VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Prosím o kontrolu logu - Infikované soubory

https://forum.viry.cz:443/viewtopic.php?t=112383

Stránka 1 z 2

Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 07:45
od Thooty
Dobré dopoledne,
Včera jsem měl problém s pozadím ikonek, zkoušel jsem vše co bylo na IT fórech popsáno a nic nefungovalo, tak mi už nezbývalo nic jiného než proskenovat počítač a zjistit, zda to není práce viru a jak jsem zjistil tak ano.
S tím že jsem dělal sken včera jsem už smazal některé viry a to:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceActiveDesktopOn (PUM.Hijack.Desktop)
Tento vir byl ve stejném registru jako ActiveDesktop, což mě hned napadlo že ten bude asi znepříjemňovat vzhled plochy a znepřístupňovat mi změnu pozadí ikonek apod. (Po odstranění zmizlo pozadí ikonek :))

c:\system volume information\_restore{aea70349-f5fc-481e-a4c7-f335703ad93e}\RP189\A0181951.exe (HackTool.Agent.H) -> No action taken.
Který jak je vidět byl v Bodě Obnovy Systému, takže jsem provedl výmaz obnovy dat.

U posledních třech jsem si nebyl jistý neboť jeden má název typu "systembackup.exe" tak jsem nevěděl jestli mi to nemůže poškodit systém nebo podobně viz. log z Malwarebytes

Log z Malwarebytes

11.6.2011 0:58:44
mbam-log-2011-06-11 (00-58-36).txt

Typ: Úplná kontrola (C:\|)
Kontrolované objekty: 299326
Uplynulý čas: 1 hodin, 29 minut, 11 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 1
Infikované složky: 0
Infikované soubory: 4

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceActiveDesktopOn (PUM.Hijack.Desktop) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\documents and settings\Ja\local settings\data aplikací\thinstall\Cache\Stubs\7b8a34a9567f413f16aa229f4f46d86c4c6cf\systembackup.exe (Trojan.Backdoor) -> No action taken.
c:\documents and settings\Ja\local settings\data aplikací\thinstall\Cache\Stubs\92517a246b0e01a6939ab37cf92d84f87b76d86\spotmau_s.exe (Trojan.Backdoor) -> No action taken.
c:\documents and settings\Ja\local settings\data aplikací\thinstall\Cache\Stubs\a297573feb85ed4de7c44e703044b11c1b42ce6a\updateclient.exe (Trojan.Backdoor) -> No action taken.
c:\system volume information\_restore{aea70349-f5fc-481e-a4c7-f335703ad93e}\RP189\A0181951.exe (HackTool.Agent.H) -> No action taken.

Log z RSIT

Logfile of random's system information tool 1.08 (written by random/random)
Run by Ja at 2011-06-11 08:35:56
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 17 GB (22%) free of 76 GB
Total RAM: 1023 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:35:58, on 11.6.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Ja\Plocha\RSIT.exe
C:\Program Files\trend micro\Ja.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/sk27211/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Data aplikací\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-2052111302-2077806209-1801674531-1005\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'UpdatusUser')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 6886452515
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - https://www.battlefieldheroes.com/stati ... 0.31.0.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Advanced SystemCare Service (AdvancedSystemCareService) - IObit - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMF Service (IMFservice) - IObit - C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--
End of file - 7342 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\ASC4_AutoUpdate.job
C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2052111302-2077806209-1801674531-1004.job
C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2052111302-2077806209-1801674531-1004.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-01-30 62376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Documents and Settings\All Users\Data aplikací\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2011-04-21 386776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL [2010-02-28 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-05-30 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-05-30 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2011-01-12 2219184]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2011-05-25 13895272]
"NvMediaCenter"=NvMCTray.dll,NvTaskbarInit -login []
"nwiz"=C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [2011-05-05 1632360]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2011-05-29 449584]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 4]
C:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe [2011-05-28 412560]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Program Files\ICQ7.5\ICQ.exe [2011-04-26 124216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2011-05-29 449584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2011-05-25 13895272]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
NvMCTray.dll,NvTaskbarInit -login []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2010-05-14 1479680]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files\PowerISO\PWRISOVM.EXE [2010-04-12 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
C:\WINDOWS\RTHDCPL.EXE [2011-02-17 20029032]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-01-07 253672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Real\RealPlayer\update\realsched.exe [2011-04-21 273544]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Program Files\uTorrent\uTorrent.exe [2011-06-04 552824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ja^Nabídka Start^Programy^Po spuštění^IMVU.lnk]
[]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2010-10-28 64592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2009-01-30 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispScrSavPage"=0
"NoDispCPL"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDriveAutoRun"=67108863
"NoDrives"=0
"NoInstrumentation"=1
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=0x00000000
"ForceActiveDesktopOn"=0
"NoSetActiveDesktop"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoResolveSearch"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB.exe"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe"="C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Games\World_of_Tanks\WorldOfTanks.exe"="C:\Games\World_of_Tanks\WorldOfTanks.exe:*:Enabled:World of Tanks"
"C:\Program Files\KONAMI\Pro Evolution Soccer 2011\pes2011.exe"="C:\Program Files\KONAMI\Pro Evolution Soccer 2011\pes2011.exe:*:Enabled:Pro Evolution Soccer 2011"
"C:\Program Files\KONAMI\Pro Evolution Soccer 2011\csp2011.exe"="C:\Program Files\KONAMI\Pro Evolution Soccer 2011\csp2011.exe:*:Enabled:Pro Evolution Soccer 2011"
"C:\Program Files\Call of Duty - Modern Warfare 2\iw4mp.dat"="C:\Program Files\Call of Duty - Modern Warfare 2\iw4mp.dat:*:Enabled:iw4mp"
"C:\Documents and Settings\Ja\Plocha\Minecraft.exe"="C:\Documents and Settings\Ja\Plocha\Minecraft.exe:*:Enabled:Minecraft"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:java"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:javaw"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\EA Games\Battlefield Play4Free\BFP4f.exe"="C:\Program Files\EA Games\Battlefield Play4Free\BFP4f.exe:*:Enabled:BFP4f"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Disabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Disabled:Windows Live Messenger"
"C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"="C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe:*:Enabled:Daemonu.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"

======List of files/folders created in the last 1 months======

2011-06-11 08:35:56 ----D---- C:\rsit
2011-06-10 23:05:48 ----SHD---- C:\Config.Msi
2011-06-10 21:45:27 ----A---- C:\WINDOWS\OEWABLog.txt
2011-06-10 21:41:19 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microangelo On Display
2011-06-10 20:14:47 ----HDC---- C:\WINDOWS\$NtUninstallKB2492386$
2011-06-04 16:17:27 ----D---- C:\Documents and Settings\Ja\Data aplikací\.minecraft
2011-06-03 18:30:22 ----A---- C:\WINDOWS\system32\nvgenco322090.dll
2011-06-03 18:30:22 ----A---- C:\WINDOWS\system32\nvdispco3220150.dll
2011-06-02 23:13:27 ----A---- C:\WINDOWS\window-title-changer.INI
2011-05-31 22:10:51 ----SHD---- C:\RECYCLER
2011-05-31 21:31:55 ----D---- C:\ERDNT
2011-05-31 18:59:04 ----A---- C:\ComboFix.txt
2011-05-31 14:19:34 ----D---- C:\Documents and Settings\Ja\Data aplikací\Publish Providers
2011-05-31 14:10:41 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sony
2011-05-31 14:10:40 ----D---- C:\Program Files\Sony
2011-05-31 13:40:10 ----D---- C:\Documents and Settings\Ja\Data aplikací\Sony
2011-05-30 17:43:53 ----A---- C:\WINDOWS\iun6002.exe
2011-05-30 17:42:41 ----D---- C:\Documents and Settings\Ja\Data aplikací\PingTesterDataBas
2011-05-30 12:30:12 ----D---- C:\Program Files\Common Files\Java
2011-05-30 12:29:58 ----A---- C:\WINDOWS\system32\javaws.exe
2011-05-30 12:29:58 ----A---- C:\WINDOWS\system32\javaw.exe
2011-05-30 12:29:58 ----A---- C:\WINDOWS\system32\java.exe
2011-05-30 12:29:40 ----D---- C:\Program Files\Java
2011-05-26 20:41:04 ----D---- C:\Program Files\Call of Duty - Modern Warfare 2
2011-05-14 14:54:44 ----D---- C:\Program Files\KONAMI
2011-05-14 14:54:44 ----D---- C:\Documents and Settings\All Users\Data aplikací\KONAMI
2011-05-13 16:42:41 ----D---- C:\Program Files\Full Tilt Poker
2011-05-13 09:01:06 ----D---- C:\Games

