Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

win32:Bubnix-I[Rtk], modrá smrt

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
Uživatelský avatar
Svitiplyn
Návštěvník
Návštěvník
Příspěvky: 87
Registrován: 15 srp 2010 08:51

win32:Bubnix-I[Rtk], modrá smrt

#1 Příspěvek od Svitiplyn »

Dobrý den, včera z ničeho nic Avast vyskočil a nahlásil vir, dal jsem smazat, poté hned vyskočil druhý, opět jsem dal smazat a vyskočil ještě třetí, to už jsem nezmohl nic, protože se mi počítač začal šíleně sekat, tak jsem resetoval pc. Jakmile se mi počítač spouštěl a nabíhala obrazovka, kde projíždí ten modrý váleček a startuje se windows, mi vyskočila modrá smrt. Modrá smrt mi vyskakuje vždycky když se pokouším počítač spustit normálně, po skončení nabíhání windows. Počítač mi jde spustit v nouzovém režimu, zapl jsem avasta a našel mi Rootkit Win32:Bubnix-I [Rtk]. Byl bych rád kdyby jste mi prohlídli můj log a pomohli mi vyřešit problém. Předem dík


Logfile of random's system information tool 1.08 (written by random/random)
Run by Martin at 2010-08-15 10:11:45
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 26 GB (9%) free of 305 GB
Total RAM: 3070 MB (89% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:12:11, on 15.8.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Martin\Plocha\RSIT.exe
C:\Program Files\trend micro\Martin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://update.microsoft.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://secure.lavasoft.com/single/redi ... NewVersion
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: 190.210.56.155 taleworlds.com
O1 - Hosts: 190.210.56.155 http://www.taleworlds.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Breakpoint Manager(system32)] C:\WINDOWS\ws2dll.exe
O4 - HKLM\..\Run: [Config] C:\Program Files\Microsoft Games\Age Of Empires ii\Config.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [GAINWARD] C:\Program Files\EXPERTool\TBPanel.exe /A
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\TEMP\E_S274.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: updpxe32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Stáhnout &vše FlashGetem - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Stáhnout FlashGetem - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (file missing)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - Unknown owner - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 7040 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl - C:\Program Files\FlashGet\jccatch.dll [2007-06-29 94308]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-12 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-04-12 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}]
FlashGet GetFlash Class - C:\Program Files\FlashGet\getflash.dll [2007-05-16 163840]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-10-16 16855552]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2007-10-11 1826816]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"Breakpoint Manager(system32)"=C:\WINDOWS\ws2dll.exe []
"Config"=C:\Program Files\Microsoft Games\Age Of Empires ii\Config.exe [2006-07-06 151552]
"WheelMouse"=C:\Program Files\A4Tech\Mouse\Amoumain.exe [2007-05-15 204800]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-06-03 1144104]
"nwiz"=C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [2010-07-07 1753192]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2010-07-09 13923432]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2010-07-09 110696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"GAINWARD"=C:\Program Files\EXPERTool\TBPanel.exe [2008-10-21 2177576]
"TuneUp MemOptimizer"=C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe [2008-06-20 153856]
"EPSON Stylus DX8400 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE [2007-04-12 182272]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

C:\Documents and Settings\Martin\Nabídka Start\Programy\Po spuštění
updpxe32.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableStatusMessages"=0
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"ForceClassicControlPanel"=1
"NoInternetIcon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoInternetIcon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\THQ\Titan Quest Immortal Throne\Tqit.exe"="C:\Program Files\THQ\Titan Quest Immortal Throne\Tqit.exe:*:Enabled:Tqit"
"C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\PlayLogic\Ancient Wars - Sparta\AWE.exe"="C:\Program Files\PlayLogic\Ancient Wars - Sparta\AWE.exe:*:Enabled:AWE"
"C:\Program Files\Electronic Arts\Command & Conquer 3\RetailExe\1.0\cnc3game.dat"="C:\Program Files\Electronic Arts\Command & Conquer 3\RetailExe\1.0\cnc3game.dat:*:Enabled:Command & Conquer 3 Tiberium Wars"
"C:\Program Files\Warcraft III\war3.exe"="C:\Program Files\Warcraft III\war3.exe:*:Enabled:Warcraft III"
"C:\Program Files\Activision\Call of Duty - World at War\CoDWaW_LANFixed.exe"="C:\Program Files\Activision\Call of Duty - World at War\CoDWaW_LANFixed.exe:*:Enabled:Call of Duty(R): World at War Campaign/Coop"
"C:\Program Files\Electronic Arts\Command & Conquer 3\RetailExe\1.4\cnc3game.dat"="C:\Program Files\Electronic Arts\Command & Conquer 3\RetailExe\1.4\cnc3game.dat:*:Enabled:Command & Conquer 3 Tiberium Wars"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Program Files\Codemasters\Operation Flashpoint\FlashpointResistance.exe"="C:\Program Files\Codemasters\Operation Flashpoint\FlashpointResistance.exe:*:Enabled:Operation Flashpoint"
"C:\Program Files\Codemasters\Operace Flashpoint\FlashpointResistance.exe"="C:\Program Files\Codemasters\Operace Flashpoint\FlashpointResistance.exe:*:Enabled:Operation Flashpoint"
"C:\Program Files\Garena\Garena.exe"="C:\Program Files\Garena\Garena.exe:*:Enabled:Garena"
"C:\Program Files\worms armageddon\WA.exe"="C:\Program Files\worms armageddon\WA.exe:*:Enabled:Worms Armageddon"
"C:\Program Files\World of Warcraft\Launcher.exe"="C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\Program Files\World of Warcraft\WoW-3.2.0-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-3.2.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"C:\Program Files\PacSteamT\SteamApps\svitiplyn\half-life\hl.exe"="C:\Program Files\PacSteamT\SteamApps\svitiplyn\half-life\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\PacSteamT\SteamApps\svitiplyn\half-life 2 deathmatch\hl2.exe"="C:\Program Files\PacSteamT\SteamApps\svitiplyn\half-life 2 deathmatch\hl2.exe:*:Enabled:hl2"
"C:\Program Files\PacSteamT\SteamApps\svitiplyn\garrysmod\hl2.exe"="C:\Program Files\PacSteamT\SteamApps\svitiplyn\garrysmod\hl2.exe:*:Enabled:hl2"
"C:\Program Files\PacSteamT\SteamApps\svitiplyn\team fortress 2\hl2.exe"="C:\Program Files\PacSteamT\SteamApps\svitiplyn\team fortress 2\hl2.exe:*:Enabled:hl2"
"C:\MARTIN\Games\Heroes of newerth\1 Verze\hon.exe"="C:\MARTIN\Games\Heroes of newerth\1 Verze\hon.exe:*:Enabled:Heroes of Newerth"
"C:\WINDOWS\alg.exe"="C:\WINDOWS\alg.exe:*:Enabled:alg"
"C:\MARTIN\Games\GRID\GRID.exe"="C:\MARTIN\Games\GRID\GRID.exe:*:Enabled:GRID Executable"
"C:\MARTIN\Downloads\GRID\GRID.exe"="C:\MARTIN\Downloads\GRID\GRID.exe:*:Enabled:GRID Executable"
"C:\MARTIN\Downloads\Heroes of newerth\1 Verze\hon.exe"="C:\MARTIN\Downloads\Heroes of newerth\1 Verze\hon.exe:*:Enabled:Heroes of Newerth"
"đţC:\WINDOWS\cmd.exe"="C:\WINDOWS\cmd.exe:*:Enabled:ErrorReporting"
"C:\WINDOWS\system32\winupdater.exe"="winu"
"C:\Program Files\Ubisoft\The Settlers 7 - Paths to a Kingdom\Data\Base\_Dbg\Bin\Release\Settlers7R.exe"="C:\Program Files\Ubisoft\The Settlers 7 - Paths to a Kingdom\Data\Base\_Dbg\Bin\Release\Settlers7R.exe:*:Enabled:The Settlers 7 - Paths to a Kingdom"
"C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe"="C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe:*:Enabled:Ubisoft Game Launcher"
"C:\Program Files\Ubisoft\Funatics\The Settlers II - 10th Anniversary\bin\S2DNG.exe"="C:\Program Files\Ubisoft\Funatics\The Settlers II - 10th Anniversary\bin\S2DNG.exe:*:Enabled:S2DNG"
"C:\WINDOWS\ws2dll.exe"="C:\WINDOWS\ws2dll.exe:*:Enabled:ErrorReporting"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold Crusader.exe"="C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold Crusader.exe:*:Enabled:Stronghold Crusader"
"C:\MARTIN\Downloads\Age of Empires 2 + Conquerors [CZ] - no instal, full, no pass\aoe2\age2_x1.exe"="C:\MARTIN\Downloads\Age of Empires 2 + Conquerors [CZ] - no instal, full, no pass\aoe2\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"C:\Program Files\Microsoft Games\Age of Empires II\Age2_x1\Age2_x1.exe"="C:\Program Files\Microsoft Games\Age of Empires II\Age2_x1\Age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Mount&Blade Warband\mb_warband.exe"="C:\Program Files\Mount&Blade Warband\mb_warband.exe:*:Enabled:Mount&Blade: Warband"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe"="C:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV"
"C:\Program Files\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe"="C:\Program Files\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe:*:Enabled:Battlefield: Bad Company™ 2"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\Program Files\Dragon Age\bin_ship\daorigins.exe"="C:\Program Files\Dragon Age\bin_ship\daorigins.exe:*:Enabled:Dragon Age Origins Game"
"C:\Program Files\Dragon Age\DAOriginsLauncher.exe"="C:\Program Files\Dragon Age\DAOriginsLauncher.exe:*:Enabled:Dragon Age Origins Launcher"
"C:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe"="C:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe:*:Enabled:Dragon Age Origins Updater"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"C:\Program Files\League of Legends\Air\LolClient.exe"="C:\Program Files\League of Legends\Air\LolClient.exe:*:Enabled:League of Legends Lobby"
"C:\Program Files\League of Legends\Game\League of Legends.exe"="C:\Program Files\League of Legends\Game\League of Legends.exe:*:Enabled:League of Legends Game Client"
"C:\Program Files\Electronic Arts\The Battle for Middle-earth (tm) II\game.dat"="C:\Program Files\Electronic Arts\The Battle for Middle-earth (tm) II\game.dat:*:Enabled:The Battle for Middle-earth(tm) II"
"C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe"="C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Steam\steamapps\common\mafia ii - public demo\launcher.exe"="C:\Program Files\Steam\steamapps\common\mafia ii - public demo\launcher.exe:*:Enabled:Mafia II - Demo"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

