VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Win32:Jeefo

https://forum.viry.cz:443/viewtopic.php?t=127226

Stránka 1 z 1

Win32:Jeefo

Napsal: 13 led 2013 08:03
od 7ivan70
zdravim,chytil som virus Win32:Jeefo,dal som cez avast vsetko vymazat,po restarte som znova skenoval z avastom pc,uz nenasiel ziadny virus,ale-cely den som si robil webovu stranku phpbb3 a i 1 infikovany subor som tam vlozil,,uz som to vymazal,,ale nemohol som infikovat i celu stranku?cez ftp?neviem,ako to preverit avastom.

Logfile of random's system information tool 1.09 (written by random/random)
Run by ivan at 2013-01-13 07:53:34
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 22 GB (75%) free of 30 GB
Total RAM: 1918 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:53:51, on 13.1.2013
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Steam\steam.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ivan\Desktop\RSIT.exe
C:\Program Files\trend micro\ivan.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

--
End of file - 4155 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\avast! Emergency Update.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-01-12 192144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll [2013-01-12 1000984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-01-12 192144]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"THotkey"=C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe [2008-05-27 360448]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-07-21 61440]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-04-01 16859648]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-04-01 69632]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-04-01 1024000]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-10-30 4297136]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"Steam"=C:\Program Files\Steam\steam.exe [2013-01-05 1354736]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2013-01-12 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-07-21 155648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit"
"C:\Program Files\Steam\steamapps\1dykmore\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\1dykmore\counter-strike\hl.exe:*:Enabled:Counter-Strike"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"MSVideo8"=VfWWDM32.dll
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.txt - open - notepad.exe %1