======List of files/folders modified in the last 1 months======

2011-06-11 08:35:57 ----D---- C:\Program Files\trend micro
2011-06-11 08:15:10 ----D---- C:\WINDOWS\Temp
2011-06-11 08:14:50 ----SD---- C:\WINDOWS\Tasks
2011-06-11 08:14:30 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-06-11 01:06:21 ----D---- C:\WINDOWS\system32\drivers
2011-06-11 01:06:21 ----D---- C:\WINDOWS\srchasst
2011-06-11 01:04:06 ----D---- C:\WINDOWS\Prefetch
2011-06-10 23:27:32 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-06-10 23:05:50 ----SHD---- C:\WINDOWS\Installer
2011-06-10 23:05:49 ----D---- C:\Program Files
2011-06-10 22:41:02 ----D---- C:\WINDOWS
2011-06-10 22:39:13 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-06-10 22:39:10 ----D---- C:\WINDOWS\system32
2011-06-10 22:38:34 ----HD---- C:\WINDOWS\inf
2011-06-10 22:38:04 ----D---- C:\WINDOWS\Help
2011-06-10 22:36:25 ----D---- C:\Program Files\NVIDIA Corporation
2011-06-10 22:29:30 ----D---- C:\WINDOWS\system32\CatRoot2
2011-06-10 21:47:23 ----D---- C:\Documents and Settings
2011-06-10 21:40:55 ----D---- C:\WINDOWS\system32\Restore
2011-06-10 20:49:14 ----D---- C:\WINDOWS\AppPatch
2011-06-10 20:14:43 ----HD---- C:\WINDOWS\$hf_mig$
2011-06-10 19:59:45 ----D---- C:\Documents and Settings\Ja\Data aplikací\IObit
2011-06-10 19:59:40 ----D---- C:\Program Files\IObit
2011-06-10 18:33:32 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2011-06-10 17:33:34 ----D---- C:\Documents and Settings\Ja\Data aplikací\Skype
2011-06-10 17:25:28 ----D---- C:\Documents and Settings\Ja\Data aplikací\skypePM
2011-06-08 10:32:28 ----D---- C:\Documents and Settings\Ja\Data aplikací\uTorrent
2011-06-08 09:28:58 ----D---- C:\Program Files\Mozilla Firefox
2011-06-08 07:13:05 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-06-07 16:21:42 ----RD---- C:\Program Files\Skype
2011-06-06 07:07:37 ----D---- C:\WINDOWS\system32\LogFiles
2011-06-05 18:21:40 ----D---- C:\WINDOWS\Logs
2011-06-05 12:20:49 ----D---- C:\WINDOWS\Network Diagnostic
2011-06-04 16:16:25 ----D---- C:\Program Files\CCleaner
2011-06-04 12:32:12 ----D---- C:\Program Files\uTorrent
2011-06-01 13:12:12 ----D---- C:\Program Files\WinRAR
2011-05-31 21:32:25 ----D---- C:\WINDOWS\system32\drivers\etc
2011-05-31 18:59:06 ----D---- C:\Qoobox
2011-05-31 18:56:35 ----A---- C:\WINDOWS\system.ini
2011-05-31 18:54:34 ----D---- C:\Program Files\Common Files
2011-05-31 18:18:46 ----D---- C:\Program Files\ESET
2011-05-31 16:44:50 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2011-05-31 16:21:39 ----D---- C:\Program Files\VstPlugins
2011-05-30 21:19:34 ----RSD---- C:\WINDOWS\Fonts
2011-05-30 17:21:43 ----D---- C:\Program Files\Steam
2011-05-30 12:29:43 ----AC---- C:\WINDOWS\system32\deployJava1.dll
2011-05-29 16:03:58 ----D---- C:\Program Files\Opera
2011-05-25 09:26:22 ----A---- C:\WINDOWS\system32\nvhdap32.dll
2011-05-25 09:26:22 ----A---- C:\WINDOWS\system32\nvhdagenco322040.dll
2011-05-25 09:26:15 ----A---- C:\WINDOWS\system32\nvwddi.dll
2011-05-25 09:26:14 ----A---- C:\WINDOWS\system32\nvsvc32.exe
2011-05-25 09:26:14 ----A---- C:\WINDOWS\system32\nvrszht.dll
2011-05-25 09:26:14 ----A---- C:\WINDOWS\system32\nvrszhc.dll
2011-05-25 09:26:14 ----A---- C:\WINDOWS\system32\nvrstr.dll
2011-05-25 09:26:14 ----A---- C:\WINDOWS\system32\nvrsth.dll
2011-05-25 09:26:14 ----A---- C:\WINDOWS\system32\nvrssv.dll
2011-05-25 09:26:14 ----A---- C:\WINDOWS\system32\nvrssl.dll
2011-05-25 09:26:14 ----A---- C:\WINDOWS\system32\nvrssk.dll
2011-05-25 09:26:14 ----A---- C:\WINDOWS\system32\nvrsru.dll
2011-05-25 09:26:14 ----A---- C:\WINDOWS\system32\nvrsptb.dll
2011-05-25 09:26:14 ----A---- C:\WINDOWS\system32\nvrspt.dll
2011-05-25 09:26:14 ----A---- C:\WINDOWS\system32\nvrspl.dll
2011-05-25 09:26:14 ----A---- C:\WINDOWS\system32\nvrsno.dll
2011-05-25 09:26:13 ----A---- C:\WINDOWS\system32\nvrsnl.dll
2011-05-25 09:26:13 ----A---- C:\WINDOWS\system32\nvrsko.dll
2011-05-25 09:26:13 ----A---- C:\WINDOWS\system32\nvrsja.dll
2011-05-25 09:26:13 ----A---- C:\WINDOWS\system32\nvrsit.dll
2011-05-25 09:26:13 ----A---- C:\WINDOWS\system32\nvrshu.dll
2011-05-25 09:26:12 ----A---- C:\WINDOWS\system32\nvrshe.dll
2011-05-25 09:26:12 ----A---- C:\WINDOWS\system32\nvrsfr.dll
2011-05-25 09:26:12 ----A---- C:\WINDOWS\system32\nvrsfi.dll
2011-05-25 09:26:11 ----A---- C:\WINDOWS\system32\nvrsesm.dll
2011-05-25 09:26:11 ----A---- C:\WINDOWS\system32\nvrses.dll
2011-05-25 09:26:11 ----A---- C:\WINDOWS\system32\nvrseng.dll
2011-05-25 09:26:11 ----A---- C:\WINDOWS\system32\nvrsel.dll
2011-05-25 09:26:11 ----A---- C:\WINDOWS\system32\nvrsde.dll
2011-05-25 09:26:10 ----A---- C:\WINDOWS\system32\nvrsda.dll
2011-05-25 09:26:10 ----A---- C:\WINDOWS\system32\nvrscs.dll
2011-05-25 09:26:10 ----A---- C:\WINDOWS\system32\nvrsar.dll
2011-05-25 09:26:09 ----A---- C:\WINDOWS\system32\nvmctray.dll
2011-05-25 09:26:03 ----A---- C:\WINDOWS\system32\nvcpl.dll
2011-05-25 09:26:01 ----A---- C:\WINDOWS\system32\nvcolor.exe
2011-05-25 09:26:00 ----A---- C:\WINDOWS\system32\easyUpdatusAPIU.dll
2011-05-25 09:25:58 ----A---- C:\WINDOWS\system32\OpenCL.dll
2011-05-25 09:25:58 ----A---- C:\WINDOWS\system32\nvoglnt.dll
2011-05-25 09:25:57 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2011-05-25 09:25:57 ----A---- C:\WINDOWS\system32\nvcuvenc.dll
2011-05-25 09:25:57 ----A---- C:\WINDOWS\system32\nvcuda.dll
2011-05-25 09:25:57 ----A---- C:\WINDOWS\system32\nvcompiler.dll
2011-05-25 09:25:56 ----A---- C:\WINDOWS\system32\nvapi.dll
2011-05-25 09:25:56 ----A---- C:\WINDOWS\system32\nv4_disp.dll
2011-05-23 19:56:26 ----AC---- C:\WINDOWS\win.ini
2011-05-22 11:22:31 ----D---- C:\Documents and Settings\Ja\Data aplikací\Opera
2011-05-19 00:17:58 ----D---- C:\WINDOWS\Debug
2011-05-13 20:44:26 ----D---- C:\WINDOWS\system32\DirectX
2011-05-13 20:43:41 ----RSD---- C:\WINDOWS\assembly
2011-05-13 20:38:49 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2011-05-13 09:18:39 ----D---- C:\WINDOWS\WinSxS
2011-05-12 12:44:03 ----HD---- C:\Program Files\InstallShield Installation Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-07-12 45648]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-05-17 50176]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\WINDOWS\System32\drivers\sfsync02.sys [2005-05-16 19968]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-10-11 691696]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2011-03-11 218688]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-12-21 115008]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2010-12-21 94872]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2010-04-12 59388]
R1 Tcpip6;Ovladač protokolu Microsoft IPv6; C:\WINDOWS\system32\DRIVERS\tcpip6.sys [2010-02-11 226880]
R2 cpuz134;cpuz134; \??\C:\WINDOWS\system32\drivers\cpuz134_x32.sys []
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-12-21 141264]
R2 LBeepKE;Logitech Beep Suppression Driver; C:\WINDOWS\System32\Drivers\LBeepKE.sys [2010-08-24 10448]
R2 NwlnkIpx;Transportní protokol kompatibilní s NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-14 88320]
R2 NwlnkNb;Služba NWLink pro rozhraní NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2008-04-14 63232]
R2 NwlnkSpx;Protokol NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2008-04-14 55936]
R2 rspndr;Odpovídající zařízení zjišťování topologie linkové vrstvy; C:\WINDOWS\system32\DRIVERS\rspndr.sys [2010-01-14 62848]
R2 zumbus;Zune Bus Enumerator Driver; C:\WINDOWS\system32\DRIVERS\zumbus.sys [2010-09-24 41472]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2011-02-24 6340200]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2010-08-24 38864]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2010-08-24 37328]
R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\WINDOWS\System32\Drivers\LUsbFilt.Sys [2010-08-24 28624]
R3 MBAMProtector;MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys []
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2011-05-25 12753664]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\WINDOWS\system32\drivers\nvhda32.sys [2011-05-25 119528]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2010-07-06 234392]
R3 tunmp;Microsoft Tun Miniport Adapter Driver; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2010-01-14 12288]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
R3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2009-07-13 91904]
S1 DumpDrv;Crash Dump Driver; C:\WINDOWS\system32\drivers\DumpDrv.sys [2010-01-14 9472]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 catchme;catchme; \??\C:\DOCUME~1\Ja\LOCALS~1\Temp\catchme.sys []
S3 FLASHSYS;FLASHSYS; \??\C:\Program Files\MSI\Live Update 4\LU4\FLASHSYS.sys []
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 msloop;Microsoft Loopback Adapter Driver; C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 4992]
S3 nm;Ovladač programu Sledování sítě; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-14 40320]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2010-02-26 18176]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2010-02-26 22528]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2010-02-26 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2010-02-26 8320]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 RegFilter;RegFilter; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\wxp_x86\regfilter.sys []
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2010-02-26 8192]
S3 UrlFilter;UrlFilter; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\wxp_x86\UrlFilter.sys []
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\DRIVERS\usbser.sys [2008-04-13 26112]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2009-07-13 132224]
S4 exFat;exFat; C:\WINDOWS\system32\drivers\exFat.sys [2010-01-14 133632]
S4 FileMonitor;FileMonitor; \??\C:\Program Files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdvancedSystemCareService;Advanced SystemCare Service; C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe [2011-05-28 353168]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2011-01-12 810144]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-05-30 153376]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
R2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\system32\nvsvc32.exe [2011-05-25 154728]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-25 2214504]
R2 NwSapAgent;Agent SAP; C:\WINDOWS\system32\svchost.exe [2010-01-14 14848]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2011-04-21 75136]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2010-01-14 14848]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 IMFservice;IMF Service; C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe [2011-05-12 821080]
S3 6to4;Pomocná služba protokolu IPv6; C:\WINDOWS\system32\svchost.exe [2010-01-14 14848]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2011-01-12 33584]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe [2010-10-28 293456]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-09-29 616448]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\wmpnetwk.exe [2009-02-04 913920]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service; c:\Program Files\Zune\WMZuneComm.exe [2010-09-24 268528]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service; c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2010-09-24 444656]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2011-03-16 407336]