======List of files/folders created in the last 1 months======

2010-08-15 10:11:46 ----D---- C:\Program Files\trend micro
2010-08-15 10:11:45 ----D---- C:\rsit
2010-08-14 16:18:12 ----A---- C:\WINDOWS\ntbtlog.txt
2010-08-14 16:13:06 ----A---- C:\WINDOWS\system32\drivers\Changer.sys
2010-08-12 00:07:03 ----D---- C:\Program Files\Mafia2
2010-08-11 23:55:37 ----D---- C:\Program Files\Steam
2010-08-04 17:01:16 ----A---- C:\WINDOWS\WORDPAD.INI
2010-08-04 01:23:20 ----A---- C:\WINDOWS\game.ini
2010-08-03 23:27:09 ----D---- C:\Documents and Settings\Martin\Data aplikací\My Battle for Middle-earth(tm) II Files
2010-08-03 23:04:08 ----D---- C:\Program Files\Electronic Arts
2010-08-03 12:02:02 ----D---- C:\Program Files\Common Files\Akamai
2010-07-31 11:59:46 ----D---- C:\Program Files\Hamachi
2010-07-31 10:41:02 ----A---- C:\WINDOWS\system32\drivers\mstee.sys
2010-07-31 10:40:57 ----A---- C:\WINDOWS\system32\dxdllreg.exe
2010-07-20 14:11:43 ----D---- C:\Documents and Settings\Martin\Data aplikací\LolClient
2010-07-20 02:35:08 ----A---- C:\WINDOWS\system32\XAudio2_7.dll
2010-07-20 02:35:08 ----A---- C:\WINDOWS\system32\XAPOFX1_5.dll
2010-07-20 02:35:08 ----A---- C:\WINDOWS\system32\xactengine3_7.dll
2010-07-20 02:35:07 ----A---- C:\WINDOWS\system32\d3dx11_43.dll
2010-07-20 02:35:07 ----A---- C:\WINDOWS\system32\d3dcsx_43.dll
2010-07-20 02:35:07 ----A---- C:\WINDOWS\system32\D3DCompiler_43.dll
2010-07-20 02:35:06 ----A---- C:\WINDOWS\system32\d3dx10_43.dll
2010-07-20 02:35:05 ----A---- C:\WINDOWS\system32\D3DX9_43.dll
2010-07-20 02:18:53 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-07-20 02:16:03 ----D---- C:\Program Files\League of Legends
2010-07-20 02:04:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\PMB Files
2010-07-20 02:03:52 ----D---- C:\Program Files\Pando Networks

======List of files/folders modified in the last 1 months======

2010-08-15 10:11:46 ----RD---- C:\Program Files
2010-08-15 10:09:33 ----D---- C:\WINDOWS\Temp
2010-08-14 16:43:08 ----D---- C:\MARTIN
2010-08-14 16:26:52 ----D---- C:\WINDOWS\system32
2010-08-14 16:25:19 ----SHD---- C:\WINDOWS\CSC
2010-08-14 16:18:12 ----D---- C:\WINDOWS
2010-08-14 16:13:06 ----D---- C:\WINDOWS\system32\drivers
2010-08-14 16:13:03 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-08-14 16:12:30 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2010-08-14 12:20:13 ----D---- C:\WINDOWS\system32\CatRoot2
2010-08-14 11:45:07 ----D---- C:\Program Files\Warcraft III
2010-08-14 11:18:10 ----D---- C:\WINDOWS\Prefetch
2010-08-14 10:32:24 ----SHD---- C:\WINDOWS\Installer
2010-08-13 23:21:30 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-08-13 21:31:21 ----D---- C:\Documents and Settings\Martin\Data aplikací\Hamachi
2010-08-12 16:52:57 ----D---- C:\Documents and Settings\Martin\Data aplikací\vlc
2010-08-12 10:57:49 ----D---- C:\Program Files\NVIDIA Corporation
2010-08-12 10:57:33 ----D---- C:\WINDOWS\system32\DirectX
2010-08-12 10:57:32 ----HD---- C:\WINDOWS\inf
2010-08-12 10:57:05 ----RSD---- C:\WINDOWS\assembly
2010-08-12 00:12:48 ----D---- C:\Program Files\Common Files
2010-08-11 13:49:57 ----D---- C:\Program Files\Garena
2010-08-05 14:33:51 ----D---- C:\Program Files\Heroes of Newerth
2010-08-04 22:09:19 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2010-08-04 21:04:37 ----D---- C:\Program Files\Activision
2010-08-04 01:32:35 ----HD---- C:\Program Files\InstallShield Installation Information
2010-08-04 00:14:32 ----D---- C:\WINDOWS\Help
2010-08-04 00:12:52 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-08-03 12:03:48 ----D---- C:\WINDOWS\WinSxS
2010-07-31 19:08:25 ----D---- C:\Program Files\DIFX
2010-07-31 10:41:28 ----D---- C:\WINDOWS\RegisteredPackages
2010-07-31 10:33:49 ----A---- C:\WINDOWS\avisplitter.INI
2010-07-31 02:22:23 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-07-30 22:36:07 ----A---- C:\WINDOWS\NeroDigital.ini
2010-07-30 17:22:28 ----D---- C:\Program Files\Mozilla Firefox
2010-07-20 02:35:00 ----HD---- C:\WINDOWS\msdownld.tmp
2010-07-20 02:22:09 ----D---- C:\Documents and Settings\Martin\Data aplikací\Adobe
2010-07-20 02:22:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI VIA; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-14 61696]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-06-10 45648]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a); C:\WINDOWS\System32\drivers\sfdrv01a.sys [2006-07-05 63352]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2006-06-14 13680]
R0 sfsync04;StarForce Protection Synchronization Driver (version 4.x); C:\WINDOWS\System32\drivers\sfsync04.sys [2006-08-11 59776]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-12-19 691696]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R3 Amusbprt;A4Tech HID-compliant Mouse Driver; C:\WINDOWS\system32\DRIVERS\Amusbprt.sys [2007-05-14 14336]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2010-07-31 17480]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2007-06-28 45824]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2007-06-28 20480]
S1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
S1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
S1 Amfilter;A4Tech Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\Amfilter.sys [2007-05-14 9216]
S1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
S1 BIOS;BIOS; \??\C:\WINDOWS\system32\drivers\BIOS.sys []
S2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
S2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
S3 a6m3pxgk;a6m3pxgk; C:\WINDOWS\system32\drivers\a6m3pxgk.sys []
S3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
S3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\Martin\LOCALS~1\Temp\KIWBD.tmp []
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-10-16 4615168]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2010-07-10 10604128]
S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-12-19 47360]
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-10 611664]
S2 Akamai;Akamai NetSession Interface; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
S2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
S2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-04-12 153376]
S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2010-07-09 155752]
S2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-08-04 75064]
S2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2010-08-14 214520]
S2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater; C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe []
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-12-19 355584]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
(c) Svitiplyn
Nahoru
Uživatelský avatar
Svitiplyn
Návštěvník
Návštěvník
Příspěvky: 87
Registrován: 15 srp 2010 08:51

Re: win32:Bubnix-I[Rtk], modrá smrt

#2 Příspěvek od Svitiplyn »

Vyčistil jsem pc CClenerem a udělal nový log, snad to usnadní práci.

Logfile of random's system information tool 1.08 (written by random/random)
Run by Martin at 2010-08-15 12:53:03
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 30 GB (10%) free of 305 GB
Total RAM: 3070 MB (89% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:53:10, on 15.8.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QIP\qip.exe
C:\Documents and Settings\Martin\Plocha\RSIT.exe
C:\Program Files\trend micro\Martin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://update.microsoft.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://secure.lavasoft.com/single/redi ... NewVersion
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: 190.210.56.155 taleworlds.com
O1 - Hosts: 190.210.56.155 http://www.taleworlds.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Breakpoint Manager(system32)] C:\WINDOWS\ws2dll.exe
O4 - HKLM\..\Run: [Config] C:\Program Files\Microsoft Games\Age Of Empires ii\Config.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [GAINWARD] C:\Program Files\EXPERTool\TBPanel.exe /A
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\TEMP\E_S274.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: updpxe32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Stáhnout &vše FlashGetem - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Stáhnout FlashGetem - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (file missing)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - Unknown owner - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 7024 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl - C:\Program Files\FlashGet\jccatch.dll [2007-06-29 94308]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-12 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-04-12 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}]
FlashGet GetFlash Class - C:\Program Files\FlashGet\getflash.dll [2007-05-16 163840]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-10-16 16855552]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2007-10-11 1826816]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"Breakpoint Manager(system32)"=C:\WINDOWS\ws2dll.exe []
"Config"=C:\Program Files\Microsoft Games\Age Of Empires ii\Config.exe [2006-07-06 151552]
"WheelMouse"=C:\Program Files\A4Tech\Mouse\Amoumain.exe [2007-05-15 204800]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-06-03 1144104]
"nwiz"=C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [2010-07-07 1753192]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2010-07-09 13923432]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2010-07-09 110696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"GAINWARD"=C:\Program Files\EXPERTool\TBPanel.exe [2008-10-21 2177576]
"TuneUp MemOptimizer"=C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe [2008-06-20 153856]
"EPSON Stylus DX8400 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE [2007-04-12 182272]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

C:\Documents and Settings\Martin\Nabídka Start\Programy\Po spuštění
updpxe32.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableStatusMessages"=0
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"ForceClassicControlPanel"=1
"NoInternetIcon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoInternetIcon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\THQ\Titan Quest Immortal Throne\Tqit.exe"="C:\Program Files\THQ\Titan Quest Immortal Throne\Tqit.exe:*:Enabled:Tqit"
"C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\PlayLogic\Ancient Wars - Sparta\AWE.exe"="C:\Program Files\PlayLogic\Ancient Wars - Sparta\AWE.exe:*:Enabled:AWE"
"C:\Program Files\Electronic Arts\Command & Conquer 3\RetailExe\1.0\cnc3game.dat"="C:\Program Files\Electronic Arts\Command & Conquer 3\RetailExe\1.0\cnc3game.dat:*:Enabled:Command & Conquer 3 Tiberium Wars"
"C:\Program Files\Warcraft III\war3.exe"="C:\Program Files\Warcraft III\war3.exe:*:Enabled:Warcraft III"
"C:\Program Files\Activision\Call of Duty - World at War\CoDWaW_LANFixed.exe"="C:\Program Files\Activision\Call of Duty - World at War\CoDWaW_LANFixed.exe:*:Enabled:Call of Duty(R): World at War Campaign/Coop"
"C:\Program Files\Electronic Arts\Command & Conquer 3\RetailExe\1.4\cnc3game.dat"="C:\Program Files\Electronic Arts\Command & Conquer 3\RetailExe\1.4\cnc3game.dat:*:Enabled:Command & Conquer 3 Tiberium Wars"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Program Files\Codemasters\Operation Flashpoint\FlashpointResistance.exe"="C:\Program Files\Codemasters\Operation Flashpoint\FlashpointResistance.exe:*:Enabled:Operation Flashpoint"
"C:\Program Files\Codemasters\Operace Flashpoint\FlashpointResistance.exe"="C:\Program Files\Codemasters\Operace Flashpoint\FlashpointResistance.exe:*:Enabled:Operation Flashpoint"
"C:\Program Files\Garena\Garena.exe"="C:\Program Files\Garena\Garena.exe:*:Enabled:Garena"
"C:\Program Files\worms armageddon\WA.exe"="C:\Program Files\worms armageddon\WA.exe:*:Enabled:Worms Armageddon"
"C:\Program Files\World of Warcraft\Launcher.exe"="C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\Program Files\World of Warcraft\WoW-3.2.0-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-3.2.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"C:\Program Files\PacSteamT\SteamApps\svitiplyn\half-life\hl.exe"="C:\Program Files\PacSteamT\SteamApps\svitiplyn\half-life\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\PacSteamT\SteamApps\svitiplyn\half-life 2 deathmatch\hl2.exe"="C:\Program Files\PacSteamT\SteamApps\svitiplyn\half-life 2 deathmatch\hl2.exe:*:Enabled:hl2"
"C:\Program Files\PacSteamT\SteamApps\svitiplyn\garrysmod\hl2.exe"="C:\Program Files\PacSteamT\SteamApps\svitiplyn\garrysmod\hl2.exe:*:Enabled:hl2"
"C:\Program Files\PacSteamT\SteamApps\svitiplyn\team fortress 2\hl2.exe"="C:\Program Files\PacSteamT\SteamApps\svitiplyn\team fortress 2\hl2.exe:*:Enabled:hl2"
"C:\MARTIN\Games\Heroes of newerth\1 Verze\hon.exe"="C:\MARTIN\Games\Heroes of newerth\1 Verze\hon.exe:*:Enabled:Heroes of Newerth"
"C:\WINDOWS\alg.exe"="C:\WINDOWS\alg.exe:*:Enabled:alg"
"C:\MARTIN\Games\GRID\GRID.exe"="C:\MARTIN\Games\GRID\GRID.exe:*:Enabled:GRID Executable"
"C:\MARTIN\Downloads\GRID\GRID.exe"="C:\MARTIN\Downloads\GRID\GRID.exe:*:Enabled:GRID Executable"
"C:\MARTIN\Downloads\Heroes of newerth\1 Verze\hon.exe"="C:\MARTIN\Downloads\Heroes of newerth\1 Verze\hon.exe:*:Enabled:Heroes of Newerth"
"đţC:\WINDOWS\cmd.exe"="C:\WINDOWS\cmd.exe:*:Enabled:ErrorReporting"
"C:\WINDOWS\system32\winupdater.exe"="winu"
"C:\Program Files\Ubisoft\The Settlers 7 - Paths to a Kingdom\Data\Base\_Dbg\Bin\Release\Settlers7R.exe"="C:\Program Files\Ubisoft\The Settlers 7 - Paths to a Kingdom\Data\Base\_Dbg\Bin\Release\Settlers7R.exe:*:Enabled:The Settlers 7 - Paths to a Kingdom"
"C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe"="C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe:*:Enabled:Ubisoft Game Launcher"
"C:\Program Files\Ubisoft\Funatics\The Settlers II - 10th Anniversary\bin\S2DNG.exe"="C:\Program Files\Ubisoft\Funatics\The Settlers II - 10th Anniversary\bin\S2DNG.exe:*:Enabled:S2DNG"
"C:\WINDOWS\ws2dll.exe"="C:\WINDOWS\ws2dll.exe:*:Enabled:ErrorReporting"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold Crusader.exe"="C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold Crusader.exe:*:Enabled:Stronghold Crusader"
"C:\MARTIN\Downloads\Age of Empires 2 + Conquerors [CZ] - no instal, full, no pass\aoe2\age2_x1.exe"="C:\MARTIN\Downloads\Age of Empires 2 + Conquerors [CZ] - no instal, full, no pass\aoe2\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"C:\Program Files\Microsoft Games\Age of Empires II\Age2_x1\Age2_x1.exe"="C:\Program Files\Microsoft Games\Age of Empires II\Age2_x1\Age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Mount&Blade Warband\mb_warband.exe"="C:\Program Files\Mount&Blade Warband\mb_warband.exe:*:Enabled:Mount&Blade: Warband"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe"="C:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV"
"C:\Program Files\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe"="C:\Program Files\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe:*:Enabled:Battlefield: Bad Company™ 2"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\Program Files\Dragon Age\bin_ship\daorigins.exe"="C:\Program Files\Dragon Age\bin_ship\daorigins.exe:*:Enabled:Dragon Age Origins Game"
"C:\Program Files\Dragon Age\DAOriginsLauncher.exe"="C:\Program Files\Dragon Age\DAOriginsLauncher.exe:*:Enabled:Dragon Age Origins Launcher"
"C:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe"="C:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe:*:Enabled:Dragon Age Origins Updater"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"C:\Program Files\League of Legends\Air\LolClient.exe"="C:\Program Files\League of Legends\Air\LolClient.exe:*:Enabled:League of Legends Lobby"
"C:\Program Files\League of Legends\Game\League of Legends.exe"="C:\Program Files\League of Legends\Game\League of Legends.exe:*:Enabled:League of Legends Game Client"
"C:\Program Files\Electronic Arts\The Battle for Middle-earth (tm) II\game.dat"="C:\Program Files\Electronic Arts\The Battle for Middle-earth (tm) II\game.dat:*:Enabled:The Battle for Middle-earth(tm) II"
"C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe"="C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Steam\steamapps\common\mafia ii - public demo\launcher.exe"="C:\Program Files\Steam\steamapps\common\mafia ii - public demo\launcher.exe:*:Enabled:Mafia II - Demo"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

======List of files/folders created in the last 1 months======

2010-08-15 12:50:52 ----D---- C:\Program Files\CCleaner
2010-08-15 10:11:46 ----D---- C:\Program Files\trend micro
2010-08-15 10:11:45 ----D---- C:\rsit
2010-08-14 16:13:06 ----A---- C:\WINDOWS\system32\drivers\Changer.sys
2010-08-12 00:07:03 ----D---- C:\Program Files\Mafia2
2010-08-11 23:55:37 ----D---- C:\Program Files\Steam
2010-08-04 17:01:16 ----A---- C:\WINDOWS\WORDPAD.INI
2010-08-04 01:23:20 ----A---- C:\WINDOWS\game.ini
2010-08-03 23:27:09 ----D---- C:\Documents and Settings\Martin\Data aplikací\My Battle for Middle-earth(tm) II Files
2010-08-03 23:04:08 ----D---- C:\Program Files\Electronic Arts
2010-08-03 12:02:02 ----D---- C:\Program Files\Common Files\Akamai
2010-07-31 11:59:46 ----D---- C:\Program Files\Hamachi
2010-07-31 10:41:02 ----A---- C:\WINDOWS\system32\drivers\mstee.sys
2010-07-31 10:40:57 ----A---- C:\WINDOWS\system32\dxdllreg.exe
2010-07-20 14:11:43 ----D---- C:\Documents and Settings\Martin\Data aplikací\LolClient
2010-07-20 02:35:08 ----A---- C:\WINDOWS\system32\XAudio2_7.dll
2010-07-20 02:35:08 ----A---- C:\WINDOWS\system32\XAPOFX1_5.dll
2010-07-20 02:35:08 ----A---- C:\WINDOWS\system32\xactengine3_7.dll
2010-07-20 02:35:07 ----A---- C:\WINDOWS\system32\d3dx11_43.dll
2010-07-20 02:35:07 ----A---- C:\WINDOWS\system32\d3dcsx_43.dll
2010-07-20 02:35:07 ----A---- C:\WINDOWS\system32\D3DCompiler_43.dll
2010-07-20 02:35:06 ----A---- C:\WINDOWS\system32\d3dx10_43.dll
2010-07-20 02:35:05 ----A---- C:\WINDOWS\system32\D3DX9_43.dll
2010-07-20 02:18:53 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-07-20 02:16:03 ----D---- C:\Program Files\League of Legends
2010-07-20 02:04:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\PMB Files
2010-07-20 02:03:52 ----D---- C:\Program Files\Pando Networks

======List of files/folders modified in the last 1 months======

2010-08-15 12:51:48 ----D---- C:\WINDOWS\Debug
2010-08-15 12:51:48 ----D---- C:\WINDOWS
2010-08-15 12:51:47 ----D---- C:\WINDOWS\Temp
2010-08-15 12:50:52 ----RD---- C:\Program Files
2010-08-15 12:50:29 ----D---- C:\MARTIN
2010-08-15 12:29:18 ----D---- C:\WINDOWS\system32\CatRoot2
2010-08-15 11:39:19 ----D---- C:\WINDOWS\system32
2010-08-14 16:25:19 ----SHD---- C:\WINDOWS\CSC
2010-08-14 16:13:06 ----D---- C:\WINDOWS\system32\drivers
2010-08-14 16:13:03 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-08-14 16:12:30 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2010-08-14 11:45:07 ----D---- C:\Program Files\Warcraft III
2010-08-14 11:18:10 ----D---- C:\WINDOWS\Prefetch
2010-08-14 10:32:24 ----SHD---- C:\WINDOWS\Installer
2010-08-13 21:31:21 ----D---- C:\Documents and Settings\Martin\Data aplikací\Hamachi
2010-08-12 16:52:57 ----D---- C:\Documents and Settings\Martin\Data aplikací\vlc
2010-08-12 10:57:49 ----D---- C:\Program Files\NVIDIA Corporation
2010-08-12 10:57:33 ----D---- C:\WINDOWS\system32\DirectX
2010-08-12 10:57:32 ----HD---- C:\WINDOWS\inf
2010-08-12 10:57:05 ----RSD---- C:\WINDOWS\assembly
2010-08-12 00:12:48 ----D---- C:\Program Files\Common Files
2010-08-11 13:49:57 ----D---- C:\Program Files\Garena
2010-08-05 14:33:51 ----D---- C:\Program Files\Heroes of Newerth
2010-08-04 22:09:19 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2010-08-04 21:04:37 ----D---- C:\Program Files\Activision
2010-08-04 01:32:35 ----HD---- C:\Program Files\InstallShield Installation Information
2010-08-04 00:14:32 ----D---- C:\WINDOWS\Help
2010-08-04 00:12:52 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-08-03 12:03:48 ----D---- C:\WINDOWS\WinSxS
2010-07-31 19:08:25 ----D---- C:\Program Files\DIFX
2010-07-31 10:41:28 ----D---- C:\WINDOWS\RegisteredPackages
2010-07-31 10:33:49 ----A---- C:\WINDOWS\avisplitter.INI
2010-07-31 02:22:23 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-07-30 22:36:07 ----A---- C:\WINDOWS\NeroDigital.ini
2010-07-30 17:22:28 ----D---- C:\Program Files\Mozilla Firefox
2010-07-20 02:35:00 ----HD---- C:\WINDOWS\msdownld.tmp
2010-07-20 02:22:09 ----D---- C:\Documents and Settings\Martin\Data aplikací\Adobe
2010-07-20 02:22:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI VIA; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-14 61696]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-06-10 45648]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a); C:\WINDOWS\System32\drivers\sfdrv01a.sys [2006-07-05 63352]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2006-06-14 13680]
R0 sfsync04;StarForce Protection Synchronization Driver (version 4.x); C:\WINDOWS\System32\drivers\sfsync04.sys [2006-08-11 59776]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-12-19 691696]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R3 Amusbprt;A4Tech HID-compliant Mouse Driver; C:\WINDOWS\system32\DRIVERS\Amusbprt.sys [2007-05-14 14336]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2010-07-31 17480]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2007-06-28 45824]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2007-06-28 20480]
S1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
S1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
S1 Amfilter;A4Tech Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\Amfilter.sys [2007-05-14 9216]
S1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
S1 BIOS;BIOS; \??\C:\WINDOWS\system32\drivers\BIOS.sys []
S2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
S2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
S3 a6m3pxgk;a6m3pxgk; C:\WINDOWS\system32\drivers\a6m3pxgk.sys []
S3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
S3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\Martin\LOCALS~1\Temp\KIWBD.tmp []
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-10-16 4615168]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2010-07-10 10604128]
S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-12-19 47360]
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-10 611664]
S2 Akamai;Akamai NetSession Interface; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
S2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
S2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-04-12 153376]
S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2010-07-09 155752]
S2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-08-04 75064]
S2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2010-08-14 214520]
S2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater; C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe []
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-12-19 355584]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
(c) Svitiplyn
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: win32:Bubnix-I[Rtk], modrá smrt

#3 Příspěvek od vyosek »

Zdravim a pekny podvecer preji :)

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
:arrow: Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  • Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
  • Vložte do PC vsechny USB klice (flash disky, ext.disky apod.)
  • Pokud mate Win XP spustte pod uctem Spravce\Administratora
  • Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
  • Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
  • Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
  • Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
  • Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
  • Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Svitiplyn
Návštěvník
Návštěvník
Příspěvky: 87
Registrován: 15 srp 2010 08:51

Re: win32:Bubnix-I[Rtk], modrá smrt

#4 Příspěvek od Svitiplyn »

ComboFix 10-08-14.06 - Martin 15.08.2010 16:39:35.1.2 - x86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3070.2649 [GMT 2:00]
Spuštěný z: c:\documents and settings\Martin\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100808-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\driver
c:\windows\cmd.exe
c:\windows\system32\xudps.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-07-15 do 2010-08-15 )))))))))))))))))))))))))))))))
.

2010-08-15 10:50 . 2010-08-15 10:50 -------- d-----w- c:\program files\CCleaner
2010-08-15 08:11 . 2010-08-15 10:53 -------- d-----w- c:\program files\trend micro
2010-08-15 08:11 . 2010-08-15 08:12 -------- d-----w- C:\rsit
2010-08-14 14:26 . 2010-08-15 09:39 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-14 14:13 . 2010-08-15 14:41 755200 ----a-w- c:\windows\system32\drivers\Changer.sys
2010-08-11 22:07 . 2010-08-11 22:08 -------- d-----w- c:\program files\Mafia2
2010-08-11 21:55 . 2010-08-14 10:20 -------- d-----w- c:\program files\Steam
2010-08-03 22:13 . 2010-08-11 22:20 232968 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-08-03 22:13 . 2010-08-11 22:20 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-08-03 22:13 . 2010-08-11 22:15 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-08-03 21:04 . 2010-08-03 21:04 -------- d-----w- c:\program files\Electronic Arts
2010-08-03 10:02 . 2010-08-14 13:28 -------- d-----w- c:\program files\Common Files\Akamai
2010-07-31 09:59 . 2010-07-31 09:59 -------- d-----w- c:\program files\Hamachi
2010-07-31 08:41 . 2002-12-11 22:14 5504 -c--a-w- c:\windows\system32\dllcache\mstee.sys
2010-07-31 08:41 . 2002-12-11 22:14 5504 ----a-w- c:\windows\system32\drivers\mstee.sys
2010-07-31 08:40 . 2005-12-05 16:07 63696 ----a-w- c:\windows\system32\dxdllreg.exe
2010-07-31 08:40 . 2002-08-29 01:41 31744 -c--a-w- c:\windows\system32\dllcache\pid.dll
2010-07-20 00:35 . 2010-06-02 02:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll
2010-07-20 00:35 . 2010-06-02 02:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll
2010-07-20 00:35 . 2010-06-02 02:55 239960 ----a-w- c:\windows\system32\xactengine3_7.dll
2010-07-20 00:35 . 2010-05-26 09:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll
2010-07-20 00:35 . 2010-05-26 09:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll
2010-07-20 00:35 . 2010-05-26 09:41 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll
2010-07-20 00:35 . 2010-05-26 09:41 470880 ----a-w- c:\windows\system32\d3dx10_43.dll
2010-07-20 00:35 . 2010-05-26 09:41 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
2010-07-20 00:18 . 2010-07-20 00:18 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-07-20 00:16 . 2010-08-06 20:06 -------- d-----w- c:\program files\League of Legends
2010-07-20 00:04 . 2010-07-20 00:04 -------- d-----w- c:\documents and settings\All Users\Data aplikac
2010-07-20 00:03 . 2010-07-20 00:03 -------- d-----w- c:\program files\Pando Networks

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-15 14:41 . 2010-08-14 14:13 755200 ----a-w- c:\windows\system32\drivers\Changer.sys
2010-08-15 10:58 . 2009-12-18 20:10 98304 ----a-w- c:\windows\DUMP54c7.tmp
2010-08-14 14:13 . 2009-12-19 09:36 0 ----a-w- c:\windows\system32\drivers\tbpanel.sys
2010-08-14 14:12 . 2009-12-20 09:44 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-08-14 14:12 . 2009-12-20 09:44 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-08-14 09:45 . 2009-12-19 12:35 -------- d-----w- c:\program files\Warcraft III
2010-08-12 08:57 . 2009-12-19 16:50 -------- d-----w- c:\program files\NVIDIA Corporation
2010-08-11 11:49 . 2010-03-25 20:01 -------- d-----w- c:\program files\Garena
2010-08-05 12:33 . 2010-07-04 19:36 -------- d-----w- c:\program files\Heroes of Newerth
2010-08-04 20:09 . 2009-12-20 09:44 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-08-04 19:04 . 2009-12-20 08:49 -------- d-----w- c:\program files\Activision
2010-08-03 23:32 . 2009-12-19 09:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-31 17:08 . 2009-12-19 09:48 -------- d-----w- c:\program files\DIFX
2010-07-31 09:59 . 2009-12-19 10:08 17480 ----a-w- c:\windows\system32\drivers\hamachi.sys
2010-07-31 00:22 . 2001-10-25 14:00 77850 ----a-w- c:\windows\system32\perfc005.dat
2010-07-31 00:22 . 2001-10-25 14:00 428744 ----a-w- c:\windows\system32\perfh005.dat
2010-07-11 16:57 . 2010-04-14 10:43 -------- d-----w- c:\program files\DivX
2010-07-11 16:55 . 2010-07-11 16:55 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-07-10 08:22 . 2009-12-19 09:42 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-07-10 08:22 . 2010-07-10 08:06 -------- d-----w- c:\program files\Common Files\BioWare
2010-07-09 14:24 . 2010-07-09 14:24 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-07-07 11:46 . 2009-12-19 09:37 604776 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-07-06 12:50 . 2010-02-15 22:32 -------- d-----w- c:\program files\WoW
2010-06-29 07:12 . 2009-12-19 10:05 -------- d-----w- c:\program files\FlashGet
2010-06-27 09:56 . 2010-06-14 13:29 -------- d-----w- c:\program files\WoW Classic
2010-06-27 09:06 . 2010-06-27 09:06 1700352 ----a-w- c:\windows\system32\gdiplus.dll
2010-06-27 07:40 . 2009-12-19 14:44 -------- d-----w- c:\program files\Rockstar Games
2010-06-24 20:03 . 2010-06-14 17:04 -------- d-----w- c:\program files\Cheat Engine
2010-06-09 23:01 . 2010-07-11 16:57 126448 ------w- c:\windows\system32\pxinsi64.exe
2010-06-09 23:01 . 2010-07-11 16:57 123888 ------w- c:\windows\system32\pxcpyi64.exe
2010-06-09 23:01 . 2010-05-30 17:20 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys
2010-06-09 23:01 . 2010-05-30 17:20 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2010-06-09 23:01 . 2010-05-30 17:20 45648 ------w- c:\windows\system32\drivers\PxHelp20.sys
2010-06-09 23:01 . 2010-05-30 17:20 133616 ------w- c:\windows\system32\pxafs.dll
2010-06-09 16:20 . 2010-07-14 20:49 2444656 ----a-w- c:\windows\system32\pbsvc_apb.exe
2010-05-29 16:16 . 2009-12-19 09:52 107132 ----a-w- c:\windows\UninstallFirefox.exe
2010-05-29 16:16 . 2009-12-19 09:52 2398 ----a-w- c:\windows\mozver.dat
2010-04-25 08:25 . 2010-04-25 08:25 16896 --sh--w- c:\windows\aceimh.exe
2010-05-06 18:37 . 2010-05-06 18:37 32768 --sh--w- c:\windows\dkggzr.exe
2010-05-06 13:03 . 2010-05-06 13:03 32768 --sh--w- c:\windows\fnvbvy.exe
2010-05-07 18:57 . 2010-05-07 18:57 32768 --sh--w- c:\windows\jolbsa.exe
2010-05-06 13:42 . 2010-05-06 13:42 32768 --sh--w- c:\windows\ooncdk.exe
2010-05-06 18:36 . 2010-05-06 18:36 32768 --sh--w- c:\windows\rnvzsv.exe
2010-05-05 18:54 . 2010-05-05 18:54 32768 --sh--w- c:\windows\sotpza.exe
2010-05-05 18:30 . 2010-05-05 18:30 32768 --sh--w- c:\windows\uodgsz.exe
2010-05-14 06:13 . 2010-05-14 06:13 15360 --sh--w- c:\windows\ws2dll.exe
2010-04-23 08:45 . 2010-04-23 08:45 16896 --sh--w- c:\windows\xljujw.exe
2010-05-10 19:49 . 2010-05-10 19:49 32768 --sh--w- c:\windows\zbuwct.exe
2006-05-03 10:06 . 2010-01-28 20:52 163328 --sh--r- c:\windows\system32\flvDX.dll
2010-05-14 15:53 . 2010-05-14 15:53 169 --sha-w- c:\windows\system32\install_mgr_wup.exe
2007-02-21 11:47 . 2010-01-28 20:52 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2010-01-28 20:52 216064 --sh--r- c:\windows\system32\nbDX.dll
2010-05-14 14:15 . 2010-05-14 14:15 32768 --sha-w- c:\windows\system32\skabwz.exe
2010-05-14 16:10 . 2010-05-14 16:10 13824 --sha-w- c:\windows\system32\updater64.exeexe.exe
2010-05-14 16:10 . 2010-05-14 16:10 13824 --sh--w- c:\windows\system32\drivers\csrss64.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2008-10-21 2177576]
"TuneUp MemOptimizer"="c:\program files\TuneUp Utilities 2008\MemOptimizer.exe" [2008-06-20 153856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552]
"SkyTel"="SkyTel.EXE" [2007-10-11 1826816]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Config"="c:\program files\Microsoft Games\Age Of Empires ii\Config.exe" [2006-07-06 151552]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-05-15 204800]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-04-14 100352]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\FlashGet\\flashget.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Warcraft III\\war3.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\Codemasters\\Operace Flashpoint\\FlashpointResistance.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\MARTIN\\Downloads\\GRID\\GRID.exe"=
"c:\\MARTIN\\Downloads\\Heroes of newerth\\1 Verze\\hon.exe"=
"c:\\Program Files\\Ubisoft\\The Settlers 7 - Paths to a Kingdom\\Data\\Base\\_Dbg\\Bin\\Release\\Settlers7R.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\Age2_x1\\Age2_x1.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\League of Legends\\Air\\LolClient.exe"=
"c:\\Program Files\\League of Legends\\Game\\League of Legends.exe"=
"c:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\mafia ii - public demo\\launcher.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"WinUpdate.exe"= 6667:TCP
"57034:TCP"= 57034:TCP:Pando Media Booster
"57034:UDP"= 57034:UDP:Pando Media Booster
"8394:TCP"= 8394:TCP:League of Legends Launcher
"8394:UDP"= 8394:UDP:League of Legends Launcher
"6952:TCP"= 6952:TCP:League of Legends Launcher
"6952:UDP"= 6952:UDP:League of Legends Launcher

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5.7.2006 14:46 63352]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.12.2009 12:10 691696]
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [19.12.2009 11:58 114768]
S1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [19.12.2009 11:44 13696]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [14.4.2008 8:52 14336]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [19.12.2009 11:58 20560]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe --> c:\program files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\Martin\LOCALS~1\Temp\KIWBD.tmp --> c:\docume~1\Martin\LOCALS~1\Temp\KIWBD.tmp [?]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - Changer

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-08-14 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-04-16 08:09]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
uInternet Connection Wizard,ShellNext = https://secure.lavasoft.com/single/redi ... NewVersion
IE: &Stáhnout &vše FlashGetem - c:\program files\FlashGet\jc_all.htm
IE: &Stáhnout FlashGetem - c:\program files\FlashGet\jc_link.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Martin\Data aplikací\Mozilla\Firefox\Profiles\m57e1lv5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - About:Blank
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-Run-Breakpoint Manager(system32) - c:\windows\ws2dll.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-15 16:41
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Akamai]
"ServiceDll"="C:/Program Files/Common Files/Akamai/rswin_3725.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Akamai]
"ServiceDll"="C:/Program Files/Common Files/Akamai/rswin_3725.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\Martin\LOCALS~1\Temp\KIWBD.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Changer]

.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1275210071-630328440-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:f3,b4,8a,3d,0c,98,84,af,9b,40,da,5a,78,68,f9,23,5a,ab,ba,d6,d3,f4,ec,
dd,7c,02,a7,53,67,23,62,e9,85,5b,f6,fe,a3,8e,e4,52,dd,c0,90,72,c1,a3,f1,ce,\
"??"=hex:fa,c6,ee,c3,8a,d0,e0,f9,03,57,b2,91,51,6b,bf,c9
.
Celkový čas: 2010-08-15 16:42:36
ComboFix-quarantined-files.txt 2010-08-15 14:42

Před spuštěním: Volných bajtů: 31 288 254 464
Po spuštění: Volných bajtů: 31 253 426 176

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS
[operating systems]
d:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 6F324720355BE3DCA21F970593B32DB3
(c) Svitiplyn
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: win32:Bubnix-I[Rtk], modrá smrt

#5 Příspěvek od vyosek »

:arrow: Nasledujici soubory otestujte na VirusTotalu (viz muj podpis)
  • c:\windows\system32\drivers\Changer.sys
    c:\windows\aceimh.exe
    c:\windows\dkggzr.exe
    c:\windows\fnvbvy.exe
    c:\windows\jolbsa.exe
    c:\windows\ooncdk.exe
    c:\windows\rnvzsv.exe
    c:\windows\sotpza.exe
    c:\windows\uodgsz.exe
    c:\windows\ws2dll.exe
    c:\windows\xljujw.exe
    c:\windows\zbuwct.exe
    c:\windows\system32\pbsvc_apb.exe
  • Kliknete na Prochazet
  • Soubor nehledejte, jen vlozte cestu souboru, ktery chci otestovat
  • Pokud napise Soubor byl jiz testovan, dejte otestovat znovu
  • Kliknete na Otestovat soubor
  • Vysledek analyzy sem vlozte (jako odkaz)
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Svitiplyn
Návštěvník
Návštěvník
Příspěvky: 87
Registrován: 15 srp 2010 08:51

Re: win32:Bubnix-I[Rtk], modrá smrt

#6 Příspěvek od Svitiplyn »

Ten první soubor Chynger.sys mi nejak neslo oskenovat. Exe soubory (od aceimh.exe po zbuwct.ece) ve složce c/:windows nemám. Šel mi oskenovat pouze ten poslední c:\windows\system32\pbsvc_apb.exe a přesně nevím co zde mám vložit, tak se pokusím sem dát co my to vyplivlo.

MD5: c41d4df5ccaad4fe084c808f3d3f302c
Date first seen: 2010-06-26 07:14:33 (UTC)
Date last seen: 2010-06-26 07:14:33 (UTC)
Detection ratio: 0/40

File name:
4A5A666770E4293D4DC42525824C9800839B7C36.exe
Submission date:
2010-06-26 07:14:33 (UTC)
Current status:
finished
Result:
0 /40 (0.0%)

Antivirus Version Last Update Result
a-squared 5.0.0.30 2010.06.26 -
AhnLab-V3 2010.06.26.00 2010.06.26 -
AntiVir 8.2.4.2 2010.06.25 -
Antiy-AVL 2.0.3.7 2010.06.25 -
Authentium 5.2.0.5 2010.06.25 -
Avast 4.8.1351.0 2010.06.25 -
Avast5 5.0.332.0 2010.06.25 -
AVG 9.0.0.836 2010.06.25 -
BitDefender 7.2 2010.06.26 -
CAT-QuickHeal 10.00 2010.06.26 -
ClamAV 0.96.0.3-git 2010.06.26 -
Comodo 5220 2010.06.26 -
DrWeb 5.0.2.03300 2010.06.26 -
eSafe 7.0.17.0 2010.06.24 -
eTrust-Vet 36.1.7668 2010.06.25 -
F-Prot 4.6.1.107 2010.06.25 -
F-Secure 9.0.15370.0 2010.06.25 -
Fortinet 4.1.133.0 2010.06.25 -
GData 21 2010.06.26 -
Ikarus T3.1.1.84.0 2010.06.26 -
Jiangmin 13.0.900 2010.06.25 -
Kaspersky 7.0.0.125 2010.06.26 -
McAfee 5.400.0.1158 2010.06.26 -
McAfee-GW-Edition 2010.1 2010.06.25 -
Microsoft 1.5902 2010.06.25 -
NOD32 5230 2010.06.26 -
Norman 6.05.10 2010.06.25 -
nProtect 2010-06-25.01 2010.06.25 -
Panda 10.0.2.7 2010.06.25 -
PCTools 7.0.3.5 2010.06.26 -
Rising 22.53.04.05 2010.06.25 -
Sophos 4.54.0 2010.06.26 -
Sunbelt 6509 2010.06.26 -
Symantec 20101.1.0.89 2010.06.26 -
TheHacker 6.5.2.0.303 2010.06.25 -
TrendMicro 9.120.0.1004 2010.06.26 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.26 -
VBA32 3.12.12.5 2010.06.25 -
ViRobot 2010.6.26.3906 2010.06.26 -
VirusBuster 5.0.27.0 2010.06.25 -
Additional information
Show all
MD5 : c41d4df5ccaad4fe084c808f3d3f302c
SHA1 : 2510ffddaf7d146e6e6af64b23a29e332dd2f1b0
SHA256: feafad19b3aa5759cda0c2ade59e7cfcea587ba8c88d9aef27284f8ab0c00a4f
(c) Svitiplyn
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: win32:Bubnix-I[Rtk], modrá smrt

#7 Příspěvek od vyosek »

Psalo to nejakou chybu proc ten prvni c:\windows\system32\drivers\Changer.sys nesel otestovat :???:
Pripadne jej zkuste otestovat zde http://virusscan.jotti.org/cs
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Svitiplyn
Návštěvník
Návštěvník
Příspěvky: 87
Registrován: 15 srp 2010 08:51

Re: win32:Bubnix-I[Rtk], modrá smrt

#8 Příspěvek od Svitiplyn »

Nenapsalo to nic, pouze znova nacetla stejná stránka znova a když jsem to zkoušel na té druhé stránce píše to soubor je prázdný ( bajtů).
(c) Svitiplyn
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: win32:Bubnix-I[Rtk], modrá smrt

#9 Příspěvek od vyosek »

Fajn, to mi jako odpoved staci :wink:

:arrow: Pokud nemate, tak presunte Combofix na plochu
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    File::
c:\windows\DUMP54c7.tmp
c:\windows\ws2dll.exe

Collect::
C:\Documents and Settings\Martin\Nabídka Start\Programy\Po spuštění\updpxe32.exe

Registry::
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Breakpoint Manager(system32)"=-

Folder::
c:\program files\Common Files\Akamai

Driver::
Akamai
GarenaPEngine
  • Ulozte vytvoreny TXT jako CFScript.txt
  • Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
    Obrázek
  • Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
:arrow: Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Svitiplyn
Návštěvník
Návštěvník
Příspěvky: 87
Registrován: 15 srp 2010 08:51

Re: win32:Bubnix-I[Rtk], modrá smrt

#10 Příspěvek od Svitiplyn »

Absolutně netuším co se stalo. Přišel jsem po koupeli a vidím konečně úvodní obrazovku normálního windowsu. Blikalo mi tu v pozadí dělší dobu, že mám čekat než kombofix dokončí svou práci, ale zdálo se mi nějaké zaseklé, protože uběhlo déle jak 20 minut, tak jsem dal křížek. V :c nemám log. Mám ještě něco udělat ? Celkem se bojím restartovat počítač, protože nevím co proběhlo, když jsem tu nebyl ? Myslíte že to je ok ? Mám udělat nějak další log ?
(c) Svitiplyn
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: win32:Bubnix-I[Rtk], modrá smrt

#11 Příspěvek od vyosek »

Nalogujte se do nouzoveho rezimu: restart PC - mackat F8 - zvolit Stav nouze s praci v siti...
Stahnete na plochu Combofix ale nespoustejte
Pak pouzijte postup se skriptem - vytvorit skript - pretahnout nad CF...
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Svitiplyn
Návštěvník
Návštěvník
Příspěvky: 87
Registrován: 15 srp 2010 08:51

Re: win32:Bubnix-I[Rtk], modrá smrt

#12 Příspěvek od Svitiplyn »

Restartoval jsem pc a zase naskočila modrá smrt, takže to není v pohodě ještě. Jdu teda znova na ten combofix s tím scriptem, ale když to pak udělám, hlásí mi to, že tu mám zaplý avast ochraný štít a není v liště, takže nelze vypnout a v procesech nevím jaký má název, ale nic podobnýho s názvem avast tam není. Jdu teda znova na ten combofix, i když mi to upozornění s avastem. Snad se ten log teď podaří!
(c) Svitiplyn
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: win32:Bubnix-I[Rtk], modrá smrt

#13 Příspěvek od vyosek »

No skript asi neprobehl proto ta BSOD :wink:

Pripadne pokud se budou objevovat dale, tak necham kolegu prozkoumat cim to je zpusobeno...
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Uživatelský avatar
Svitiplyn
Návštěvník
Návštěvník
Příspěvky: 87
Registrován: 15 srp 2010 08:51

Re: win32:Bubnix-I[Rtk], modrá smrt

#14 Příspěvek od Svitiplyn »

Poprvé mi to vyhodilo nějakou chybu o prázdné tabulce a restartl se pc. Po druhé už mi to konečně vyplivlo ten log, ani pc se mi nerestartoval, jenom se to hned ukázalo.

ComboFix 10-08-14.06 - Martin 15.08.2010 20:33:22.4.2 - x86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3070.2703 [GMT 2:00]
Spuštěný z: c:\documents and settings\Martin\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Martin\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100808-1] *On-access scanning enabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\windows\DUMP54c7.tmp"
"c:\windows\ws2dll.exe"
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-07-15 do 2010-08-15 )))))))))))))))))))))))))))))))
.

2010-08-15 17:57 . 2010-08-15 18:11 -------- d-----w- c:\windows\LastGood.Tmp
2010-08-15 10:50 . 2010-08-15 10:50 -------- d-----w- c:\program files\CCleaner
2010-08-15 08:11 . 2010-08-15 10:53 -------- d-----w- c:\program files\trend micro
2010-08-15 08:11 . 2010-08-15 08:12 -------- d-----w- C:\rsit
2010-08-14 14:26 . 2010-08-15 17:35 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-14 14:13 . 2010-08-15 18:35 755200 ----a-w- c:\windows\system32\drivers\Changer.sys
2010-08-11 22:07 . 2010-08-11 22:08 -------- d-----w- c:\program files\Mafia2
2010-08-11 21:55 . 2010-08-14 10:20 -------- d-----w- c:\program files\Steam
2010-08-03 22:13 . 2010-08-11 22:20 232968 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-08-03 22:13 . 2010-08-11 22:20 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-08-03 22:13 . 2010-08-11 22:15 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-08-03 21:04 . 2010-08-03 21:04 -------- d-----w- c:\program files\Electronic Arts
2010-07-31 09:59 . 2010-07-31 09:59 -------- d-----w- c:\program files\Hamachi
2010-07-31 08:41 . 2002-12-11 22:14 5504 -c--a-w- c:\windows\system32\dllcache\mstee.sys
2010-07-31 08:41 . 2002-12-11 22:14 5504 ----a-w- c:\windows\system32\drivers\mstee.sys
2010-07-31 08:40 . 2005-12-05 16:07 63696 ----a-w- c:\windows\system32\dxdllreg.exe
2010-07-31 08:40 . 2002-08-29 01:41 31744 -c--a-w- c:\windows\system32\dllcache\pid.dll
2010-07-20 00:35 . 2010-06-02 02:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll
2010-07-20 00:35 . 2010-06-02 02:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll
2010-07-20 00:35 . 2010-06-02 02:55 239960 ----a-w- c:\windows\system32\xactengine3_7.dll
2010-07-20 00:35 . 2010-05-26 09:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll
2010-07-20 00:35 . 2010-05-26 09:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll
2010-07-20 00:35 . 2010-05-26 09:41 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll
2010-07-20 00:35 . 2010-05-26 09:41 470880 ----a-w- c:\windows\system32\d3dx10_43.dll
2010-07-20 00:35 . 2010-05-26 09:41 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
2010-07-20 00:18 . 2010-07-20 00:18 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-07-20 00:16 . 2010-08-06 20:06 -------- d-----w- c:\program files\League of Legends
2010-07-20 00:04 . 2010-07-20 00:04 -------- d-----w- c:\documents and settings\All Users\Data aplikac
2010-07-20 00:03 . 2010-07-20 00:03 -------- d-----w- c:\program files\Pando Networks

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-15 18:35 . 2010-08-14 14:13 755200 ----a-w- c:\windows\system32\drivers\Changer.sys
2010-08-15 17:48 . 2009-12-18 20:10 98304 ----a-w- c:\windows\DUMP4e4e.tmp
2010-08-14 14:13 . 2009-12-19 09:36 0 ----a-w- c:\windows\system32\drivers\tbpanel.sys
2010-08-14 14:12 . 2009-12-20 09:44 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-08-14 14:12 . 2009-12-20 09:44 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-08-14 09:45 . 2009-12-19 12:35 -------- d-----w- c:\program files\Warcraft III
2010-08-12 08:57 . 2009-12-19 16:50 -------- d-----w- c:\program files\NVIDIA Corporation
2010-08-11 11:49 . 2010-03-25 20:01 -------- d-----w- c:\program files\Garena
2010-08-05 12:33 . 2010-07-04 19:36 -------- d-----w- c:\program files\Heroes of Newerth
2010-08-04 20:09 . 2009-12-20 09:44 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-08-04 19:04 . 2009-12-20 08:49 -------- d-----w- c:\program files\Activision
2010-08-03 23:32 . 2009-12-19 09:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-31 17:08 . 2009-12-19 09:48 -------- d-----w- c:\program files\DIFX
2010-07-31 09:59 . 2009-12-19 10:08 17480 ----a-w- c:\windows\system32\drivers\hamachi.sys
2010-07-31 00:22 . 2001-10-25 14:00 77850 ----a-w- c:\windows\system32\perfc005.dat
2010-07-31 00:22 . 2001-10-25 14:00 428744 ----a-w- c:\windows\system32\perfh005.dat
2010-07-11 16:57 . 2010-04-14 10:43 -------- d-----w- c:\program files\DivX
2010-07-11 16:55 . 2010-07-11 16:55 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-07-10 08:22 . 2009-12-19 09:42 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-07-10 08:22 . 2010-07-10 08:06 -------- d-----w- c:\program files\Common Files\BioWare
2010-07-09 14:24 . 2010-07-09 14:24 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-07-07 11:46 . 2009-12-19 09:37 604776 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-07-06 12:50 . 2010-02-15 22:32 -------- d-----w- c:\program files\WoW
2010-06-29 07:12 . 2009-12-19 10:05 -------- d-----w- c:\program files\FlashGet
2010-06-27 09:56 . 2010-06-14 13:29 -------- d-----w- c:\program files\WoW Classic
2010-06-27 09:06 . 2010-06-27 09:06 1700352 ----a-w- c:\windows\system32\gdiplus.dll
2010-06-27 07:40 . 2009-12-19 14:44 -------- d-----w- c:\program files\Rockstar Games
2010-06-24 20:03 . 2010-06-14 17:04 -------- d-----w- c:\program files\Cheat Engine
2010-06-09 23:01 . 2010-07-11 16:57 126448 ------w- c:\windows\system32\pxinsi64.exe
2010-06-09 23:01 . 2010-07-11 16:57 123888 ------w- c:\windows\system32\pxcpyi64.exe
2010-06-09 23:01 . 2010-05-30 17:20 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys
2010-06-09 23:01 . 2010-05-30 17:20 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2010-06-09 23:01 . 2010-05-30 17:20 45648 ------w- c:\windows\system32\drivers\PxHelp20.sys
2010-06-09 23:01 . 2010-05-30 17:20 133616 ------w- c:\windows\system32\pxafs.dll
2010-06-09 16:20 . 2010-07-14 20:49 2444656 ----a-w- c:\windows\system32\pbsvc_apb.exe
2010-05-29 16:16 . 2009-12-19 09:52 107132 ----a-w- c:\windows\UninstallFirefox.exe
2010-05-29 16:16 . 2009-12-19 09:52 2398 ----a-w- c:\windows\mozver.dat
2010-04-25 08:25 . 2010-04-25 08:25 16896 --sh--w- c:\windows\aceimh.exe
2010-05-06 18:37 . 2010-05-06 18:37 32768 --sh--w- c:\windows\dkggzr.exe
2010-05-06 13:03 . 2010-05-06 13:03 32768 --sh--w- c:\windows\fnvbvy.exe
2010-05-07 18:57 . 2010-05-07 18:57 32768 --sh--w- c:\windows\jolbsa.exe
2010-05-06 13:42 . 2010-05-06 13:42 32768 --sh--w- c:\windows\ooncdk.exe
2010-05-06 18:36 . 2010-05-06 18:36 32768 --sh--w- c:\windows\rnvzsv.exe
2010-05-05 18:54 . 2010-05-05 18:54 32768 --sh--w- c:\windows\sotpza.exe
2010-05-05 18:30 . 2010-05-05 18:30 32768 --sh--w- c:\windows\uodgsz.exe
2010-04-23 08:45 . 2010-04-23 08:45 16896 --sh--w- c:\windows\xljujw.exe
2010-05-10 19:49 . 2010-05-10 19:49 32768 --sh--w- c:\windows\zbuwct.exe
2006-05-03 10:06 . 2010-01-28 20:52 163328 --sh--r- c:\windows\system32\flvDX.dll
2010-05-14 15:53 . 2010-05-14 15:53 169 --sha-w- c:\windows\system32\install_mgr_wup.exe
2007-02-21 11:47 . 2010-01-28 20:52 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2010-01-28 20:52 216064 --sh--r- c:\windows\system32\nbDX.dll
2010-05-14 14:15 . 2010-05-14 14:15 32768 --sha-w- c:\windows\system32\skabwz.exe
2010-05-14 16:10 . 2010-05-14 16:10 13824 --sha-w- c:\windows\system32\updater64.exeexe.exe
2010-05-14 16:10 . 2010-05-14 16:10 13824 --sh--w- c:\windows\system32\drivers\csrss64.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-08-15_14.41.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-08-15 17:58 . 2010-08-15 17:58 5120 c:\windows\Installer\{789289CA-F73A-4A16-A331-54D498CE069F}\Icon789289CA.exe
- 2010-08-14 08:32 . 2010-08-14 08:32 5120 c:\windows\Installer\{789289CA-F73A-4A16-A331-54D498CE069F}\Icon789289CA.exe
+ 2010-08-14 14:13 . 2010-08-15 18:35 755200 c:\windows\system32\drivers\Changer.sys
- 2010-08-14 14:13 . 2010-08-15 14:41 755200 c:\windows\system32\drivers\Changer.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2008-10-21 2177576]
"TuneUp MemOptimizer"="c:\program files\TuneUp Utilities 2008\MemOptimizer.exe" [2008-06-20 153856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552]
"SkyTel"="SkyTel.EXE" [2007-10-11 1826816]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Config"="c:\program files\Microsoft Games\Age Of Empires ii\Config.exe" [2006-07-06 151552]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-05-15 204800]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-04-14 100352]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\FlashGet\\flashget.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Warcraft III\\war3.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\Codemasters\\Operace Flashpoint\\FlashpointResistance.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\MARTIN\\Downloads\\GRID\\GRID.exe"=
"c:\\MARTIN\\Downloads\\Heroes of newerth\\1 Verze\\hon.exe"=
"c:\\Program Files\\Ubisoft\\The Settlers 7 - Paths to a Kingdom\\Data\\Base\\_Dbg\\Bin\\Release\\Settlers7R.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\Age2_x1\\Age2_x1.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\League of Legends\\Air\\LolClient.exe"=
"c:\\Program Files\\League of Legends\\Game\\League of Legends.exe"=
"c:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\mafia ii - public demo\\launcher.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"WinUpdate.exe"= 6667:TCP
"57034:TCP"= 57034:TCP:Pando Media Booster
"57034:UDP"= 57034:UDP:Pando Media Booster
"8394:TCP"= 8394:TCP:League of Legends Launcher
"8394:UDP"= 8394:UDP:League of Legends Launcher
"6952:TCP"= 6952:TCP:League of Legends Launcher
"6952:UDP"= 6952:UDP:League of Legends Launcher

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5.7.2006 14:46 63352]
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [19.12.2009 11:58 114768]
S1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [19.12.2009 11:44 13696]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [19.12.2009 11:58 20560]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe --> c:\program files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.12.2009 12:10 691696]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - Changer

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-08-15 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-04-16 08:09]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
uInternet Connection Wizard,ShellNext = https://secure.lavasoft.com/single/redi ... NewVersion
IE: &Stáhnout &vše FlashGetem - c:\program files\FlashGet\jc_all.htm
IE: &Stáhnout FlashGetem - c:\program files\FlashGet\jc_link.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Martin\Data aplikací\Mozilla\Firefox\Profiles\m57e1lv5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - About:Blank
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-15 20:35
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Changer]

.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1275210071-630328440-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:f3,b4,8a,3d,0c,98,84,af,9b,40,da,5a,78,68,f9,23,5a,ab,ba,d6,d3,f4,ec,
dd,7c,02,a7,53,67,23,62,e9,85,5b,f6,fe,a3,8e,e4,52,dd,c0,90,72,c1,a3,f1,ce,\
"??"=hex:fa,c6,ee,c3,8a,d0,e0,f9,03,57,b2,91,51,6b,bf,c9
.
Celkový čas: 2010-08-15 20:35:56
ComboFix-quarantined-files.txt 2010-08-15 18:35
ComboFix2.txt 2010-08-15 18:30
ComboFix3.txt 2010-08-15 14:42

Před spuštěním: Volných bajtů: 31 128 813 568
Po spuštění: Volných bajtů: 31 114 227 712

- - End Of File - - 117CF4D452C1F37EB16CB0EDF138BFD1
(c) Svitiplyn
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: win32:Bubnix-I[Rtk], modrá smrt

#15 Příspěvek od vyosek »

:arrow: Odinstalujte vsechny emulatory virtualnich jednotek (Deamon Tools, Alcohol 120%, PowerISO apod)

:arrow: Stahnete SPTD http://www.duplexsecure.com/en/downloads
  • Vyberte z uvedene stranky verzi dle sveho operacniho systemu (32(x86)bit ci 64(x64)bit)
  • Ulozte na plochu a spustte
  • Zvolte moznost Uninstall a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte
:arrow: Stahnete Defogger http://www.jpshortstuff.247fixes.com/Defogger.exe
  • Ulozte na plochu a spustte
  • Kliknete na Disable a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte
:arrow: Stahnete MBR na plochu http://www2.gmer.net/mbr/mbr.exe

:arrow: Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R
  • Vyskoci na Vas okenko, do ktereho zkopirujte text nize

  • Kód: Vybrat vše

    "%userprofile%\plocha\mbr" -t
  • Kliknete na OK
  • Na plose se Vam vytvori log s nazvem mbr.txt, jeho obsah mi sem vlozte
:arrow: Dejte logy z Gmeru - viz muj podpis
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“