======List of files/folders created in the last 1 month======

2013-01-12 22:21:47 ----D---- C:\Program Files\trend micro
2013-01-12 22:21:46 ----D---- C:\rsit
2013-01-12 21:10:01 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2013-01-12 21:08:03 ----D---- C:\Program Files\Google
2013-01-12 21:08:01 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2013-01-12 21:08:01 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2013-01-12 21:07:58 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2013-01-12 21:07:58 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2013-01-12 21:07:57 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2013-01-12 21:07:54 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2013-01-12 21:07:54 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2013-01-12 21:07:54 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2013-01-12 21:07:30 ----A---- C:\WINDOWS\avastSS.scr
2013-01-12 21:07:28 ----A---- C:\WINDOWS\system32\aswBoot.exe
2013-01-12 21:07:03 ----D---- C:\Program Files\AVAST Software
2013-01-12 21:07:03 ----D---- C:\Documents and Settings\All Users\Application Data\AVAST Software
2013-01-10 21:15:51 ----D---- C:\totalcmd
2013-01-10 21:15:51 ----D---- C:\Documents and Settings\ivan\Application Data\GHISLER
2013-01-07 19:18:23 ----D---- C:\Documents and Settings\ivan\Application Data\WinRAR
2013-01-07 19:18:18 ----D---- C:\Program Files\WinRAR
2013-01-07 12:20:05 ----A---- C:\WINDOWS\system32\wiafbdrv.dll
2013-01-07 12:20:05 ----A---- C:\WINDOWS\system32\hpgtmcro.dll
2013-01-07 12:20:05 ----A---- C:\WINDOWS\system32\hpgt34tk.dll
2013-01-07 12:20:05 ----A---- C:\WINDOWS\system32\hpgt34.dll
2013-01-07 12:20:04 ----A---- C:\WINDOWS\system32\drivers\usbscan.sys
2013-01-07 09:03:32 ----A---- C:\WINDOWS\system32\drivers\USBSTOR.SYS
2013-01-05 20:12:28 ----D---- C:\Documents and Settings\ivan\Application Data\PSpad
2013-01-05 19:05:49 ----D---- C:\Documents and Settings\ivan\Application Data\Macromedia
2013-01-05 19:05:49 ----D---- C:\Documents and Settings\ivan\Application Data\Adobe
2013-01-05 18:59:31 ----SHD---- C:\RECYCLER
2013-01-05 18:58:30 ----A---- C:\WINDOWS\system32\h323log.txt
2013-01-05 18:57:09 ----A---- C:\WINDOWS\system32\drivers\MSTEE.sys
2013-01-05 18:57:05 ----A---- C:\WINDOWS\system32\drivers\SLIP.sys
2013-01-05 18:57:04 ----D---- C:\Program Files\Steam
2013-01-05 18:57:04 ----D---- C:\Program Files\Common Files\Steam
2013-01-05 18:57:03 ----A---- C:\WINDOWS\system32\drivers\NABTSFEC.sys
2013-01-05 18:57:00 ----A---- C:\WINDOWS\system32\drivers\NdisIP.sys
2013-01-05 18:56:58 ----A---- C:\WINDOWS\system32\drivers\CCDECODE.sys
2013-01-05 18:56:56 ----A---- C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2013-01-05 18:56:54 ----A---- C:\WINDOWS\system32\drivers\MSKSSRV.sys
2013-01-05 18:56:51 ----A---- C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2013-01-05 18:56:49 ----A---- C:\WINDOWS\system32\drivers\StreamIP.sys
2013-01-05 18:56:47 ----A---- C:\WINDOWS\system32\drivers\MSPQM.sys
2013-01-05 18:56:41 ----A---- C:\WINDOWS\system32\drivers\audstub.sys
2013-01-05 18:56:39 ----D---- C:\Program Files\ScreenShots
2013-01-05 18:56:25 ----D---- C:\Program Files\PSPad editor
2013-01-05 18:56:21 ----A---- C:\WINDOWS\system32\hidserv.dll
2013-01-05 18:56:09 ----A---- C:\WINDOWS\system32\vfwwdm32.dll
2013-01-05 18:56:08 ----A---- C:\WINDOWS\system32\ksuser.dll
2013-01-05 18:56:08 ----A---- C:\WINDOWS\system32\drivers\usbvideo.sys
2013-01-05 18:55:49 ----A---- C:\WINDOWS\system32\drivers\redbook.sys
2013-01-05 18:55:12 ----D---- C:\Program Files\HaoZip
2013-01-05 18:54:52 ----D---- C:\Program Files\VS Revo Group
2013-01-05 18:54:21 ----A---- C:\WINDOWS\system32\usbui.dll
2013-01-05 18:54:07 ----A---- C:\WINDOWS\system32\drivers\compbatt.sys
2013-01-05 18:54:06 ----A---- C:\WINDOWS\system32\drivers\CmBatt.sys
2013-01-05 18:54:06 ----A---- C:\WINDOWS\system32\drivers\battc.sys
2013-01-05 18:53:50 ----D---- C:\Program Files\Common Files\Adobe
2013-01-05 18:53:50 ----D---- C:\Program Files\Adobe
2013-01-05 18:53:12 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2013-01-05 18:52:55 ----A---- C:\WINDOWS\imsins.BAK
2013-01-05 18:52:52 ----SHD---- C:\WINDOWS\Installer
2013-01-05 18:52:52 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2013-01-05 18:52:51 ----D---- C:\Program Files\Common Files\ODBC
2013-01-05 18:52:51 ----A---- C:\WINDOWS\ODBCINST.INI
2013-01-05 18:52:47 ----D---- C:\Program Files\Common Files\SpeechEngines
2013-01-05 18:52:46 ----RD---- C:\Program Files
2013-01-05 18:52:46 ----D---- C:\Program Files\Common Files\Microsoft Shared
2013-01-05 18:52:46 ----D---- C:\Program Files\Common Files
2013-01-05 18:52:43 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2013-01-05 18:52:43 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2013-01-05 18:52:43 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2013-01-05 18:52:42 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2013-01-05 18:52:42 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2013-01-05 18:52:41 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2013-01-05 18:52:41 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2013-01-05 18:52:41 ----RA---- C:\WINDOWS\system32\kbdur.dll
2013-01-05 18:52:41 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2013-01-05 18:52:41 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2013-01-05 18:52:41 ----RA---- C:\WINDOWS\system32\kbdru.dll