-----------------EOF-----------------

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 07:52
od chodnik74
Dobrý den :welcome:
nalezené položky smažte :)

Program nepoužívejte bez doporučení Rádce a pozorně se řiďte následujících pokynu,protože program netoleruje chyby a může dojít k úplnému poškození systému!!
  • :arrow: Stáhneme si Combofix Obrázek
  • Program uložíme nejlépe na Plochu
  • Vypneme všechny rezidentní štíty.Jak antiviru,tak antispywaru a firewallu
  • Vypneme všechny běžící aplikace (ICQ,prohlížeč,programy) a necháme pouze Combofix
  • Spustíme Combofix.exe s administrátorským oprávněním
    U Windows XP se přihlásíme pod účtem správce
    Ve Windows 7 a Vista klikněte pravým tlačítkem myši na Combofix.exe a dejte ,,Spustit jako správce,,)
  • Hned po startu programu na vás vyskočí licenční podmínky,tak potvrdíme tlačítkemANO
  • Pokud vám Combofix nabídne instalaci Konzoly pro zotavení,tak souhlaste a nechte nainstalovat(zde je potřeba aktivní připojení na internet)
  • Pokračujte dle pokynů programu a během skenování na nic neklikejte,na pc nepracujte(ICQ,jiné aplikace,internet..).Nechte počítač v klidu.
  • Celý sken tvá mezi 5-15 min,ale pokud je v PC hodně havěti,tak se čas může lišit.
  • Po skončení skenování(případném restartu počítače) se vám zobrazí log z Combofixu,který mi vložte sem(Kdyby se log nezobrazil,tak jej najdete zde: C:\ComboFix.txt
  • (Pokud si nevíte rady s kterýmkoliv z výše uvedených kroků,tak se ptejte nebo mrkněte na detailnější návod včetně obrázků http://www.bleepingcomputer.com/combofi ... t-combofix )

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 07:54
od chodnik74
:idea: Mimochodem,ten Combofix z 31.5....to jste spouštěl sám?

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 08:21
od Thooty
Combofix 31.5 jsem spouštěl s tím, že mě na to odkázal rádce(tehdy jsem měl problém s připojením k internetu za který mohl provider)
A ještě menší otázku bych měl, sken z Malwarebytes jsem dělal včera a po ukončení programu to samozřejmě nechce nabídnout smazání těch 3 "Trojanů", můžu tedy ty viry uložit do karantény(NOD nebo Malwarebytes?)
Děkuji předem za odpověď, jdu provést ten sken ComboFixu

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 08:32
od chodnik74
Vložte do karantény nalezené položky Malwarebytes :) Počkám na Combofix..ten taky pohledá havěť a smaže,popřípadě dočistíme :)

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 08:43
od Thooty
Soubory jsem dal tedy do karantény, udělal sken combofixu a po skenu se mi aktualizovala plocha a vratilo se zpět pozadí ikonek.

Log z Combofixu

ComboFix 11-06-10.09 - Ja 11.06.2011 9:26.4.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.698 [GMT 2:00]
Spuštěný z: c:\documents and settings\Ja\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Ja\WINDOWS
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-11 do 2011-06-11 )))))))))))))))))))))))))))))))
.
.
2011-06-11 06:35 . 2011-06-11 06:36 -------- d-----w- C:\rsit
2011-06-10 20:12 . 2011-06-10 20:12 -------- d-----w- c:\documents and settings\Ja\Local Settings\Data aplikací\PackageAware
2011-06-10 19:41 . 2011-06-10 19:41 -------- d-----w- c:\documents and settings\Ja\Local Settings\Data aplikací\Microangelo On Display
2011-06-10 19:41 . 2011-06-10 19:41 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Microangelo On Display
2011-06-04 14:17 . 2011-06-08 13:42 -------- d-----w- c:\documents and settings\Ja\Data aplikací\.minecraft
2011-06-03 16:30 . 2011-05-25 07:25 899688 ----a-w- c:\windows\system32\nvdispco3220150.dll
2011-06-03 16:30 . 2011-05-25 07:25 865896 ----a-w- c:\windows\system32\nvgenco322090.dll
2011-06-01 18:19 . 2011-06-01 18:30 -------- d-----w- c:\documents and settings\Ja\Local Settings\Data aplikací\Dxtory Software
2011-05-31 19:31 . 2011-05-31 19:32 -------- d-----w- C:\ERDNT
2011-05-31 12:19 . 2011-05-31 12:19 -------- d-----w- c:\documents and settings\Ja\Data aplikací\Publish Providers
2011-05-31 12:10 . 2011-05-31 12:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Sony
2011-05-31 12:10 . 2011-05-31 12:10 -------- d-----w- c:\program files\Sony
2011-05-31 11:56 . 2011-05-31 11:56 -------- d-----w- c:\documents and settings\Ja\Local Settings\Data aplikací\Sony
2011-05-31 11:40 . 2011-05-31 12:31 -------- d-----w- c:\documents and settings\Ja\Data aplikací\Sony
2011-05-30 15:43 . 2011-05-30 15:43 724992 ----a-w- c:\windows\iun6002.exe
2011-05-30 15:42 . 2011-05-30 15:44 -------- d-----w- c:\documents and settings\Ja\Data aplikací\PingTesterDataBas
2011-05-30 10:30 . 2011-05-30 10:30 -------- d-----w- c:\program files\Common Files\Java
2011-05-30 10:29 . 2011-05-30 10:29 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-05-30 10:29 . 2011-05-30 10:29 -------- d-----w- c:\program files\Java
2011-05-26 18:41 . 2011-06-08 13:38 -------- d-----w- c:\program files\Call of Duty - Modern Warfare 2
2011-05-14 12:54 . 2011-05-14 12:54 -------- d-----w- c:\program files\KONAMI
2011-05-14 12:54 . 2011-05-14 12:54 -------- d-----w- c:\documents and settings\All Users\Data aplikací\KONAMI
2011-05-13 14:49 . 2011-05-13 14:49 -------- d-----w- c:\documents and settings\Ja\Local Settings\Data aplikací\cache
2011-05-13 14:43 . 2011-05-13 15:17 -------- d-----w- c:\documents and settings\Ja\Local Settings\Data aplikací\FullTiltPoker
2011-05-13 14:42 . 2011-06-08 07:42 -------- d-----w- c:\program files\Full Tilt Poker
2011-05-13 07:01 . 2011-05-13 07:01 -------- d-----w- C:\Games
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-10 16:34 . 2010-10-01 21:50 138264 -c--a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-06-10 16:33 . 2010-10-01 21:51 234768 -c--a-w- c:\windows\system32\PnkBstrB.xtr
2011-06-10 16:33 . 2010-10-01 21:50 234768 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-06-10 16:22 . 2010-10-01 21:50 234768 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-05-30 10:29 . 2010-10-01 22:22 472808 -c--a-w- c:\windows\system32\deployJava1.dll
2011-05-29 07:11 . 2010-10-12 11:43 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 07:11 . 2010-10-12 11:43 22712 -c--a-w- c:\windows\system32\drivers\mbam.sys
2011-05-25 07:26 . 2011-03-31 13:37 865896 ----a-w- c:\windows\system32\nvhdagenco322040.dll
2011-05-25 07:26 . 2010-10-01 20:24 26216 ----a-w- c:\windows\system32\nvhdap32.dll
2011-05-25 07:26 . 2010-10-01 20:24 119528 ----a-w- c:\windows\system32\drivers\nvhda32.sys
2011-05-25 07:26 . 2011-04-07 20:16 54272 ----a-w- c:\windows\system32\nvwddi.dll
2011-05-25 07:26 . 2011-04-07 20:16 253952 ----a-w- c:\windows\system32\nvrsth.dll
2011-05-25 07:26 . 2011-04-07 20:16 126976 ----a-w- c:\windows\system32\nvrszht.dll
2011-05-25 07:26 . 2011-04-07 20:16 270336 ----a-w- c:\windows\system32\nvrsru.dll
2011-05-25 07:26 . 2011-04-07 20:16 258048 ----a-w- c:\windows\system32\nvrstr.dll
2011-05-25 07:26 . 2011-04-07 20:16 258048 ----a-w- c:\windows\system32\nvrssl.dll
2011-05-25 07:26 . 2011-04-07 20:16 229376 ----a-w- c:\windows\system32\nvrszhc.dll
2011-05-25 07:26 . 2011-04-07 20:16 274432 ----a-w- c:\windows\system32\nvrspt.dll
2011-05-25 07:26 . 2011-04-07 20:16 270336 ----a-w- c:\windows\system32\nvrsptb.dll
2011-05-25 07:26 . 2011-04-07 20:16 258048 ----a-w- c:\windows\system32\nvrssk.dll
2011-05-25 07:26 . 2011-04-07 20:16 258048 ----a-w- c:\windows\system32\nvrspl.dll
2011-05-25 07:26 . 2011-04-07 20:16 253952 ----a-w- c:\windows\system32\nvrssv.dll
2011-05-25 07:26 . 2011-04-07 20:16 253952 ----a-w- c:\windows\system32\nvrsno.dll
2011-05-25 07:26 . 2011-04-07 20:16 154728 ----a-w- c:\windows\system32\nvsvc32.exe
2011-05-25 07:26 . 2011-04-07 20:16 274432 ----a-w- c:\windows\system32\nvrsnl.dll
2011-05-25 07:26 . 2011-04-07 20:16 262144 ----a-w- c:\windows\system32\nvrshu.dll
2011-05-25 07:26 . 2011-04-07 20:16 282624 ----a-w- c:\windows\system32\nvrsit.dll
2011-05-25 07:26 . 2011-04-07 20:16 270336 ----a-w- c:\windows\system32\nvrsja.dll
2011-05-25 07:26 . 2011-04-07 20:16 266240 ----a-w- c:\windows\system32\nvrsko.dll
2011-05-25 07:26 . 2011-04-07 20:16 331776 ----a-w- c:\windows\system32\nvrshe.dll
2011-05-25 07:26 . 2011-04-07 20:16 286720 ----a-w- c:\windows\system32\nvrsfr.dll
2011-05-25 07:26 . 2011-04-07 20:16 249856 ----a-w- c:\windows\system32\nvrsfi.dll
2011-05-25 07:26 . 2011-04-07 20:16 282624 ----a-w- c:\windows\system32\nvrsel.dll
2011-05-25 07:26 . 2011-04-07 20:16 249856 ----a-w- c:\windows\system32\nvrseng.dll
2011-05-25 07:26 . 2011-04-07 20:16 274432 ----a-w- c:\windows\system32\nvrsesm.dll
2011-05-25 07:26 . 2011-04-07 20:16 282624 ----a-w- c:\windows\system32\nvrses.dll
2011-05-25 07:26 . 2011-04-07 20:16 278528 ----a-w- c:\windows\system32\nvrsde.dll
2011-05-25 07:26 . 2011-04-07 20:16 253952 ----a-w- c:\windows\system32\nvrsda.dll
2011-05-25 07:26 . 2011-04-07 20:16 335872 ----a-w- c:\windows\system32\nvrsar.dll
2011-05-25 07:26 . 2011-04-07 20:16 249856 ----a-w- c:\windows\system32\nvrscs.dll
2011-05-25 07:26 . 2011-04-07 20:16 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-05-25 07:26 . 2011-04-07 20:16 13895272 ----a-w- c:\windows\system32\nvcpl.dll
2011-05-25 07:26 . 2011-04-07 20:16 145000 ----a-w- c:\windows\system32\nvcolor.exe
2011-05-25 07:26 . 2011-04-07 20:16 543336 ----a-w- c:\windows\system32\easyUpdatusAPIU.dll
2011-05-25 07:25 . 2010-10-01 20:23 61440 ----a-w- c:\windows\system32\OpenCL.dll
2011-05-25 07:25 . 2010-10-01 20:23 16068608 ----a-w- c:\windows\system32\nvoglnt.dll
2011-05-25 07:25 . 2010-10-01 20:23 2808936 ----a-w- c:\windows\system32\nvcuvid.dll
2011-05-25 07:25 . 2010-10-01 20:23 2082408 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-05-25 07:25 . 2010-10-01 20:23 5332992 ----a-w- c:\windows\system32\nvcuda.dll
2011-05-25 07:25 . 2010-10-01 20:23 13004800 ----a-w- c:\windows\system32\nvcompiler.dll
2011-05-25 07:25 . 2010-10-01 20:23 12753664 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-05-25 07:25 . 2010-10-01 20:23 4198272 ----a-w- c:\windows\system32\nv4_disp.dll
2011-05-25 07:25 . 2010-10-01 20:23 2328576 ----a-w- c:\windows\system32\nvapi.dll
2011-05-25 07:16 . 2011-03-11 13:49 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-13 18:38 . 2011-01-29 12:56 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2011-05-09 10:47 . 2010-01-14 15:00 6656 -c--a-w- c:\windows\system32\lpcio.dll
2011-04-21 18:38 . 2010-10-01 21:49 75136 -c--a-w- c:\windows\system32\PnkBstrA.exe
2011-04-21 18:08 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-04-21 18:08 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-04-21 16:47 . 2010-10-01 21:50 138056 -c--a-w- c:\documents and settings\Ja\Data aplikací\PnkBstrK.sys
2011-04-14 07:47 . 2011-04-14 07:47 86016 -c--a-w- c:\windows\system32\frapsvid.dll
2011-04-08 05:14 . 2011-03-31 13:37 944232 ----a-w- c:\windows\system32\nvdispco3220140.dll
2011-04-08 05:14 . 2011-03-31 13:37 855656 ----a-w- c:\windows\system32\nvgenco322060.dll
2011-04-07 20:16 . 2011-04-07 20:16 277608 ----a-w- c:\windows\system32\nvmccs.dll
2011-06-08 07:28 . 2011-03-24 19:16 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-10-09 . FF876311F58C86EC3E1A24F585949C25 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot_2011-05-31_16.56.34 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-06-11 06:14 . 2011-06-11 06:14 16384 c:\windows\Temp\Perflib_Perfdata_60c.dat
+ 2011-06-10 19:40 . 2011-06-10 19:41 97196 c:\windows\system32\Restore\rstrlog.dat
+ 2011-06-10 20:39 . 2011-05-25 07:26 26216 c:\windows\system32\ReinstallBackups\0020\DriverFiles\nvhdap32.dll
- 2011-04-21 17:44 . 2011-03-03 15:59 26216 c:\windows\system32\ReinstallBackups\0020\DriverFiles\nvhdap32.dll
- 2011-04-21 17:44 . 2008-04-14 05:53 23552 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\wdmaud.drv
+ 2011-06-10 20:39 . 2008-04-14 05:53 23552 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\wdmaud.drv
+ 2011-06-10 20:39 . 2004-07-09 03:27 48512 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\stream.sys
- 2011-04-21 17:44 . 2004-07-09 03:27 48512 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\stream.sys
- 2011-04-21 17:44 . 2008-04-13 21:15 60160 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\drmk.sys
+ 2011-06-10 20:39 . 2008-04-13 21:15 60160 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\drmk.sys
+ 2011-06-03 16:32 . 2011-03-03 15:59 26216 c:\windows\system32\ReinstallBackups\0018\DriverFiles\nvhdap32.dll
+ 2011-06-03 16:32 . 2008-04-14 05:53 23552 c:\windows\system32\ReinstallBackups\0018\DriverFiles\i386\wdmaud.drv
+ 2011-06-03 16:32 . 2004-07-09 03:27 48512 c:\windows\system32\ReinstallBackups\0018\DriverFiles\i386\stream.sys
+ 2011-06-03 16:32 . 2008-04-13 21:15 60160 c:\windows\system32\ReinstallBackups\0018\DriverFiles\i386\drmk.sys
+ 2011-06-10 20:38 . 2011-05-25 07:26 26216 c:\windows\system32\ReinstallBackups\0017\DriverFiles\nvhdap32.dll
- 2011-04-21 17:44 . 2011-03-03 15:59 26216 c:\windows\system32\ReinstallBackups\0017\DriverFiles\nvhdap32.dll
+ 2011-06-10 20:38 . 2008-04-14 05:53 23552 c:\windows\system32\ReinstallBackups\0017\DriverFiles\i386\wdmaud.drv
- 2011-04-21 17:44 . 2008-04-14 05:53 23552 c:\windows\system32\ReinstallBackups\0017\DriverFiles\i386\wdmaud.drv
- 2011-04-21 17:44 . 2004-07-09 03:27 48512 c:\windows\system32\ReinstallBackups\0017\DriverFiles\i386\stream.sys
+ 2011-06-10 20:38 . 2004-07-09 03:27 48512 c:\windows\system32\ReinstallBackups\0017\DriverFiles\i386\stream.sys
- 2011-04-21 17:44 . 2008-04-13 21:15 60160 c:\windows\system32\ReinstallBackups\0017\DriverFiles\i386\drmk.sys
+ 2011-06-10 20:38 . 2008-04-13 21:15 60160 c:\windows\system32\ReinstallBackups\0017\DriverFiles\i386\drmk.sys
+ 2011-06-03 16:30 . 2011-04-08 05:14 61440 c:\windows\system32\ReinstallBackups\0016\DriverFiles\OpenCL.dll
+ 2011-06-10 20:38 . 2011-05-25 07:26 26216 c:\windows\system32\ReinstallBackups\0013\DriverFiles\nvhdap32.dll
- 2011-04-21 17:43 . 2011-03-03 15:59 26216 c:\windows\system32\ReinstallBackups\0013\DriverFiles\nvhdap32.dll
- 2011-04-21 17:43 . 2008-04-14 05:53 23552 c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\wdmaud.drv
+ 2011-06-10 20:38 . 2008-04-14 05:53 23552 c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\wdmaud.drv
+ 2011-06-10 20:38 . 2004-07-09 03:27 48512 c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\stream.sys
- 2011-04-21 17:43 . 2004-07-09 03:27 48512 c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\stream.sys
- 2011-04-21 17:43 . 2008-04-13 21:15 60160 c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\drmk.sys
+ 2011-06-10 20:38 . 2008-04-13 21:15 60160 c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\drmk.sys
+ 2008-04-14 11:00 . 2011-06-08 05:13 88322 c:\windows\system32\perfc009.dat
- 2008-04-14 11:00 . 2011-04-25 14:38 88322 c:\windows\system32\perfc009.dat
- 2011-04-21 17:44 . 2002-12-11 23:14 4096 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\ksuser.dll
+ 2011-06-10 20:39 . 2002-12-11 23:14 4096 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\ksuser.dll
+ 2011-06-03 16:32 . 2002-12-11 23:14 4096 c:\windows\system32\ReinstallBackups\0018\DriverFiles\i386\ksuser.dll
- 2011-04-21 17:44 . 2002-12-11 23:14 4096 c:\windows\system32\ReinstallBackups\0017\DriverFiles\i386\ksuser.dll
+ 2011-06-10 20:38 . 2002-12-11 23:14 4096 c:\windows\system32\ReinstallBackups\0017\DriverFiles\i386\ksuser.dll
+ 2011-06-10 20:38 . 2002-12-11 23:14 4096 c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\ksuser.dll
- 2011-04-21 17:43 . 2002-12-11 23:14 4096 c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\ksuser.dll
+ 2011-06-10 20:39 . 2011-05-25 07:26 119528 c:\windows\system32\ReinstallBackups\0020\DriverFiles\nvhda32.sys
+ 2011-06-10 20:39 . 2011-05-25 07:26 865896 c:\windows\system32\ReinstallBackups\0020\DriverFiles\nvgenco32.dll
+ 2011-06-10 20:39 . 2008-03-21 09:35 146048 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\portcls.sys
- 2011-04-21 17:44 . 2008-03-21 09:35 146048 c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\portcls.sys
+ 2011-06-03 16:32 . 2011-03-03 15:59 119272 c:\windows\system32\ReinstallBackups\0018\DriverFiles\nvhda32.sys
+ 2011-06-03 16:32 . 2011-03-03 15:59 837224 c:\windows\system32\ReinstallBackups\0018\DriverFiles\nvgenco32.dll
+ 2011-06-03 16:32 . 2008-03-21 09:35 146048 c:\windows\system32\ReinstallBackups\0018\DriverFiles\i386\portcls.sys
+ 2011-06-10 20:38 . 2011-05-25 07:26 119528 c:\windows\system32\ReinstallBackups\0017\DriverFiles\nvhda32.sys
+ 2011-06-10 20:38 . 2011-05-25 07:26 865896 c:\windows\system32\ReinstallBackups\0017\DriverFiles\nvgenco32.dll
+ 2011-06-10 20:38 . 2008-03-21 09:35 146048 c:\windows\system32\ReinstallBackups\0017\DriverFiles\i386\portcls.sys
- 2011-04-21 17:44 . 2008-03-21 09:35 146048 c:\windows\system32\ReinstallBackups\0017\DriverFiles\i386\portcls.sys
+ 2011-06-03 16:31 . 2011-04-08 05:14 855656 c:\windows\system32\ReinstallBackups\0016\DriverFiles\nvgenco32.dll
+ 2011-06-03 16:30 . 2011-04-08 05:14 259604 c:\windows\system32\ReinstallBackups\0016\DriverFiles\nvdrsdb.bin
+ 2011-06-03 16:31 . 2011-04-08 05:14 944232 c:\windows\system32\ReinstallBackups\0016\DriverFiles\nvdispco32.dll
+ 2011-06-03 16:30 . 2011-04-08 05:14 147456 c:\windows\system32\ReinstallBackups\0016\DriverFiles\dbInstaller.exe
+ 2011-06-10 20:38 . 2011-05-25 07:26 119528 c:\windows\system32\ReinstallBackups\0013\DriverFiles\nvhda32.sys
+ 2011-06-10 20:38 . 2011-05-25 07:26 865896 c:\windows\system32\ReinstallBackups\0013\DriverFiles\nvgenco32.dll
- 2011-04-21 17:43 . 2008-03-21 09:35 146048 c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\portcls.sys
+ 2011-06-10 20:38 . 2008-03-21 09:35 146048 c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\portcls.sys
+ 2008-04-14 11:00 . 2011-06-08 05:13 502798 c:\windows\system32\perfh009.dat
- 2008-04-14 11:00 . 2011-04-25 14:38 502798 c:\windows\system32\perfh009.dat
- 2008-04-14 11:00 . 2011-04-25 14:38 497594 c:\windows\system32\perfh005.dat
+ 2008-04-14 11:00 . 2011-06-08 05:13 497594 c:\windows\system32\perfh005.dat
+ 2008-04-14 11:00 . 2011-06-08 05:13 102874 c:\windows\system32\perfc005.dat
- 2008-04-14 11:00 . 2011-04-25 14:38 102874 c:\windows\system32\perfc005.dat
+ 2010-10-01 20:23 . 2011-06-10 20:49 274492 c:\windows\system32\nvdrsdb1.bin
+ 2010-10-01 20:23 . 2011-06-10 20:49 274488 c:\windows\system32\nvdrsdb0.bin
+ 2010-01-14 14:59 . 2011-03-11 14:09 471552 c:\windows\system32\dllcache\aclayers.dll
- 2010-01-14 14:59 . 2010-01-14 14:59 471552 c:\windows\system32\dllcache\aclayers.dll
+ 2011-06-07 14:21 . 2011-06-07 14:21 371272 c:\windows\Installer\{5335DADB-34BA-4AE8-A519-648D78498846}\SkypeIcon.exe
- 2011-05-25 08:39 . 2011-05-25 08:39 371272 c:\windows\Installer\{5335DADB-34BA-4AE8-A519-648D78498846}\SkypeIcon.exe
- 2010-01-14 14:59 . 2010-01-14 14:59 471552 c:\windows\AppPatch\AcLayers.dll
+ 2010-01-14 14:59 . 2011-03-11 14:09 471552 c:\windows\AppPatch\aclayers.dll
+ 2011-06-03 16:31 . 2011-04-08 05:14 2116894 c:\windows\system32\ReinstallBackups\0016\DriverFiles\nvdata.bin
+ 2011-06-03 16:31 . 2011-04-08 05:14 2770536 c:\windows\system32\ReinstallBackups\0016\DriverFiles\nvcuvid.dll
+ 2011-06-03 16:31 . 2011-04-08 05:14 2074216 c:\windows\system32\ReinstallBackups\0016\DriverFiles\nvcuvenc.dll
+ 2011-06-03 16:31 . 2011-04-08 05:14 5210112 c:\windows\system32\ReinstallBackups\0016\DriverFiles\nvcuda.dll
+ 2011-06-03 16:30 . 2011-04-08 05:14 2027008 c:\windows\system32\ReinstallBackups\0016\DriverFiles\nvapi.dll
+ 2011-06-03 16:30 . 2011-04-08 05:14 4111232 c:\windows\system32\ReinstallBackups\0016\DriverFiles\nv4_disp.dll
+ 2011-06-07 14:21 . 2011-06-07 14:21 1645056 c:\windows\Installer\380e9c.msi
+ 2011-06-03 16:31 . 2011-04-08 05:14 14856192 c:\windows\system32\ReinstallBackups\0016\DriverFiles\nvoglnt.dll
+ 2011-06-03 16:31 . 2011-04-08 05:14 13000704 c:\windows\system32\ReinstallBackups\0016\DriverFiles\nvcompiler.dll
+ 2011-06-03 16:30 . 2011-04-08 05:14 12501600 c:\windows\system32\ReinstallBackups\0016\DriverFiles\nv4_mini.sys
+ 2010-10-01 20:23 . 2011-05-25 07:25 12753664 c:\windows\system32\dllcache\nv4_mini.sys
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-05-25 13895272]
"NvMediaCenter"="NvMCTray.dll" [2011-05-25 111208]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-05-04 1632360]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-10-28 10:13 64592 ----a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Ja^Nabídka Start^Programy^Po spuštění^IMVU.lnk]
backup=c:\windows\pss\IMVU.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 4]
2011-05-28 12:46 412560 ----a-w- c:\program files\IObit\Advanced SystemCare 4\ASCTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2011-04-26 13:53 124216 ----a-w- c:\program files\ICQ7.5\ICQ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-05-29 07:11 449584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2011-05-25 07:26 13895272 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2011-05-25 07:26 111208 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2010-05-14 08:32 1479680 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2010-04-12 08:40 180224 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2011-02-17 13:02 20029032 ----a-w- c:\windows\RTHDCPL.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-01-07 11:12 253672 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-04-21 18:08 273544 ----a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2011-06-03 22:53 552824 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Games\\World_of_Tanks\\WorldOfTanks.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2011\\pes2011.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2011\\csp2011.exe"=
"c:\\Program Files\\Call of Duty - Modern Warfare 2\\iw4mp.dat"=
"c:\\Documents and Settings\\Ja\\Plocha\\Minecraft.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\EA Games\\Battlefield Play4Free\\BFP4f.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11.10.2010 21:03 691696]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [11.3.2011 15:42 218688]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 15:04 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2010 13:47 94872]
R2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [2.10.2010 10:36 20328]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [12.1.2011 16:41 810144]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [9.10.2010 12:11 10448]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12.10.2010 13:43 22712]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [1.10.2010 22:24 119528]
S1 DumpDrv;Crash Dump Driver;c:\windows\system32\drivers\dumpdrv.sys [14.1.2010 17:04 9472]
S2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\IObit\Advanced SystemCare 4\ASCService.exe [25.4.2011 16:09 353168]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 14:16 130384]
S2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [10.6.2011 19:59 821080]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10.6.2011 23:27 366640]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [31.3.2011 15:40 2214504]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1.10.2010 23:07 1691480]
S3 FLASHSYS;FLASHSYS;c:\program files\MSI\Live Update 4\LU4\FlashSys.sys [2.10.2010 0:01 9216]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [12.10.2010 13:43 39984]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [26.10.2010 20:42 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [26.10.2010 20:42 8320]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 21:37 4640000]
S3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\RegFilter.sys [10.6.2011 19:59 30368]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]
S3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\UrlFilter.sys [10.6.2011 19:59 16080]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [24.9.2010 13:19 268528]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 14:16 753504]
S4 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys [10.6.2011 19:59 239472]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'
.
2011-06-10 c:\windows\Tasks\ASC4_AutoUpdate.job
- c:\program files\IObit\Advanced SystemCare 4\AutoUpdate.exe [2011-04-25 12:46]
.
2011-06-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2052111302-2077806209-1801674531-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]
.
2011-06-11 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2052111302-2077806209-1801674531-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/sk27211/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949}
Trusted Zone: adobe.com
Trusted Zone: microsoft.com\windows
TCP: DhcpNameServer = 88.81.64.34 88.81.64.1
FF - ProfilePath - c:\documents and settings\Ja\Data aplikací\Mozilla\Firefox\Profiles\0l0iu5q0.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/sk27211/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
MSConfigStartUp-nwiz - nwiz.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-11 09:33
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(804)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
- - - - - - - > 'explorer.exe'(904)
c:\windows\system32\msi.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2011-06-11 09:35:59
ComboFix-quarantined-files.txt 2011-06-11 07:35
ComboFix2.txt 2011-05-31 16:59
ComboFix3.txt 2011-02-27 21:40
ComboFix4.txt 2011-02-27 20:01
.
Před spuštěním: Volných bajtů: 17 634 570 240
Po spuštění: Volných bajtů: 17 641 168 896
.
- - End Of File - - 0A1B7ADA2B7DABE9C6A63F9C58E694B8

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 08:47
od chodnik74
Výborně..ale ještě bude potřeba dočištění :) ale teď se omlouvám,musím jít něco dělat,práce volá..hned jak bude chvilka,tak vám napíši opravný script :) nejpozději na oběd :)

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 08:51
od Thooty
V pořádku já mám času momenálně dost, takže si klidně počkám, hlavní je že je ta havěť pryč ;)

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 09:06
od chodnik74
Uz makam..Pisu z mobilu..aby pc nestal,dejte mbam uplnou kontrolu a vlozte sem log =)pak docistime,co nam nasel cf =)

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 11:02
od chodnik74
:!: Takže opět stejná pravidla..vypnout všechny štíty atd.. :)
:arrow: Otevřeme si Poznámkový blok Obrázek
  • (stiskneme klávesovou kombinaci WIN+R a napíšeme ,,notepad,, bez úvozovek a dáme enter)
  • Vložíme do něj následující script:

    Kód: Vybrat vše

    KillAll::

Firefox::
FF - ProfilePath - c:\documents and settings\Ja\Data aplikací\Mozilla\Firefox\Profiles\0l0iu5q0.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/sk27211/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... r=1.1.9&q=

DDS::
Trusted Zone: adobe.com
Trusted Zone: microsoft.com\windows
uStart Page = hxxp://start.icq.com/sk27211/

File::
c:\windows\Tasks\ASC4_AutoUpdate.job

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 4]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
[-HKLM\~\startupfolder\C:^Documents and Settings^Ja^Nabídka Start^Programy^Po spuštění^IMVU.lnk]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"=-
"nwiz"=-
"Malwarebytes' Anti-Malware"=-

Restore::
c:\windows\system32\sfcfiles.dll

Reboot::
  • Soubor uložíme na Plochu jako CFScript.txt
  • Poté tento soubor uchopíme levým tlačítkem myši a přetáhneme na ikonu Combofixu a upustíme

    Obrázek
  • Poté Combofix provede všechny operace a udělá nový log,který sem vložte

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 11:14
od chodnik74
Takže postup je následující..udělejte Combofix se scriptem :) Poté mi sem vložte log :) Pak bych doporučil odstranit VŠE OD IOBIT a pak můžete zahájit skenování Malwarebytes :)

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 11:42
od Thooty
chodnik74 píše:Uz makam..Pisu z mobilu..aby pc nestal,dejte mbam uplnou kontrolu a vlozte sem log =)pak docistime,co nam nasel cf =)
Jak tak vidím havěť se zase usadila v Bodech obnovení že ano? Takže můžu smazat..
To co jste psal po tomto postu jsem nečetl, protože už jsem dělal kontrolu pomocí Malwarebytes a tak jsem tedy neodstranil IOBIT programy a taky neaplikoval ComboFix se scriptem.
Pokud je nutné odinstalovat IOBIT programy tak je to celkem blbé, protože můj PC není zrovna rychlík a jak vidíte testy mi trvají 1hodinu a 22 minut, takže doufám že bude stačit když použiju ten ComboFix se scriptem nebo je nutné abych udělal test znovu?

Malwarebytes' Anti-Malware
http://www.malwarebytes.org

Verze databáze:

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

11.6.2011 12:38:18
mbam-log-2011-06-11 (12-38-14).txt

Typ: Úplná kontrola (C:\|)
Kontrolované objekty: 298317
Uplynulý čas: 1 hodin, 22 minut, 23 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 3

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\system volume information\_restore{aea70349-f5fc-481e-a4c7-f335703ad93e}\RP1\A0000088.exe (Trojan.Backdoor) -> No action taken.
c:\system volume information\_restore{aea70349-f5fc-481e-a4c7-f335703ad93e}\RP1\A0000089.exe (Trojan.Backdoor) -> No action taken.
c:\system volume information\_restore{aea70349-f5fc-481e-a4c7-f335703ad93e}\RP1\A0000090.exe (Trojan.Backdoor) -> No action taken.

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 12:01
od chodnik74
:arrow: Odinstalujte vše od IOBit...tyto produkty vám v pc pouze škodí :) věřte mi..na údržbu pc vám dám na závěr něco jiného..
:arrow: Poté pokračujte Combofixem se scriptem :)

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 12:08
od Thooty
Odstranil jsem tedy infikované objekty v MB (+ Bod Obnovy), Odinstaloval jsem IOBIT programy a aplikoval ComboFix se scriptem a zde je log


ComboFix 11-06-10.0A - Ja 11.06.2011 12:52:54.5.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.617 [GMT 2:00]
Spuštěný z: c:\documents and settings\Ja\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Ja\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
FILE ::
"c:\windows\Tasks\ASC4_AutoUpdate.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Tasks\ASC4_AutoUpdate.job
.
c:\windows\system32\sfcfiles.dll . . . je infikován!!
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-11 do 2011-06-11 )))))))))))))))))))))))))))))))
.
.
2011-06-11 06:35 . 2011-06-11 06:36 -------- d-----w- C:\rsit
2011-06-10 20:12 . 2011-06-10 20:12 -------- d-----w- c:\documents and settings\Ja\Local Settings\Data aplikací\PackageAware
2011-06-10 19:41 . 2011-06-10 19:41 -------- d-----w- c:\documents and settings\Ja\Local Settings\Data aplikací\Microangelo On Display
2011-06-10 19:41 . 2011-06-10 19:41 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Microangelo On Display
2011-06-04 14:17 . 2011-06-08 13:42 -------- d-----w- c:\documents and settings\Ja\Data aplikací\.minecraft
2011-06-03 16:30 . 2011-05-25 07:25 899688 ----a-w- c:\windows\system32\nvdispco3220150.dll
2011-06-03 16:30 . 2011-05-25 07:25 865896 ----a-w- c:\windows\system32\nvgenco322090.dll
2011-06-01 18:19 . 2011-06-01 18:30 -------- d-----w- c:\documents and settings\Ja\Local Settings\Data aplikací\Dxtory Software
2011-05-31 19:31 . 2011-05-31 19:32 -------- d-----w- C:\ERDNT
2011-05-31 12:19 . 2011-05-31 12:19 -------- d-----w- c:\documents and settings\Ja\Data aplikací\Publish Providers
2011-05-31 12:10 . 2011-05-31 12:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Sony
2011-05-31 12:10 . 2011-05-31 12:10 -------- d-----w- c:\program files\Sony
2011-05-31 11:56 . 2011-05-31 11:56 -------- d-----w- c:\documents and settings\Ja\Local Settings\Data aplikací\Sony
2011-05-31 11:40 . 2011-05-31 12:31 -------- d-----w- c:\documents and settings\Ja\Data aplikací\Sony
2011-05-30 15:43 . 2011-05-30 15:43 724992 ----a-w- c:\windows\iun6002.exe
2011-05-30 15:42 . 2011-05-30 15:44 -------- d-----w- c:\documents and settings\Ja\Data aplikací\PingTesterDataBas
2011-05-30 10:30 . 2011-05-30 10:30 -------- d-----w- c:\program files\Common Files\Java
2011-05-30 10:29 . 2011-05-30 10:29 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-05-30 10:29 . 2011-05-30 10:29 -------- d-----w- c:\program files\Java
2011-05-26 18:41 . 2011-06-08 13:38 -------- d-----w- c:\program files\Call of Duty - Modern Warfare 2
2011-05-14 12:54 . 2011-05-14 12:54 -------- d-----w- c:\program files\KONAMI
2011-05-14 12:54 . 2011-05-14 12:54 -------- d-----w- c:\documents and settings\All Users\Data aplikací\KONAMI
2011-05-13 14:49 . 2011-05-13 14:49 -------- d-----w- c:\documents and settings\Ja\Local Settings\Data aplikací\cache
2011-05-13 14:43 . 2011-05-13 15:17 -------- d-----w- c:\documents and settings\Ja\Local Settings\Data aplikací\FullTiltPoker
2011-05-13 14:42 . 2011-06-08 07:42 -------- d-----w- c:\program files\Full Tilt Poker
2011-05-13 07:01 . 2011-05-13 07:01 -------- d-----w- C:\Games
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-10 16:34 . 2010-10-01 21:50 138264 -c--a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-06-10 16:33 . 2010-10-01 21:51 234768 -c--a-w- c:\windows\system32\PnkBstrB.xtr
2011-06-10 16:33 . 2010-10-01 21:50 234768 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-06-10 16:22 . 2010-10-01 21:50 234768 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-05-30 10:29 . 2010-10-01 22:22 472808 -c--a-w- c:\windows\system32\deployJava1.dll
2011-05-29 07:11 . 2010-10-12 11:43 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 07:11 . 2010-10-12 11:43 22712 -c--a-w- c:\windows\system32\drivers\mbam.sys
2011-05-25 07:26 . 2011-03-31 13:37 865896 ----a-w- c:\windows\system32\nvhdagenco322040.dll
2011-05-25 07:26 . 2010-10-01 20:24 26216 ----a-w- c:\windows\system32\nvhdap32.dll
2011-05-25 07:26 . 2010-10-01 20:24 119528 ----a-w- c:\windows\system32\drivers\nvhda32.sys
2011-05-25 07:26 . 2011-04-07 20:16 54272 ----a-w- c:\windows\system32\nvwddi.dll
2011-05-25 07:26 . 2011-04-07 20:16 253952 ----a-w- c:\windows\system32\nvrsth.dll
2011-05-25 07:26 . 2011-04-07 20:16 126976 ----a-w- c:\windows\system32\nvrszht.dll
2011-05-25 07:26 . 2011-04-07 20:16 270336 ----a-w- c:\windows\system32\nvrsru.dll
2011-05-25 07:26 . 2011-04-07 20:16 258048 ----a-w- c:\windows\system32\nvrstr.dll
2011-05-25 07:26 . 2011-04-07 20:16 258048 ----a-w- c:\windows\system32\nvrssl.dll
2011-05-25 07:26 . 2011-04-07 20:16 229376 ----a-w- c:\windows\system32\nvrszhc.dll
2011-05-25 07:26 . 2011-04-07 20:16 274432 ----a-w- c:\windows\system32\nvrspt.dll
2011-05-25 07:26 . 2011-04-07 20:16 270336 ----a-w- c:\windows\system32\nvrsptb.dll
2011-05-25 07:26 . 2011-04-07 20:16 258048 ----a-w- c:\windows\system32\nvrssk.dll
2011-05-25 07:26 . 2011-04-07 20:16 258048 ----a-w- c:\windows\system32\nvrspl.dll
2011-05-25 07:26 . 2011-04-07 20:16 253952 ----a-w- c:\windows\system32\nvrssv.dll
2011-05-25 07:26 . 2011-04-07 20:16 253952 ----a-w- c:\windows\system32\nvrsno.dll
2011-05-25 07:26 . 2011-04-07 20:16 154728 ----a-w- c:\windows\system32\nvsvc32.exe
2011-05-25 07:26 . 2011-04-07 20:16 274432 ----a-w- c:\windows\system32\nvrsnl.dll
2011-05-25 07:26 . 2011-04-07 20:16 262144 ----a-w- c:\windows\system32\nvrshu.dll
2011-05-25 07:26 . 2011-04-07 20:16 282624 ----a-w- c:\windows\system32\nvrsit.dll
2011-05-25 07:26 . 2011-04-07 20:16 270336 ----a-w- c:\windows\system32\nvrsja.dll
2011-05-25 07:26 . 2011-04-07 20:16 266240 ----a-w- c:\windows\system32\nvrsko.dll
2011-05-25 07:26 . 2011-04-07 20:16 331776 ----a-w- c:\windows\system32\nvrshe.dll
2011-05-25 07:26 . 2011-04-07 20:16 286720 ----a-w- c:\windows\system32\nvrsfr.dll
2011-05-25 07:26 . 2011-04-07 20:16 249856 ----a-w- c:\windows\system32\nvrsfi.dll
2011-05-25 07:26 . 2011-04-07 20:16 282624 ----a-w- c:\windows\system32\nvrsel.dll
2011-05-25 07:26 . 2011-04-07 20:16 249856 ----a-w- c:\windows\system32\nvrseng.dll
2011-05-25 07:26 . 2011-04-07 20:16 274432 ----a-w- c:\windows\system32\nvrsesm.dll
2011-05-25 07:26 . 2011-04-07 20:16 282624 ----a-w- c:\windows\system32\nvrses.dll
2011-05-25 07:26 . 2011-04-07 20:16 278528 ----a-w- c:\windows\system32\nvrsde.dll
2011-05-25 07:26 . 2011-04-07 20:16 253952 ----a-w- c:\windows\system32\nvrsda.dll
2011-05-25 07:26 . 2011-04-07 20:16 335872 ----a-w- c:\windows\system32\nvrsar.dll
2011-05-25 07:26 . 2011-04-07 20:16 249856 ----a-w- c:\windows\system32\nvrscs.dll
2011-05-25 07:26 . 2011-04-07 20:16 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-05-25 07:26 . 2011-04-07 20:16 13895272 ----a-w- c:\windows\system32\nvcpl.dll
2011-05-25 07:26 . 2011-04-07 20:16 145000 ----a-w- c:\windows\system32\nvcolor.exe
2011-05-25 07:26 . 2011-04-07 20:16 543336 ----a-w- c:\windows\system32\easyUpdatusAPIU.dll
2011-05-25 07:25 . 2010-10-01 20:23 61440 ----a-w- c:\windows\system32\OpenCL.dll
2011-05-25 07:25 . 2010-10-01 20:23 16068608 ----a-w- c:\windows\system32\nvoglnt.dll
2011-05-25 07:25 . 2010-10-01 20:23 2808936 ----a-w- c:\windows\system32\nvcuvid.dll
2011-05-25 07:25 . 2010-10-01 20:23 2082408 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-05-25 07:25 . 2010-10-01 20:23 5332992 ----a-w- c:\windows\system32\nvcuda.dll
2011-05-25 07:25 . 2010-10-01 20:23 13004800 ----a-w- c:\windows\system32\nvcompiler.dll
2011-05-25 07:25 . 2010-10-01 20:23 12753664 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-05-25 07:25 . 2010-10-01 20:23 4198272 ----a-w- c:\windows\system32\nv4_disp.dll
2011-05-25 07:25 . 2010-10-01 20:23 2328576 ----a-w- c:\windows\system32\nvapi.dll
2011-05-25 07:16 . 2011-03-11 13:49 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-13 18:38 . 2011-01-29 12:56 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2011-05-09 10:47 . 2010-01-14 15:00 6656 -c--a-w- c:\windows\system32\lpcio.dll
2011-04-21 18:38 . 2010-10-01 21:49 75136 -c--a-w- c:\windows\system32\PnkBstrA.exe
2011-04-21 18:08 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-04-21 18:08 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-04-21 16:47 . 2010-10-01 21:50 138056 -c--a-w- c:\documents and settings\Ja\Data aplikací\PnkBstrK.sys
2011-04-14 07:47 . 2011-04-14 07:47 86016 -c--a-w- c:\windows\system32\frapsvid.dll
2011-04-08 05:14 . 2011-03-31 13:37 944232 ----a-w- c:\windows\system32\nvdispco3220140.dll
2011-04-08 05:14 . 2011-03-31 13:37 855656 ----a-w- c:\windows\system32\nvgenco322060.dll
2011-04-07 20:16 . 2011-04-07 20:16 277608 ----a-w- c:\windows\system32\nvmccs.dll
2011-06-08 07:28 . 2011-03-24 19:16 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-10-09 . FF876311F58C86EC3E1A24F585949C25 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-05-25 13895272]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-10-28 10:13 64592 ----a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Games\\World_of_Tanks\\WorldOfTanks.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2011\\pes2011.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2011\\csp2011.exe"=
"c:\\Program Files\\Call of Duty - Modern Warfare 2\\iw4mp.dat"=
"c:\\Documents and Settings\\Ja\\Plocha\\Minecraft.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\EA Games\\Battlefield Play4Free\\BFP4f.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11.10.2010 21:03 691696]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [11.3.2011 15:42 218688]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 15:04 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2010 13:47 94872]
R2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [2.10.2010 10:36 20328]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [12.1.2011 16:41 810144]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [9.10.2010 12:11 10448]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10.6.2011 23:27 366640]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [31.3.2011 15:40 2214504]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12.10.2010 13:43 22712]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [1.10.2010 22:24 119528]
S1 DumpDrv;Crash Dump Driver;c:\windows\system32\drivers\dumpdrv.sys [14.1.2010 17:04 9472]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 14:16 130384]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1.10.2010 23:07 1691480]
S3 FLASHSYS;FLASHSYS;c:\program files\MSI\Live Update 4\LU4\FlashSys.sys [2.10.2010 0:01 9216]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [12.10.2010 13:43 39984]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [26.10.2010 20:42 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [26.10.2010 20:42 8320]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 21:37 4640000]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [24.9.2010 13:19 268528]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 14:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'
.
2011-06-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2052111302-2077806209-1801674531-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]
.
2011-06-11 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2052111302-2077806209-1801674531-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949}
TCP: DhcpNameServer = 88.81.64.34 88.81.64.1
FF - ProfilePath - c:\documents and settings\Ja\Data aplikací\Mozilla\Firefox\Profiles\0l0iu5q0.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-11 13:02
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(808)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
- - - - - - - > 'explorer.exe'(3868)
c:\windows\system32\webcheck.dll
c:\windows\system32\msls31.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
.
**************************************************************************
.
Celkový čas: 2011-06-11 13:07:35 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-06-11 11:07
ComboFix2.txt 2011-06-11 07:35
ComboFix3.txt 2011-05-31 16:59
ComboFix4.txt 2011-02-27 21:40
ComboFix5.txt 2011-06-11 10:51
.
Před spuštěním: Volných bajtů: 17 748 312 064
Po spuštění: Volných bajtů: 17 732 952 064
.
- - End Of File - - 24C7F512A4EA7F2A440800A91E0A00DA

Re: Prosím o kontrolu logu - Infikované soubory

Napsal: 11 čer 2011 12:16
od chodnik74
Jeden systémový soubor je infikován..

:arrow: Budeme potřebovat instalační CD systému Windows XP
:arrow: Potřebuji vědět písmeno jednotky,ve které bude inst. CD,podle toho napíši opravu :)
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz