VIRY.CZ

Kód: Vybrat vše

Logfile of random's system information tool 1.06 (written by random/random)
Run by Maroš at 2010-01-05 01:26:05
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 120 GB (50%) free of 238 GB
Total RAM: 2046 MB (68% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:26:20, on 5.1.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Maroš\Desktop\RSIT.exe
C:\Program Files\trend micro\Maroš.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2C35C72-C98E-4C9E-8D89-DB5A0152A3DB}: NameServer = 87.244.225.1,217.199.113.244
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate1ca887ce5052f88) (gupdate1ca887ce5052f88) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Zwunzi Service - Unknown owner - C:\Documents and Settings\All Users\Application Data\Zwunzi\zwunzi133.exe

--
End of file - 6639 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-11-07 1088296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG9\avgssie.dll [2009-12-12 1484056]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-11-10 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-11-10 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-07-26 13570048]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-07-26 86016]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-07-03 16876032]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2008-06-18 77824]
"AlcWzrd"=C:\WINDOWS\ALCWZRD.EXE [2008-06-19 2808832]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-06-19 57344]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-09 153136]
"Monitor"=C:\WINDOWS\PixArt\PAC207\Monitor.exe [2006-11-03 319488]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-11-10 149280]
"AVG9_TRAY"=C:\PROGRA~1\AVG\AVG9\avgtray.exe [2010-01-01 2033432]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Vypress Chat StartUp.lnk]
C:\WINDOWS\Installer\{EFB20191-C715-40FB-BF86-929AEF40C1B8}\iconVCAdvertised.exe [2009-10-13 12390]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2009-09-03 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
C:\WINDOWS\system32\avgrsstx.dll [2009-11-15 12464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Activision Value\Soldier of Fortune Payback\sof3.exe"="C:\Program Files\Activision Value\Soldier of Fortune Payback\sof3.exe:*:Enabled:sof3"
"C:\Program Files\Vypress Chat\VyChat.exe"="C:\Program Files\Vypress Chat\VyChat.exe:*:Enabled:Vypress Chat - network chat software"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\KONAMI\Pro Evolution Soccer 2010\pes2010.exe"="C:\Program Files\KONAMI\Pro Evolution Soccer 2010\pes2010.exe:*:Enabled:Pro Evolution Soccer 2010"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\2K Games\Gearbox Software\Borderlands\Binaries\Borderlands.exe"="C:\Program Files\2K Games\Gearbox Software\Borderlands\Binaries\Borderlands.exe:*:Enabled:Borderlands"
"C:\Program Files\Java\jre6\launch4j-tmp\frd.exe"="C:\Program Files\Java\jre6\launch4j-tmp\frd.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\AVG\AVG9\avgupd.exe"="C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG9\avgnsx.exe"="C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Hry\Counter strike fun\CSTRIKE.EXE"="C:\Hry\Counter strike fun\CSTRIKE.EXE:*:Enabled:Half-Life Launcher"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"C:\Program Files\Activision\Modern Warfare 2\iw4mp.exe"="C:\Program Files\Activision\Modern Warfare 2\iw4mp.exe:*:Enabled:iw4mp"
"C:\Program Files\TeamViewer\Version5\TeamViewer.exe"="C:\Program Files\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application"
"C:\Program Files\GSC World Publishing\Ń.Ň.Ŕ.Ë.Ę.Ĺ.Đ. - ×čńňîĺ Íĺáî\bin\xrEngine.exe"="C:\Program Files\GSC World Publishing\Ń.Ň.Ŕ.Ë.Ę.Ĺ.Đ. - ×čńňîĺ Íĺáî\bin\xrEngine.exe:*:Enabled:Ń.Ň.Ŕ.Ë.Ę.Ĺ.Đ. - ×čńňîĺ Íĺáî (CLI)"
"C:\Program Files\GSC World Publishing\Ń.Ň.Ŕ.Ë.Ę.Ĺ.Đ. - ×čńňîĺ Íĺáî\bin\dedicated\xrEngine.exe"="C:\Program Files\GSC World Publishing\Ń.Ň.Ŕ.Ë.Ę.Ĺ.Đ. - ×čńňîĺ Íĺáî\bin\dedicated\xrEngine.exe:*:Enabled:Ń.Ň.Ŕ.Ë.Ę.Ĺ.Đ. - ×čńňîĺ Íĺáî (SRV)"
"C:\Documents and Settings\Maroš\Desktop\Turok\Binaries\TurokGame.exe"="C:\Documents and Settings\Maroš\Desktop\Turok\Binaries\TurokGame.exe:*:Enabled:Turok"
"C:\Hry\Turok\Binaries\TurokGame.exe"="C:\Hry\Turok\Binaries\TurokGame.exe:*:Enabled:Turok"
"C:\Program Files\EA Sports\FIFA 09\FIFA09.exe"="C:\Program Files\EA Sports\FIFA 09\FIFA09.exe:*:Enabled:FIFA09"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe"="C:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV"
"C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"C:\Program Files\Rockstar Games\Grand Theft Auto IV\GTAIV.exe"="C:\Program Files\Rockstar Games\Grand Theft Auto IV\GTAIV.exe:*:Enabled:Grand Theft Auto IV"
"C:\Program Files\Xfire\Xfire.exe"="C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aff872b8-bee2-11de-a96b-001fd0b541bd}]
shell\AutoRun\command - J:\abk.bat
shell\explore\command - J:\abk.bat
shell\open\command - J:\abk.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aff872b9-bee2-11de-a96b-001fd0b541bd}]
shell\AutoRun\command - K:\abk.bat
shell\explore\command - K:\abk.bat
shell\open\command - K:\abk.bat


======List of files/folders created in the last 1 months======

2010-01-05 01:26:05 ----D---- C:\rsit
2010-01-05 01:26:05 ----D---- C:\Program Files\trend micro
2010-01-04 23:19:41 ----D---- C:\Documents and Settings\Maroš\Application Data\Xfire
2010-01-04 23:19:37 ----D---- C:\Program Files\Xfire
2010-01-04 20:38:08 ----D---- C:\WINDOWS\system32\LogFiles
2010-01-04 20:38:05 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-01-04 20:38:03 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2010-01-04 20:37:25 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2010-01-04 20:36:54 ----D---- C:\WINDOWS\LastGood
2009-12-31 19:48:24 ----A---- C:\WINDOWS\system32\wmpns.dll
2009-12-31 18:02:48 ----D---- C:\Documents and Settings\Maroš\Application Data\Audio Recorder for Free
2009-12-31 18:02:38 ----D---- C:\Program Files\Zwunzi
2009-12-31 18:02:38 ----D---- C:\Documents and Settings\All Users\Application Data\Zwunzi
2009-12-31 18:02:05 ----A---- C:\WINDOWS\system32\NCTWMAFile2.dll
2009-12-31 18:02:05 ----A---- C:\WINDOWS\system32\NCTTextToAudio2.dll
2009-12-31 18:02:05 ----A---- C:\WINDOWS\system32\NCTAudioVisualization2.dll
2009-12-31 18:02:05 ----A---- C:\WINDOWS\system32\NCTAudioTransform2.dll
2009-12-31 18:02:05 ----A---- C:\WINDOWS\system32\NCTAudioRecord2.dll
2009-12-31 18:02:05 ----A---- C:\WINDOWS\system32\NCTAudioPlayer2.dll
2009-12-31 18:02:05 ----A---- C:\WINDOWS\system32\NCTAudioInformation2.dll
2009-12-31 18:02:04 ----A---- C:\WINDOWS\system32\NCTAudioFile2.dll
2009-12-31 18:02:04 ----A---- C:\WINDOWS\system32\NCTAudioEditor2.dll
2009-12-31 18:02:04 ----A---- C:\WINDOWS\system32\NCTAudioCDGrabber2.dll
2009-12-31 18:02:04 ----A---- C:\WINDOWS\system32\msvcr70.dll
2009-12-31 18:02:03 ----D---- C:\Program Files\Audio Recorder for FREE
2009-12-31 17:55:54 ----D---- C:\Program Files\MXSkypeRec
2009-12-29 12:51:55 ----D---- C:\Documents and Settings\Maroš\Application Data\Google
2009-12-29 12:48:43 ----D---- C:\Program Files\Google
2009-12-23 00:59:32 ----A---- C:\WINDOWS\system32\xfcodec.dll
2009-12-22 18:22:15 ----D---- C:\Program Files\Rockstar Games
2009-12-22 12:58:23 ----D---- C:\Program Files\Ubisoft
2009-12-20 20:16:57 ----D---- C:\Program Files\Robster Productions
2009-12-17 21:27:18 ----D---- C:\Documents and Settings\Maroš\Application Data\XRay Engine
2009-12-16 19:02:57 ----D---- C:\Documents and Settings\Maroš\Application Data\BSplayer Pro
2009-12-16 19:02:56 ----D---- C:\Program Files\Webteh
2009-12-09 07:19:08 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2009-12-09 07:19:03 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2009-12-09 07:18:35 ----HDC---- C:\WINDOWS\$NtUninstallKB976325$
2009-12-09 07:18:30 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2009-12-09 07:18:03 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2009-12-09 07:17:58 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2009-12-08 17:33:13 ----D---- C:\Documents and Settings\Maroš\Application Data\Download Manager
2009-12-07 17:15:23 ----D---- C:\WINDOWS\Sun

======List of files/folders modified in the last 1 months======

2010-01-05 01:26:05 ----RD---- C:\Program Files
2010-01-05 01:14:04 ----D---- C:\Documents and Settings\Maroš\Application Data\Skype
2010-01-05 00:41:40 ----D---- C:\Program Files\Mozilla Firefox
2010-01-05 00:03:36 ----D---- C:\WINDOWS\system32
2010-01-05 00:03:36 ----A---- C:\WINDOWS\system32\H@tKeysH@@k.DLL
2010-01-04 22:40:28 ----D---- C:\Hry
2010-01-04 22:38:06 ----D---- C:\WINDOWS
2010-01-04 21:42:41 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2010-01-04 20:42:26 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-04 20:40:04 ----D---- C:\WINDOWS\Prefetch
2010-01-04 20:40:01 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2010-01-04 20:39:46 ----SHD---- C:\WINDOWS\Installer
2010-01-04 20:39:18 ----D---- C:\WINDOWS\Temp
2010-01-04 20:39:17 ----HD---- C:\WINDOWS\inf
2010-01-04 20:38:56 ----RSD---- C:\WINDOWS\assembly
2010-01-04 20:38:13 ----D---- C:\WINDOWS\system32\DirectX
2010-01-04 20:38:06 ----D---- C:\WINDOWS\system32\drivers
2010-01-04 20:37:34 ----D---- C:\Program Files\Windows Media Player
2010-01-04 20:37:31 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-01-04 20:37:28 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-04 16:06:07 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-01-04 16:04:17 ----D---- C:\Documents and Settings\Maroš\Application Data\skypePM
2010-01-04 14:58:33 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-01-04 13:08:46 ----D---- C:\Documents and Settings\Maroš\Application Data\AnoPoker
2010-01-04 00:04:25 ----D---- C:\Program Files\Soldier of Fortune II - Double Helix
2010-01-04 00:03:46 ----A---- C:\WINDOWS\Sof2.INI
2010-01-03 23:30:17 ----D---- C:\Documents and Settings\Maroš\Application Data\Hamachi
2010-01-03 22:49:17 ----D---- C:\Documents and Settings\Maroš\Application Data\uTorrent
2010-01-01 22:12:44 ----SHD---- C:\System Volume Information
2010-01-01 22:12:44 ----D---- C:\WINDOWS\system32\Restore
2010-01-01 17:22:47 ----D---- C:\Filmy
2009-12-30 11:26:56 ----RSD---- C:\WINDOWS\Fonts
2009-12-29 21:51:11 ----D---- C:\WINDOWS\Debug
2009-12-29 17:34:59 ----D---- C:\WINDOWS\system32\inetsrv
2009-12-29 13:45:30 ----D---- C:\Documents and Settings\Maroš\Application Data\Canon
2009-12-29 13:04:21 ----SD---- C:\WINDOWS\Tasks
2009-12-29 12:02:23 ----D---- C:\Program Files\ICQ6.5
2009-12-20 12:16:12 ----D---- C:\Documents and Settings\Maroš\Application Data\Vso
2009-12-19 11:01:41 ----D---- C:\Program Files\SUPERAntiSpyware
2009-12-17 20:47:24 ----D---- C:\Program Files\Activision
2009-12-17 18:53:24 ----D---- C:\Documents and Settings\Maroš\Application Data\TeamViewer
2009-12-17 18:53:06 ----D---- C:\Program Files\TeamViewer
2009-12-14 14:36:19 ----D---- C:\Documents and Settings
2009-12-14 10:43:26 ----A---- C:\WINDOWS\NeroDigital.ini
2009-12-09 07:18:58 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-12-09 07:18:29 ----HD---- C:\WINDOWS\$hf_mig$

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdPPM;AMD HwPState Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2009-11-15 333192]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2009-11-15 28424]
R1 AvgTdiX;AVG Free Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2009-11-15 360584]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-11-22 25280]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-07-03 4745216]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-07-26 6097536]
R3 PAC207;Trust Webcam Live; C:\WINDOWS\system32\DRIVERS\PFC027.SYS [2007-04-12 507264]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-10-15 47360]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-04 105856]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 a80odvl4;a80odvl4; C:\WINDOWS\system32\drivers\a80odvl4.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avg9wd;AVG Free WatchDog; C:\Program Files\AVG\AVG9\avgwdsvc.exe [2009-11-15 285392]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-11-10 153376]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-07-26 159812]
R3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe []
S2 gupdate1ca887ce5052f88;Služba Google Update (gupdate1ca887ce5052f88); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-29 133104]
S2 spupdsvc;Windows Service Pack Installer update service; C:\WINDOWS\system32\spupdsvc.exe [2007-11-30 26488]
S2 Zwunzi Service;Zwunzi Service; C:\Documents and Settings\All Users\Application Data\Zwunzi\zwunzi133.exe [2009-12-21 58176]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-11-04 654848]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Kód: Vybrat vše

ComboFix 10-01-04.01 - Maroš 06.01.2010  10:58:01.1.2 - x86
Systém Microsoft Windows XP Professional  5.1.2600.3.1250.421.1033.18.2046.1526 [GMT 1:00]
Running from: c:\documents and settings\Maroš\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

(((((((((((((((((((((((((   Files Created from 2009-12-06 to 2010-01-06  )))))))))))))))))))))))))))))))
.

2010-01-05 00:26 . 2010-01-05 15:59	--------	d-----w-	c:\program files\trend micro
2010-01-05 00:26 . 2010-01-05 00:26	--------	d-----w-	C:\rsit
2010-01-04 22:19 . 2010-01-05 08:46	--------	d-----w-	c:\program files\Xfire
2010-01-04 19:38 . 2010-01-04 19:38	--------	d-----w-	c:\windows\system32\LogFiles
2010-01-04 19:37 . 2010-01-04 19:38	--------	d-----w-	c:\windows\system32\drivers\umdf
2009-12-31 18:48 . 2008-04-14 00:12	221184	----a-w-	c:\windows\system32\wmpns.dll
2009-12-31 17:02 . 2005-05-18 10:52	1212416	----a-w-	c:\windows\system32\NCTAudioInformation2.dll
2009-12-31 17:02 . 2005-04-25 12:01	458752	----a-w-	c:\windows\system32\NCTAudioRecord2.dll
2009-12-31 17:02 . 2005-04-25 12:01	458752	----a-w-	c:\windows\system32\NCTAudioPlayer2.dll
2009-12-31 17:02 . 2005-04-04 16:21	602112	----a-w-	c:\windows\system32\NCTAudioTransform2.dll
2009-12-31 17:02 . 2005-03-28 14:54	479232	----a-w-	c:\windows\system32\NCTAudioVisualization2.dll
2009-12-31 17:02 . 2005-03-28 14:52	417792	----a-w-	c:\windows\system32\NCTTextToAudio2.dll
2009-12-31 17:02 . 2005-02-24 10:51	348160	----a-w-	c:\windows\system32\NCTWMAFile2.dll
2009-12-31 17:02 . 2005-05-17 11:37	1986560	----a-w-	c:\windows\system32\NCTAudioFile2.dll
2009-12-31 17:02 . 2005-04-15 11:08	880640	----a-w-	c:\windows\system32\NCTAudioEditor2.dll
2009-12-31 17:02 . 2004-11-04 12:31	835584	----a-w-	c:\windows\system32\NCTAudioCDGrabber2.dll
2009-12-31 17:02 . 2002-01-05 15:37	344064	----a-w-	c:\windows\system32\msvcr70.dll
2009-12-31 17:02 . 2009-12-31 17:02	--------	d-----w-	c:\program files\Audio Recorder for FREE
2009-12-31 16:55 . 2009-12-31 16:56	--------	d-----w-	c:\program files\MXSkypeRec
2009-12-29 12:09 . 2009-12-29 12:09	--------	d-----w-	c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-12-29 11:49 . 2009-12-29 11:49	--------	d-----w-	c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-12-29 11:48 . 2009-12-29 11:51	--------	d-----w-	c:\program files\Google
2009-12-22 23:59 . 2009-12-22 23:59	41872	----a-w-	c:\windows\system32\xfcodec.dll
2009-12-22 17:22 . 2010-01-04 19:42	--------	d-----w-	c:\program files\Rockstar Games
2009-12-22 11:58 . 2009-12-22 11:58	--------	d-----w-	c:\program files\Ubisoft
2009-12-20 19:16 . 2009-12-20 19:16	--------	d-----w-	c:\program files\Robster Productions
2009-12-16 18:02 . 2009-12-16 18:04	--------	d-----w-	c:\program files\Webteh
2009-12-07 16:15 . 2009-12-07 16:15	--------	d-----w-	c:\windows\Sun

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-06 00:36 . 2009-11-11 22:01	1227336	----a-w-	c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-05 21:27 . 2009-11-04 18:42	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP
2010-01-05 12:55 . 2009-10-19 17:32	20480	----a-w-	c:\windows\system32\H@tKeysH@@k.DLL
2010-01-04 19:42 . 2009-10-10 10:13	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-01-04 19:40 . 2009-11-19 20:19	107888	----a-w-	c:\windows\system32\CmdLineExt.dll
2010-01-03 23:04 . 2009-10-19 17:08	--------	d-----w-	c:\program files\Soldier of Fortune II - Double Helix
2009-12-29 11:02 . 2009-11-17 20:57	--------	d-----w-	c:\program files\ICQ6.5
2009-12-19 10:01 . 2009-10-14 13:12	--------	d-----w-	c:\program files\SUPERAntiSpyware
2009-12-17 19:47 . 2009-10-16 19:19	--------	d-----w-	c:\program files\Activision
2009-12-17 17:53 . 2009-10-20 13:15	--------	d-----w-	c:\program files\TeamViewer
2009-12-09 06:18 . 2009-11-04 14:16	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-05 13:26 . 2009-12-05 13:26	--------	d-----w-	c:\program files\Electronic Arts
2009-12-05 01:26 . 2009-10-10 11:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skype
2009-11-23 14:15 . 2009-11-23 14:15	--------	d-----w-	c:\program files\1C Publishing EU
2009-11-22 20:47 . 2009-11-19 20:13	--------	d-----w-	c:\program files\Serious Sam 2
2009-11-22 11:17 . 2009-11-22 11:17	--------	d-----w-	c:\program files\Hamachi
2009-11-22 11:17 . 2009-11-22 11:17	25280	----a-w-	c:\windows\system32\drivers\hamachi.sys
2009-11-21 10:37 . 2009-11-21 10:37	--------	d-----w-	c:\program files\VideoLAN
2009-11-15 08:17 . 2009-11-15 08:14	360584	----a-w-	c:\windows\system32\drivers\avgtdix.sys
2009-11-15 08:14 . 2009-11-15 08:14	12464	----a-w-	c:\windows\system32\avgrsstx.dll
2009-11-15 08:14 . 2009-11-15 08:14	333192	----a-w-	c:\windows\system32\drivers\avgldx86.sys
2009-11-15 08:14 . 2009-11-15 08:14	28424	----a-w-	c:\windows\system32\drivers\avgmfx86.sys
2009-11-15 08:14 . 2009-11-15 08:14	--------	d-----w-	c:\program files\AVG
2009-11-15 08:14 . 2009-11-15 08:14	--------	d-----w-	c:\documents and settings\All Users\Application Data\avg9
2009-11-11 14:57 . 2009-11-11 14:57	--------	d-----w-	c:\program files\Aspyr
2009-11-10 21:11 . 2009-11-10 21:11	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-11-10 21:11 . 2009-11-10 21:11	--------	d-----w-	c:\program files\Java
2009-11-10 14:43 . 2009-10-14 13:12	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard
2009-11-01 15:17 . 2009-10-13 13:10	691696	----a-w-	c:\windows\system32\drivers\sptd.sys
2009-10-29 05:38 . 2004-08-03 22:56	667136	----a-w-	c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-03 22:56	75776	----a-w-	c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-03 22:56	25088	----a-w-	c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-03 21:00	265728	----a-w-	c:\windows\system32\drivers\http.sys
2009-10-15 16:11 . 2009-10-15 16:11	47360	----a-w-	c:\windows\system32\drivers\pcouffin.sys
2009-10-13 13:29 . 2009-10-10 09:58	166455	----a-w-	c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-10-13 13:29 . 2009-10-10 09:58	5938	----a-w-	c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2009-10-13 10:30 . 2004-08-03 22:56	270336	----a-w-	c:\windows\system32\oakley.dll
2009-10-13 09:44 . 2009-10-13 09:44	315392	----a-w-	c:\windows\HideWin.exe
2009-10-13 09:43 . 2009-10-10 11:11	16608	----a-w-	c:\windows\gdrv.sys
2009-10-12 13:38 . 2004-08-03 22:56	149504	----a-w-	c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-03 22:56	79872	----a-w-	c:\windows\system32\raschap.dll
2009-10-10 12:01 . 2009-10-10 12:00	1925024	----a-w-	c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2009-10-10 11:37 . 2009-10-10 11:37	56	---ha-w-	c:\windows\system32\ezsidmv.dat
2009-10-10 11:32 . 2009-10-10 11:32	0	----a-w-	c:\windows\nsreg.dat
2009-10-10 10:48 . 2009-10-10 10:48	664	----a-w-	c:\windows\system32\d3d9caps.dat
2009-10-10 10:05 . 2009-10-10 09:58	8972	----a-w-	c:\windows\pchealth\helpctr\Config\Cntstore.bin
2009-10-10 09:56 . 2009-10-10 09:56	21640	----a-w-	c:\windows\system32\emptyregdb.dat
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-26 13570048]
"nwiz"="nwiz.exe" [2008-07-26 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-07-26 86016]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16876032]
"SoundMan"="SOUNDMAN.EXE" [2008-06-18 77824]
"AlcWzrd"="ALCWZRD.EXE" [2008-06-19 2808832]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-10 149280]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-01-01 2033432]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21	548352	----a-w-	c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-15 08:14	12464	----a-w-	c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Vypress Chat StartUp.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Vypress Chat StartUp.lnk
backup=c:\windows\pss\Vypress Chat StartUp.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Vypress Chat\\VyChat.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2010\\pes2010.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Hry\\Counter strike fun\\CSTRIKE.EXE"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Activision\\Modern Warfare 2\\iw4mp.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\EA Sports\\FIFA 09\\FIFA09.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [15.11.2009 9:14 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [15.11.2009 9:14 360584]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [15.9.2009 10:42 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [15.9.2009 10:42 74480]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [15.11.2009 9:14 285392]
R3 PAC207;Trust Webcam Live;c:\windows\system32\drivers\PFC027.SYS [12.4.2007 15:50 507264]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [13.10.2009 14:10 691696]
S2 gupdate1ca887ce5052f88;Služba Google Update (gupdate1ca887ce5052f88);c:\program files\Google\Update\GoogleUpdate.exe [29.12.2009 12:48 133104]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [15.9.2009 10:42 7408]
.
Contents of the 'Scheduled Tasks' folder

2010-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-29 11:48]

2010-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-29 11:48]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: {E2C35C72-C98E-4C9E-8D89-DB5A0152A3DB} = 87.244.225.1,217.199.113.244
FF - ProfilePath - c:\documents and settings\Maroš\Application Data\Mozilla\Firefox\Profiles\lt8fg4cu.default\
FF - prefs.js: browser.startup.homepage - www.google.sk
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-06 11:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(868)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2010-01-06  11:02:18
ComboFix-quarantined-files.txt  2010-01-06 10:02

Pre-Run: 133 414 187 008 bytes free
Post-Run: 15 adresárov, 133 406 203 904 voľných bajtov

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - B5ABA9763B53633BEBD9F2F474A3B802

Kód: Vybrat vše

ComboFix 10-01-04.01 - Maroš 06.01.2010  11:31:20.2.2 - x86
Systém Microsoft Windows XP Professional  5.1.2600.3.1250.421.1033.18.2046.1503 [GMT 1:00]
Running from: c:\documents and settings\Maroš\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Maroš\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

(((((((((((((((((((((((((   Files Created from 2009-12-06 to 2010-01-06  )))))))))))))))))))))))))))))))
.

2010-01-05 00:26 . 2010-01-05 15:59	--------	d-----w-	c:\program files\trend micro
2010-01-05 00:26 . 2010-01-05 00:26	--------	d-----w-	C:\rsit
2010-01-04 22:19 . 2010-01-05 08:46	--------	d-----w-	c:\program files\Xfire
2010-01-04 19:38 . 2010-01-04 19:38	--------	d-----w-	c:\windows\system32\LogFiles
2010-01-04 19:37 . 2010-01-04 19:38	--------	d-----w-	c:\windows\system32\drivers\umdf
2009-12-31 18:48 . 2008-04-14 00:12	221184	----a-w-	c:\windows\system32\wmpns.dll
2009-12-31 17:02 . 2005-05-18 10:52	1212416	----a-w-	c:\windows\system32\NCTAudioInformation2.dll
2009-12-31 17:02 . 2005-04-25 12:01	458752	----a-w-	c:\windows\system32\NCTAudioRecord2.dll
2009-12-31 17:02 . 2005-04-25 12:01	458752	----a-w-	c:\windows\system32\NCTAudioPlayer2.dll
2009-12-31 17:02 . 2005-04-04 16:21	602112	----a-w-	c:\windows\system32\NCTAudioTransform2.dll
2009-12-31 17:02 . 2005-03-28 14:54	479232	----a-w-	c:\windows\system32\NCTAudioVisualization2.dll
2009-12-31 17:02 . 2005-03-28 14:52	417792	----a-w-	c:\windows\system32\NCTTextToAudio2.dll
2009-12-31 17:02 . 2005-02-24 10:51	348160	----a-w-	c:\windows\system32\NCTWMAFile2.dll
2009-12-31 17:02 . 2005-05-17 11:37	1986560	----a-w-	c:\windows\system32\NCTAudioFile2.dll
2009-12-31 17:02 . 2005-04-15 11:08	880640	----a-w-	c:\windows\system32\NCTAudioEditor2.dll
2009-12-31 17:02 . 2004-11-04 12:31	835584	----a-w-	c:\windows\system32\NCTAudioCDGrabber2.dll
2009-12-31 17:02 . 2002-01-05 15:37	344064	----a-w-	c:\windows\system32\msvcr70.dll
2009-12-31 17:02 . 2009-12-31 17:02	--------	d-----w-	c:\program files\Audio Recorder for FREE
2009-12-31 16:55 . 2009-12-31 16:56	--------	d-----w-	c:\program files\MXSkypeRec
2009-12-29 12:09 . 2009-12-29 12:09	--------	d-----w-	c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-12-29 11:49 . 2009-12-29 11:49	--------	d-----w-	c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-12-29 11:48 . 2009-12-29 11:51	--------	d-----w-	c:\program files\Google
2009-12-22 23:59 . 2009-12-22 23:59	41872	----a-w-	c:\windows\system32\xfcodec.dll
2009-12-22 17:22 . 2010-01-04 19:42	--------	d-----w-	c:\program files\Rockstar Games
2009-12-22 11:58 . 2009-12-22 11:58	--------	d-----w-	c:\program files\Ubisoft
2009-12-20 19:16 . 2009-12-20 19:16	--------	d-----w-	c:\program files\Robster Productions
2009-12-16 18:02 . 2009-12-16 18:04	--------	d-----w-	c:\program files\Webteh
2009-12-07 16:15 . 2009-12-07 16:15	--------	d-----w-	c:\windows\Sun

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-06 00:36 . 2009-11-11 22:01	1227336	----a-w-	c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-05 21:27 . 2009-11-04 18:42	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP
2010-01-05 12:55 . 2009-10-19 17:32	20480	----a-w-	c:\windows\system32\H@tKeysH@@k.DLL
2010-01-04 19:42 . 2009-10-10 10:13	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-01-04 19:40 . 2009-11-19 20:19	107888	----a-w-	c:\windows\system32\CmdLineExt.dll
2010-01-03 23:04 . 2009-10-19 17:08	--------	d-----w-	c:\program files\Soldier of Fortune II - Double Helix
2009-12-29 11:02 . 2009-11-17 20:57	--------	d-----w-	c:\program files\ICQ6.5
2009-12-19 10:01 . 2009-10-14 13:12	--------	d-----w-	c:\program files\SUPERAntiSpyware
2009-12-17 19:47 . 2009-10-16 19:19	--------	d-----w-	c:\program files\Activision
2009-12-17 17:53 . 2009-10-20 13:15	--------	d-----w-	c:\program files\TeamViewer
2009-12-09 06:18 . 2009-11-04 14:16	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-05 13:26 . 2009-12-05 13:26	--------	d-----w-	c:\program files\Electronic Arts
2009-12-05 01:26 . 2009-10-10 11:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skype
2009-11-23 14:15 . 2009-11-23 14:15	--------	d-----w-	c:\program files\1C Publishing EU
2009-11-22 20:47 . 2009-11-19 20:13	--------	d-----w-	c:\program files\Serious Sam 2
2009-11-22 11:17 . 2009-11-22 11:17	--------	d-----w-	c:\program files\Hamachi
2009-11-22 11:17 . 2009-11-22 11:17	25280	----a-w-	c:\windows\system32\drivers\hamachi.sys
2009-11-21 10:37 . 2009-11-21 10:37	--------	d-----w-	c:\program files\VideoLAN
2009-11-15 08:17 . 2009-11-15 08:14	360584	----a-w-	c:\windows\system32\drivers\avgtdix.sys
2009-11-15 08:14 . 2009-11-15 08:14	12464	----a-w-	c:\windows\system32\avgrsstx.dll
2009-11-15 08:14 . 2009-11-15 08:14	333192	----a-w-	c:\windows\system32\drivers\avgldx86.sys
2009-11-15 08:14 . 2009-11-15 08:14	28424	----a-w-	c:\windows\system32\drivers\avgmfx86.sys
2009-11-15 08:14 . 2009-11-15 08:14	--------	d-----w-	c:\program files\AVG
2009-11-15 08:14 . 2009-11-15 08:14	--------	d-----w-	c:\documents and settings\All Users\Application Data\avg9
2009-11-11 14:57 . 2009-11-11 14:57	--------	d-----w-	c:\program files\Aspyr
2009-11-10 21:11 . 2009-11-10 21:11	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-11-10 21:11 . 2009-11-10 21:11	--------	d-----w-	c:\program files\Java
2009-11-10 14:43 . 2009-10-14 13:12	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard
2009-11-01 15:17 . 2009-10-13 13:10	691696	----a-w-	c:\windows\system32\drivers\sptd.sys
2009-10-29 05:38 . 2004-08-03 22:56	667136	------w-	c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-03 22:56	75776	----a-w-	c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-03 22:56	25088	----a-w-	c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-03 21:00	265728	----a-w-	c:\windows\system32\drivers\http.sys
2009-10-15 16:11 . 2009-10-15 16:11	47360	----a-w-	c:\windows\system32\drivers\pcouffin.sys
2009-10-13 13:29 . 2009-10-10 09:58	166455	----a-w-	c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-10-13 13:29 . 2009-10-10 09:58	5938	----a-w-	c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2009-10-13 10:30 . 2004-08-03 22:56	270336	----a-w-	c:\windows\system32\oakley.dll
2009-10-13 09:44 . 2009-10-13 09:44	315392	----a-w-	c:\windows\HideWin.exe
2009-10-13 09:43 . 2009-10-10 11:11	16608	----a-w-	c:\windows\gdrv.sys
2009-10-12 13:38 . 2004-08-03 22:56	149504	----a-w-	c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-03 22:56	79872	----a-w-	c:\windows\system32\raschap.dll
2009-10-10 12:01 . 2009-10-10 12:00	1925024	----a-w-	c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2009-10-10 11:37 . 2009-10-10 11:37	56	---ha-w-	c:\windows\system32\ezsidmv.dat
2009-10-10 11:32 . 2009-10-10 11:32	0	----a-w-	c:\windows\nsreg.dat
2009-10-10 10:48 . 2009-10-10 10:48	664	----a-w-	c:\windows\system32\d3d9caps.dat
2009-10-10 10:05 . 2009-10-10 09:58	8972	----a-w-	c:\windows\pchealth\helpctr\Config\Cntstore.bin
2009-10-10 09:56 . 2009-10-10 09:56	21640	----a-w-	c:\windows\system32\emptyregdb.dat
.

(((((((((((((((((((((((((((((   SnapShot@2010-01-06_10.01.13   )))))))))))))))))))))))))))))))))))))))))
.
- 2001-08-23 11:00 . 2010-01-06 09:57	68504              c:\windows\system32\perfc009.dat
+ 2001-08-23 11:00 . 2010-01-06 10:31	68504              c:\windows\system32\perfc009.dat
+ 2010-01-06 10:26 . 2010-01-06 10:26	16384              c:\windows\system32\config\systemprofile\Local Settings\Temp\Perflib_Perfdata_78c.dat
+ 2001-08-23 11:00 . 2010-01-06 10:31	436184              c:\windows\system32\perfh009.dat
- 2001-08-23 11:00 . 2010-01-06 09:57	436184              c:\windows\system32\perfh009.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-26 13570048]
"nwiz"="nwiz.exe" [2008-07-26 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-07-26 86016]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16876032]
"SoundMan"="SOUNDMAN.EXE" [2008-06-18 77824]
"AlcWzrd"="ALCWZRD.EXE" [2008-06-19 2808832]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-10 149280]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-01-01 2033432]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21	548352	----a-w-	c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-15 08:14	12464	----a-w-	c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Vypress Chat StartUp.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Vypress Chat StartUp.lnk
backup=c:\windows\pss\Vypress Chat StartUp.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Vypress Chat\\VyChat.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2010\\pes2010.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Hry\\Counter strike fun\\CSTRIKE.EXE"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Activision\\Modern Warfare 2\\iw4mp.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\EA Sports\\FIFA 09\\FIFA09.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [15.11.2009 9:14 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [15.11.2009 9:14 360584]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [15.9.2009 10:42 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [15.9.2009 10:42 74480]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [15.11.2009 9:14 285392]
R3 PAC207;Trust Webcam Live;c:\windows\system32\drivers\PFC027.SYS [12.4.2007 15:50 507264]
S2 gupdate1ca887ce5052f88;Služba Google Update (gupdate1ca887ce5052f88);c:\program files\Google\Update\GoogleUpdate.exe [29.12.2009 12:48 133104]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [15.9.2009 10:42 7408]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [13.10.2009 14:10 691696]
.
Contents of the 'Scheduled Tasks' folder

2010-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-29 11:48]

2010-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-29 11:48]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: {E2C35C72-C98E-4C9E-8D89-DB5A0152A3DB} = 87.244.225.1,217.199.113.244
FF - ProfilePath - c:\documents and settings\Maroš\Application Data\Mozilla\Firefox\Profiles\lt8fg4cu.default\
FF - prefs.js: browser.startup.homepage - www.google.sk
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-06 11:36
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(868)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(2688)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-01-06  11:37:06
ComboFix-quarantined-files.txt  2010-01-06 10:37
ComboFix2.txt  2010-01-06 10:02

Pre-Run: 133 412 470 784 bytes free
Post-Run: 133 378 457 600 bytes free

- - End Of File - - 7FEDFD690FD92963EB3E6A673D4B1FC6