2013-01-05 18:52:41 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2013-01-05 18:52:41 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2013-01-05 18:52:41 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2013-01-05 18:52:41 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2013-01-05 18:52:39 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2013-01-05 18:52:39 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2013-01-05 18:52:39 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2013-01-05 18:52:39 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2013-01-05 18:52:39 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2013-01-05 18:52:39 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2013-01-05 18:52:39 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2013-01-05 18:52:38 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2013-01-05 18:52:38 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2013-01-05 18:52:38 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2013-01-05 18:52:38 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2013-01-05 18:52:38 ----RA---- C:\WINDOWS\system32\kbdest.dll
2013-01-05 18:52:36 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2013-01-05 18:52:36 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2013-01-05 18:52:36 ----RA---- C:\WINDOWS\system32\kbdro.dll
2013-01-05 18:52:36 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2013-01-05 18:52:36 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2013-01-05 18:52:36 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2013-01-05 18:52:36 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2013-01-05 18:52:36 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2013-01-05 18:52:35 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2013-01-05 18:52:35 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2013-01-05 18:52:35 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2013-01-05 18:52:35 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2013-01-05 18:52:35 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2013-01-05 18:52:33 ----A---- C:\WINDOWS\system32\spxcoins.dll
2013-01-05 18:52:33 ----A---- C:\WINDOWS\system32\irclass.dll
2013-01-05 18:52:33 ----A---- C:\WINDOWS\system32\dgsetup.dll
2013-01-05 18:52:33 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2013-01-05 18:52:32 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2013-01-05 18:52:30 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2013-01-05 18:52:30 ----A---- C:\WINDOWS\TASKMAN.EXE
2013-01-05 18:52:30 ----A---- C:\WINDOWS\system32\drivers\irenum.sys
2013-01-05 18:52:30 ----A---- C:\WINDOWS\system32\batt.dll
2013-01-05 18:52:29 ----A---- C:\WINDOWS\NOTEPAD.EXE
2013-01-05 18:52:27 ----A---- C:\WINDOWS\system32\storprop.dll
2013-01-05 18:52:15 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2013-01-05 18:52:12 ----RA---- C:\WINDOWS\SET8.tmp
2013-01-05 18:52:08 ----RA---- C:\WINDOWS\SET4.tmp
2013-01-05 18:52:07 ----RA---- C:\WINDOWS\system32\drivers\RTL8187B.sys
2013-01-05 18:52:07 ----RA---- C:\WINDOWS\SET3.tmp
2013-01-05 18:52:07 ----R---- C:\WINDOWS\system32\drivers\rtl819xp.sys
2013-01-05 18:52:07 ----R---- C:\WINDOWS\system32\drivers\rtl8187Se.sys
2013-01-05 18:52:03 ----D---- C:\Program Files\Realtek WLAN driver
2013-01-05 18:51:59 ----D---- C:\WINDOWS\system32\CatRoot2
2013-01-05 18:51:59 ----D---- C:\WINDOWS\system32\CatRoot
2013-01-05 18:51:53 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2013-01-05 18:51:24 ----A---- C:\WINDOWS\setuplog.txt
2013-01-05 18:51:20 ----D---- C:\Documents and Settings
2013-01-05 18:51:19 ----SHD---- C:\System Volume Information
2013-01-05 18:51:19 ----A---- C:\WINDOWS\system32\FNTCACHE.DAT
2013-01-05 18:50:22 ----RSH---- C:\boot.ini
2013-01-05 18:49:24 ----A---- C:\WINDOWS\system32\SynTPCo4.dll
2013-01-05 18:49:24 ----A---- C:\WINDOWS\system32\SynTPAPI.dll
2013-01-05 18:49:24 ----A---- C:\WINDOWS\system32\drivers\SynTP.sys
2013-01-05 18:49:23 ----A---- C:\WINDOWS\system32\SynCtrl.dll
2013-01-05 18:49:21 ----D---- C:\Program Files\Synaptics
2013-01-05 18:49:21 ----A---- C:\WINDOWS\system32\SynCOM.dll
2013-01-05 18:48:45 ----D---- C:\WINDOWS\system32\Lang
2013-01-05 18:48:44 ----A---- C:\WINDOWS\system32\drivers\drmkaud.sys
2013-01-05 18:48:41 ----A---- C:\WINDOWS\system32\drivers\kmixer.sys
2013-01-05 18:48:39 ----A---- C:\WINDOWS\system32\drivers\DMusic.sys
2013-01-05 18:48:37 ----A---- C:\WINDOWS\system32\drivers\swmidi.sys
2013-01-05 18:48:34 ----A---- C:\WINDOWS\system32\drivers\aec.sys
2013-01-05 18:48:32 ----A---- C:\WINDOWS\system32\drivers\splitter.sys
2013-01-05 18:48:26 ----A---- C:\WINDOWS\system32\drivers\wdmaud.sys
2013-01-05 18:47:01 ----A---- C:\WINDOWS\system32\drivers\sysaudio.sys
2013-01-05 18:46:57 ----R---- C:\WINDOWS\system32\ChCfg.exe
2013-01-05 18:46:44 ----RA---- C:\WINDOWS\system32\UCI32M25.dll
2013-01-05 18:46:43 ----RA---- C:\WINDOWS\system32\mdmxsdk.dll
2013-01-05 18:46:43 ----RA---- C:\WINDOWS\system32\drivers\mdmxsdk.sys
2013-01-05 18:46:43 ----D---- C:\Program Files\CONEXANT
2013-01-05 18:46:42 ----RA---- C:\WINDOWS\system32\drivers\HSFHWAZL.sys
2013-01-05 18:46:42 ----RA---- C:\WINDOWS\system32\drivers\HSF_DPV.sys
2013-01-05 18:46:42 ----RA---- C:\WINDOWS\system32\drivers\HSF_CNXT.sys
2013-01-05 18:46:36 ----D---- C:\WINDOWS\system32\RTCOM
2013-01-05 18:46:32 ----A---- C:\WINDOWS\system32\drivers\drmk.sys
2013-01-05 18:45:56 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2013-01-05 18:45:55 ----HDC---- C:\WINDOWS\$NtUninstallKB888111WXPSP2$
2013-01-05 18:45:48 ----R---- C:\WINDOWS\SoundMan.exe
2013-01-05 18:45:47 ----R---- C:\WINDOWS\SkyTel.exe
2013-01-05 18:45:42 ----R---- C:\WINDOWS\RTLCPL.exe
2013-01-05 18:45:40 ----R---- C:\WINDOWS\system32\drivers\RtkHDAud.sys
2013-01-05 18:45:32 ----R---- C:\WINDOWS\RTHDCPL.exe
2013-01-05 18:45:27 ----R---- C:\WINDOWS\Alcmtr.exe
2013-01-05 18:45:26 ----R---- C:\WINDOWS\alcwzrd.exe
2013-01-05 18:45:21 ----R---- C:\WINDOWS\RtlExUpd.dll
2013-01-05 18:45:01 ----R---- C:\WINDOWS\system32\RTS5121icon.dll
2013-01-05 18:44:48 ----D---- C:\Program Files\USB 2.0 Card Reader
2013-01-05 18:44:40 ----RSHDC---- C:\WINDOWS\system32\dllcache
2013-01-05 18:44:40 ----RSD---- C:\WINDOWS\Fonts
2013-01-05 18:44:40 ----RD---- C:\WINDOWS\Web
2013-01-05 18:44:40 ----HD---- C:\WINDOWS\inf
2013-01-05 18:44:40 ----D---- C:\WINDOWS\WinSxS
2013-01-05 18:44:40 ----D---- C:\WINDOWS\twain_32
2013-01-05 18:44:40 ----D---- C:\WINDOWS\Temp
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\wins
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\wbem
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\usmt
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\spool
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\ShellExt
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\Setup
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\ras
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\oobe
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\npp
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\mui
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\inetsrv
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\IME
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\icsxml
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\ias
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\export
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\drivers\etc
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\drivers\disdn
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\drivers
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\dhcp
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\config
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\3com_dmi
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\3076
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\2052
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\1054
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\1042
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\1041
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\1037
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\1033
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\1031
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\1028
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32\1025
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system32
2013-01-05 18:44:40 ----D---- C:\WINDOWS\system
2013-01-05 18:44:40 ----D---- C:\WINDOWS\security
2013-01-05 18:44:40 ----D---- C:\WINDOWS\Resources
2013-01-05 18:44:40 ----D---- C:\WINDOWS\repair
2013-01-05 18:44:40 ----D---- C:\WINDOWS\Provisioning
2013-01-05 18:44:40 ----D---- C:\WINDOWS\pchealth
2013-01-05 18:44:40 ----D---- C:\WINDOWS\PeerNet
2013-01-05 18:44:40 ----D---- C:\WINDOWS\mui
2013-01-05 18:44:40 ----D---- C:\WINDOWS\msapps
2013-01-05 18:44:40 ----D---- C:\WINDOWS\msagent
2013-01-05 18:44:40 ----D---- C:\WINDOWS\Media
2013-01-05 18:44:40 ----D---- C:\WINDOWS\java
2013-01-05 18:44:40 ----D---- C:\WINDOWS\ime
2013-01-05 18:44:40 ----D---- C:\WINDOWS\Help
2013-01-05 18:44:40 ----D---- C:\WINDOWS\ehome
2013-01-05 18:44:40 ----D---- C:\WINDOWS\Driver Cache
2013-01-05 18:44:40 ----D---- C:\WINDOWS\Debug
2013-01-05 18:44:40 ----D---- C:\WINDOWS\Cursors
2013-01-05 18:44:40 ----D---- C:\WINDOWS\Connection Wizard
2013-01-05 18:44:40 ----D---- C:\WINDOWS\Config
2013-01-05 18:44:40 ----D---- C:\WINDOWS\AppPatch
2013-01-05 18:44:40 ----D---- C:\WINDOWS\addins
2013-01-05 18:44:40 ----D---- C:\WINDOWS
2013-01-05 18:44:40 ----ASH---- C:\pagefile.sys
2013-01-05 18:43:51 ----RA---- C:\WINDOWS\system32\drivers\Rtenicxp.sys
2013-01-05 18:43:43 ----D---- C:\WINDOWS\OPTIONS
2013-01-05 18:43:43 ----D---- C:\Program Files\Realtek
2013-01-05 18:39:34 ----N---- C:\WINDOWS\system32\ati2sgag.exe
2013-01-05 18:39:12 ----D---- C:\Program Files\ATI Technologies
2013-01-05 18:38:36 ----D---- C:\ATI
2013-01-05 18:35:19 ----D---- C:\Program Files\TOSHIBA
2013-01-05 18:35:19 ----A---- C:\WINDOWS\system32\TSBWLS.dll
2013-01-05 18:35:19 ----A---- C:\WINDOWS\system32\TPeculiarity.dll
2013-01-05 18:35:19 ----A---- C:\WINDOWS\system32\TCtrlIO.dll
2013-01-05 18:35:19 ----A---- C:\WINDOWS\system32\TCMSVR.dll
2013-01-05 18:35:19 ----A---- C:\WINDOWS\system32\LEDONOFF.exe
2013-01-05 18:35:19 ----A---- C:\WINDOWS\system32\drivers\FwLnk.sys
2013-01-05 18:35:19 ----A---- C:\WINDOWS\system32\DLLVGA.dll
2013-01-05 18:35:08 ----D---- C:\Program Files\Common Files\InstallShield
2013-01-05 18:33:06 ----D---- C:\WINDOWS\system32\ReinstallBackups
2013-01-05 18:33:00 ----DC---- C:\WINDOWS\system32\DRVSTORE
2013-01-05 18:33:00 ----A---- C:\WINDOWS\system32\drivers\AmdK8.sys
2013-01-05 18:32:55 ----HD---- C:\Program Files\InstallShield Installation Information
2013-01-05 18:32:55 ----D---- C:\Program Files\AMD
2013-01-05 18:32:44 ----D---- C:\Documents and Settings\ivan\Application Data\InstallShield
2013-01-05 18:24:49 ----A---- C:\WINDOWS\system32\WMErrSKY.dll
2013-01-05 18:24:47 ----D---- C:\WINDOWS\system32\1051
2013-01-05 18:24:22 ----D---- C:\temp
2013-01-05 18:22:14 ----D---- C:\Documents and Settings\ivan\Application Data\Identities
2013-01-05 18:22:12 ----HD---- C:\Program Files\Uninstall Information
2013-01-05 18:22:05 ----ASH---- C:\Documents and Settings\ivan\Application Data\desktop.ini
2013-01-05 18:22:04 ----SD---- C:\Documents and Settings\ivan\Application Data\Microsoft
2013-01-05 18:21:25 ----D---- C:\WINDOWS\SoftwareDistribution
2013-01-05 18:21:23 ----SD---- C:\WINDOWS\system32\Microsoft
2013-01-05 18:21:23 ----D---- C:\WINDOWS\Prefetch
2013-01-05 18:21:23 ----A---- C:\WINDOWS\SchedLgU.Txt
2013-01-05 18:08:04 ----AS---- C:\WINDOWS\bootstat.dat
2013-01-05 18:05:55 ----D---- C:\WINDOWS\system32\xircom
2013-01-05 18:05:55 ----D---- C:\Program Files\xerox
2013-01-05 18:05:55 ----D---- C:\Program Files\microsoft frontpage
2013-01-05 18:05:32 ----RASH---- C:\MSDOS.SYS
2013-01-05 18:05:32 ----RASH---- C:\IO.SYS
2013-01-05 18:05:32 ----A---- C:\WINDOWS\control.ini
2013-01-05 18:05:32 ----A---- C:\CONFIG.SYS
2013-01-05 18:05:32 ----A---- C:\AUTOEXEC.BAT
2013-01-05 18:05:19 ----A---- C:\WINDOWS\OEWABLog.txt
2013-01-05 18:05:13 ----A---- C:\WINDOWS\system32\mapi32.dll
2013-01-05 18:04:16 ----SD---- C:\WINDOWS\Downloaded Program Files
2013-01-05 18:04:16 ----RD---- C:\WINDOWS\Offline Web Pages
2013-01-05 18:04:05 ----HD---- C:\Program Files\WindowsUpdate
2013-01-05 18:03:40 ----D---- C:\WINDOWS\system32\DirectX
2013-01-05 18:03:18 ----A---- C:\WINDOWS\system32\atrace.dll
2013-01-05 18:03:15 ----A---- C:\WINDOWS\system32\desktop.ini
2013-01-05 18:03:15 ----A---- C:\WINDOWS\desktop.ini
2013-01-05 18:03:08 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2013-01-05 18:03:07 ----A---- C:\WINDOWS\system32\acctres.dll
2013-01-05 18:03:06 ----D---- C:\Program Files\Common Files\Services
2013-01-05 18:03:04 ----SD---- C:\WINDOWS\Tasks
2013-01-05 18:03:04 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2013-01-05 18:03:02 ----D---- C:\Program Files\Common Files\MSSoap
2013-01-05 18:02:58 ----D---- C:\WINDOWS\srchasst
2013-01-05 18:02:57 ----D---- C:\WINDOWS\system32\Macromed
2013-01-05 18:02:53 ----A---- C:\WINDOWS\system32\wuweb.dll
2013-01-05 18:02:53 ----A---- C:\WINDOWS\system32\wups.dll
2013-01-05 18:02:53 ----A---- C:\WINDOWS\system32\wucltui.dll
2013-01-05 18:02:53 ----A---- C:\WINDOWS\system32\wuauserv.dll
2013-01-05 18:02:53 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2013-01-05 18:02:53 ----A---- C:\WINDOWS\system32\wuaueng.dll
2013-01-05 18:02:53 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2013-01-05 18:02:53 ----A---- C:\WINDOWS\system32\wuauclt.exe
2013-01-05 18:02:52 ----A---- C:\WINDOWS\system32\wuapi.dll
2013-01-05 18:02:52 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2013-01-05 18:02:52 ----A---- C:\WINDOWS\system32\qmgr.dll
2013-01-05 18:02:52 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2013-01-05 18:02:52 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2013-01-05 18:02:47 ----D---- C:\Program Files\Movie Maker
2013-01-05 18:02:43 ----A---- C:\WINDOWS\system32\safrslv.dll
2013-01-05 18:02:43 ----A---- C:\WINDOWS\system32\safrdm.dll
2013-01-05 18:02:43 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2013-01-05 18:02:43 ----A---- C:\WINDOWS\system32\racpldlg.dll
2013-01-05 18:02:38 ----D---- C:\WINDOWS\system32\Restore
2013-01-05 18:02:38 ----A---- C:\WINDOWS\system32\srrstr.dll
2013-01-05 18:02:38 ----A---- C:\WINDOWS\system32\fltMc.exe
2013-01-05 18:02:38 ----A---- C:\WINDOWS\system32\fltlib.dll
2013-01-05 18:02:38 ----A---- C:\WINDOWS\system32\drivers\fltMgr.sys
2013-01-05 18:02:37 ----A---- C:\WINDOWS\system32\srsvc.dll
2013-01-05 18:02:37 ----A---- C:\WINDOWS\system32\srclient.dll
2013-01-05 18:02:37 ----A---- C:\WINDOWS\system32\mnmdd.dll
2013-01-05 18:02:37 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2013-01-05 18:02:37 ----A---- C:\WINDOWS\system32\ils.dll
2013-01-05 18:02:37 ----A---- C:\WINDOWS\system32\drivers\sr.sys
2013-01-05 18:02:36 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2013-01-05 18:02:36 ----A---- C:\WINDOWS\system32\msconf.dll
2013-01-05 18:02:36 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2013-01-05 18:02:33 ----D---- C:\Program Files\NetMeeting
2013-01-05 18:02:33 ----A---- C:\WINDOWS\system32\msoert2.dll
2013-01-05 18:02:33 ----A---- C:\WINDOWS\system32\msoeacct.dll
2013-01-05 18:02:32 ----A---- C:\WINDOWS\system32\inetres.dll
2013-01-05 18:02:32 ----A---- C:\WINDOWS\system32\inetcomm.dll
2013-01-05 18:02:29 ----D---- C:\Program Files\Outlook Express
2013-01-05 18:02:29 ----A---- C:\WINDOWS\system32\schedsvc.dll
2013-01-05 18:02:29 ----A---- C:\WINDOWS\system32\mstinit.exe
2013-01-05 18:02:29 ----A---- C:\WINDOWS\system32\mstask.dll
2013-01-05 18:02:29 ----A---- C:\WINDOWS\system32\icwphbk.dll
2013-01-05 18:02:28 ----A---- C:\WINDOWS\system32\isign32.dll
2013-01-05 18:02:28 ----A---- C:\WINDOWS\system32\inetcfg.dll
2013-01-05 18:02:28 ----A---- C:\WINDOWS\system32\icwdial.dll
2013-01-05 18:02:22 ----D---- C:\Program Files\Common Files\System
2013-01-05 18:02:17 ----D---- C:\Program Files\Internet Explorer
2013-01-05 18:01:51 ----A---- C:\WINDOWS\system32\emptyregdb.dat
2013-01-05 18:01:34 ----D---- C:\Program Files\ComPlus Applications
2013-01-05 18:01:31 ----A---- C:\WINDOWS\vbaddin.ini
2013-01-05 18:01:31 ----A---- C:\WINDOWS\vb.ini
2013-01-05 18:01:24 ----D---- C:\WINDOWS\Registration
2013-01-05 18:01:12 ----D---- C:\Program Files\Windows Media Player
2013-01-05 18:01:12 ----D---- C:\Program Files\Online Services
2013-01-05 18:01:04 ----D---- C:\Program Files\Messenger
2013-01-05 18:01:00 ----D---- C:\Program Files\MSN Gaming Zone
2013-01-05 18:01:00 ----A---- C:\WINDOWS\system32\write.exe
2013-01-05 18:00:51 ----A---- C:\WINDOWS\system32\sndvol32.exe
2013-01-05 18:00:51 ----A---- C:\WINDOWS\system32\hticons.dll
2013-01-05 18:00:51 ----A---- C:\WINDOWS\system32\avwav.dll
2013-01-05 18:00:51 ----A---- C:\WINDOWS\system32\avtapi.dll
2013-01-05 18:00:51 ----A---- C:\WINDOWS\system32\avmeter.dll
2013-01-05 18:00:50 ----A---- C:\WINDOWS\system32\winchat.exe
2013-01-05 18:00:44 ----A---- C:\WINDOWS\system32\getuname.dll
2013-01-05 18:00:43 ----A---- C:\WINDOWS\system32\sol.exe
2013-01-05 18:00:43 ----A---- C:\WINDOWS\system32\charmap.exe
2013-01-05 18:00:43 ----A---- C:\WINDOWS\system32\calc.exe
2013-01-05 18:00:42 ----A---- C:\WINDOWS\system32\winmine.exe
2013-01-05 18:00:42 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2013-01-05 18:00:42 ----A---- C:\WINDOWS\system32\reset.exe
2013-01-05 18:00:42 ----A---- C:\WINDOWS\system32\mshearts.exe
2013-01-05 18:00:42 ----A---- C:\WINDOWS\system32\freecell.exe
2013-01-05 18:00:41 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2013-01-05 18:00:41 ----A---- C:\WINDOWS\system32\tslabels.ini
2013-01-05 18:00:41 ----A---- C:\WINDOWS\system32\tskill.exe
2013-01-05 18:00:41 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2013-01-05 18:00:41 ----A---- C:\WINDOWS\system32\tscon.exe
2013-01-05 18:00:41 ----A---- C:\WINDOWS\system32\shadow.exe
2013-01-05 18:00:41 ----A---- C:\WINDOWS\system32\rwinsta.exe
2013-01-05 18:00:41 ----A---- C:\WINDOWS\system32\regini.exe
2013-01-05 18:00:41 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2013-01-05 18:00:41 ----A---- C:\WINDOWS\system32\qwinsta.exe
2013-01-05 18:00:41 ----A---- C:\WINDOWS\system32\qappsrv.exe
2013-01-05 18:00:41 ----A---- C:\WINDOWS\system32\msg.exe
2013-01-05 18:00:41 ----A---- C:\WINDOWS\system32\logoff.exe
2013-01-05 18:00:40 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2013-01-05 18:00:40 ----A---- C:\WINDOWS\system32\cdmodem.dll
2013-01-05 18:00:39 ----A---- C:\WINDOWS\system32\stclient.dll
2013-01-05 18:00:39 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2013-01-05 18:00:39 ----A---- C:\WINDOWS\system32\mtxex.dll
2013-01-05 18:00:39 ----A---- C:\WINDOWS\system32\mtxdm.dll
2013-01-05 18:00:39 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2013-01-05 18:00:39 ----A---- C:\WINDOWS\system32\comrepl.dll
2013-01-05 18:00:39 ----A---- C:\WINDOWS\system32\comaddin.dll
2013-01-05 18:00:38 ----A---- C:\WINDOWS\system32\comsnap.dll
2013-01-05 18:00:33 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2013-01-05 18:00:17 ----D---- C:\Program Files\MSN
2013-01-05 18:00:16 ----A---- C:\WINDOWS\system32\sndrec32.exe
2013-01-05 18:00:16 ----A---- C:\WINDOWS\system32\mplay32.exe
2013-01-05 18:00:16 ----A---- C:\WINDOWS\system32\accwiz.exe
2013-01-05 18:00:15 ----D---- C:\Program Files\Windows NT
2013-01-05 18:00:15 ----A---- C:\WINDOWS\system32\mspaint.exe
2013-01-05 18:00:15 ----A---- C:\WINDOWS\system32\hypertrm.dll
2013-01-05 18:00:15 ----A---- C:\WINDOWS\system32\clipbrd.exe
2013-01-05 18:00:14 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2013-01-05 18:00:14 ----A---- C:\WINDOWS\system32\spider.exe
2013-01-05 18:00:14 ----A---- C:\WINDOWS\system32\drivers\tdtcp.sys
2013-01-05 18:00:14 ----A---- C:\WINDOWS\system32\drivers\tdpipe.sys
2013-01-05 18:00:14 ----A---- C:\WINDOWS\system32\drivers\rdpwd.sys
2013-01-05 18:00:13 ----A---- C:\WINDOWS\system32\sessmgr.exe
2013-01-05 18:00:13 ----A---- C:\WINDOWS\system32\remotepg.dll
2013-01-05 18:00:13 ----A---- C:\WINDOWS\system32\rdshost.exe
2013-01-05 18:00:13 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2013-01-05 18:00:13 ----A---- C:\WINDOWS\system32\mstscax.dll
2013-01-05 18:00:13 ----A---- C:\WINDOWS\system32\mstsc.exe
2013-01-05 18:00:12 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2013-01-05 18:00:12 ----A---- C:\WINDOWS\system32\termsrv.dll
2013-01-05 18:00:12 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2013-01-05 18:00:12 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2013-01-05 18:00:12 ----A---- C:\WINDOWS\system32\rdpclip.exe
2013-01-05 18:00:12 ----A---- C:\WINDOWS\system32\rdchost.dll
2013-01-05 18:00:12 ----A---- C:\WINDOWS\system32\qprocess.exe
2013-01-05 18:00:12 ----A---- C:\WINDOWS\system32\icaapi.dll
2013-01-05 18:00:12 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2013-01-05 18:00:11 ----D---- C:\WINDOWS\system32\MsDtc
2013-01-05 18:00:11 ----A---- C:\WINDOWS\system32\mtxoci.dll
2013-01-05 18:00:11 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2013-01-05 18:00:11 ----A---- C:\WINDOWS\system32\msdtctm.dll
2013-01-05 18:00:11 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2013-01-05 18:00:10 ----A---- C:\WINDOWS\system32\xolehlp.dll
2013-01-05 18:00:10 ----A---- C:\WINDOWS\system32\msdtclog.dll
2013-01-05 18:00:10 ----A---- C:\WINDOWS\system32\msdtc.exe
2013-01-05 18:00:09 ----D---- C:\WINDOWS\system32\Com
2013-01-05 18:00:09 ----A---- C:\WINDOWS\system32\colbact.dll
2013-01-05 18:00:09 ----A---- C:\WINDOWS\system32\clbcatex.dll
2013-01-05 18:00:09 ----A---- C:\WINDOWS\system32\catsrvut.dll
2013-01-05 18:00:09 ----A---- C:\WINDOWS\system32\catsrvps.dll
2013-01-05 18:00:09 ----A---- C:\WINDOWS\system32\catsrv.dll
2013-01-05 18:00:08 ----A---- C:\WINDOWS\system32\comuid.dll
2013-01-05 18:00:08 ----A---- C:\WINDOWS\system32\comsvcs.dll
2013-01-05 18:00:08 ----A---- C:\WINDOWS\system32\clbcatq.dll
2013-01-05 18:00:01 ----A---- C:\WINDOWS\system32\servdeps.dll
2013-01-05 18:00:00 ----A---- C:\WINDOWS\system32\mmfutil.dll
2013-01-05 18:00:00 ----A---- C:\WINDOWS\system32\licwmi.dll
2013-01-05 17:59:58 ----A---- C:\WINDOWS\system32\cmprops.dll
2013-01-05 17:59:55 ----A---- C:\WINDOWS\system32\drivers\rdpdr.sys
2013-01-05 17:59:54 ----A---- C:\WINDOWS\system32\drivers\termdd.sys

======List of files/folders modified in the last 1 month======

2013-01-05 18:30:30 ----A---- C:\WINDOWS\system.ini
2013-01-05 18:05:31 ----A---- C:\WINDOWS\win.ini
2013-01-05 18:05:00 ----ASH---- C:\WINDOWS\fonts\desktop.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-10-30 25256]
R1 AmdK8;AMD Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 36864]
R1 AswRdr;aswRdr; C:\WINDOWS\system32\drivers\AswRdr.sys [2012-10-30 35928]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-10-30 738504]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-10-30 361032]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-10-30 54232]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-10-30 21256]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-10-30 97608]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2008-10-27 12672]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-07-21 3565056]
R3 FwLnk;FwLnk Driver; C:\WINDOWS\system32\DRIVERS\FwLnk.sys [2007-04-04 5888]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-04 9600]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2008-10-27 989696]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2008-10-27 211456]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-04-01 4725760]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2007-11-12 103296]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2008-04-01 220032]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbvideo;USB Video Device (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2004-08-04 78464]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2008-10-27 731520]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader; C:\WINDOWS\System32\Drivers\RTS5121.sys []
S3 RTL8187B;Sieťový adaptér bezdrôtového pripojenia RTL8187B Wireless 802.11b/g 54Mbps USB 2.0; C:\WINDOWS\system32\DRIVERS\RTL8187B.sys [2009-02-23 338944]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-07-21 602112]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-10-30 44808]
R2 TAPPSRV;TOSHIBA Application Service; C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe [2008-04-14 34304]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-07-21 593920]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2013-01-12 136176]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2013-01-12 136176]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2013-01-12 194032]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2013-01-08 541760]

-----------------EOF-----------------

Re: Win32:Jeefo

Napsal: 13 led 2013 10:19
od Rudy
Zdravím!
Dejte log ComboFix:
Stahnete a ulozte nejlepe na plochu ComboFix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na

tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o

jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte

spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni

aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni

stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu

pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

Re: Win32:Jeefo

Napsal: 13 led 2013 11:14
od 7ivan70
ComboFix 13-01-13.01 - ivan 13.01.2013 10:51:09.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.1918.1484 [GMT 1:00]
Running from: c:\documents and settings\ivan\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\ijl11.dll
c:\windows\system32\MUI\041b\tourstart.exe
c:\windows\system32\vbpng1.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_POWERMANAGER
.
.
((((((((((((((((((((((((( Files Created from 2012-12-13 to 2013-01-13 )))))))))))))))))))))))))))))))
.
.
2013-01-13 08:20 . 2013-01-13 08:20 -------- d-----w- C:\totalcmd
2013-01-12 21:21 . 2013-01-12 21:29 -------- d-----w- C:\rsit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\Steam\steam.exe" [2013-01-05 1354736]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2013-01-12 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2008-05-27 360448]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-21 61440]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-01 16859648]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-01 1024000]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\steamapps\\1dykmore\\counter-strike\\hl.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [12.1.2013 21:07 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [12.1.2013 21:08 361032]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12.1.2013 21:08 21256]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [5.1.2013 18:35 5888]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTS5121.sys --> c:\windows\system32\Drivers\RTS5121.sys [?]
S3 RTL8187B;Sieťový adaptér bezdrôtového pripojenia RTL8187B Wireless 802.11b/g 54Mbps USB 2.0;c:\windows\system32\drivers\RTL8187B.sys [5.1.2013 18:52 338944]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2013-01-13 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-01-12 22:50]
.
2013-01-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-01-12 20:08]
.
2013-01-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-01-12 20:08]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
TCP: DhcpNameServer = 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Adobe Flash Player ActiveX - c:\windows\system32\Macromed\Flash\FlashUtil11g_ActiveX.exe
AddRemove-Adobe Photoshop 7.0 CE - c:\windows\ISUN0405.EXE
AddRemove-All ATI Software - c:\program files\ATI Technologies\UninstallAll\AtiCimUn.exe
AddRemove-CNXT_MODEM_PCI_VEN_14F1&DEV_2C06&SUBSYS_14F10000 - c:\program files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2C06&SUBSYS_14F10000\UIU32m.exe
AddRemove-PSPad editor_is1 - c:\program files\PSPad editor\Uninst\unins000.exe
AddRemove-{C151CE54-E7EA-4804-854B-F515368B0798} - c:\program files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe
AddRemove-{C9BED750-1211-4480-B1A5-718A3BE15525} - c:\program files\InstallShield Installation Information\{C9BED750-1211-4480-B1A5-718A3BE15525}\setup.exe
AddRemove-{D10CB652-9332-4242-B7A9-2D61570144F7} - c:\program files\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\setup.exe
AddRemove-Google Chrome - c:\documents and settings\ivan\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.97\Installer\setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-01-13 10:56
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(756)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
.
**************************************************************************
.
Completion time: 2013-01-13 10:59:26 - machine was rebooted
ComboFix-quarantined-files.txt 2013-01-13 09:59
.
Pre-Run: 23 340 163 072 bytes free
Post-Run: 9 adresárov, 23 049 666 560 voľných bajtov
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - 3A0BDA0861F558B9D542FBAB14B0882F

Re: Win32:Jeefo

Napsal: 13 led 2013 11:49
od Rudy
Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:
KillAll::

Folder::
c:\program files\Google\GoogleToolbarNotifier

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"=-

Reboot::
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek

Re: Win32:Jeefo

Napsal: 13 led 2013 12:15
od 7ivan70
ComboFix 13-01-13.01 - ivan 13.01.2013 11:56:08.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.1918.1502 [GMT 1:00]
Running from: c:\documents and settings\ivan\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\ivan\Desktop\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Google\GoogleToolbarNotifier
c:\program files\Google\GoogleToolbarNotifier\5.7.8313.1002\gth.dll
c:\program files\Google\GoogleToolbarNotifier\5.7.8313.1002\gtn.dll
c:\program files\Google\GoogleToolbarNotifier\5.7.8313.1002\Readme.url
c:\program files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll
c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((( Files Created from 2012-12-13 to 2013-01-13 )))))))))))))))))))))))))))))))
.
.
2013-01-13 08:20 . 2013-01-13 08:20 -------- d-----w- C:\totalcmd
2013-01-12 21:21 . 2013-01-12 21:29 -------- d-----w- C:\rsit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\Steam\steam.exe" [2013-01-05 1354736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2008-05-27 360448]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-21 61440]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-01 16859648]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-01 1024000]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\steamapps\\1dykmore\\counter-strike\\hl.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [12.1.2013 21:07 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [12.1.2013 21:08 361032]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12.1.2013 21:08 21256]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [5.1.2013 18:35 5888]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTS5121.sys --> c:\windows\system32\Drivers\RTS5121.sys [?]
S3 RTL8187B;Sieťový adaptér bezdrôtového pripojenia RTL8187B Wireless 802.11b/g 54Mbps USB 2.0;c:\windows\system32\drivers\RTL8187B.sys [5.1.2013 18:52 338944]
.
Contents of the 'Scheduled Tasks' folder
.
2013-01-13 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-01-12 22:50]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TCP: DhcpNameServer = 192.168.1.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-01-13 12:01
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(756)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\RTHDCPL.EXE
c:\program files\Google\Update\GoogleUpdate.exe
c:\program files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2013-01-13 12:03:35 - machine was rebooted
ComboFix-quarantined-files.txt 2013-01-13 11:03
ComboFix2.txt 2013-01-13 09:59
.
Pre-Run: 23 044 354 048 bytes free
Post-Run: 9 adresárov, 23 156 195 328 voľných bajtov
.
- - End Of File - - 34D1636F5C201287A52E6B41E731F5EE

Re: Win32:Jeefo

Napsal: 13 led 2013 12:26
od Rudy
Log již vypadá čistý.

Re: Win32:Jeefo

Napsal: 13 led 2013 12:33
od 7ivan70
dakujem,,,

ako si preverit,ci som si nenakazil i svoju www stranku?mohol som ju nakazit cez ftp?



vsetko z ftp som stiahol na svoj hdd a dal skontrolovat,,,nenasiel avast nic.

Re: Win32:Jeefo

Napsal: 13 led 2013 16:15
od Rudy
Pokud jste si jist, že záloha, kterou máte uloženou, je čistá, postačí klidně přehrát tu stránku ze zálohy. Pak si můžete být jistý, že není nakažena.
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz