VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Prevence je prevence

https://forum.viry.cz:443/viewtopic.php?t=96084

Stránka 1 z 1

Prevence je prevence

Napsal: 12 led 2010 00:50
od j3šť3r
po par letech amaterskyho udrzovani systemu bych rad vedel na cem jsem (od posledni kontroly ubehly minimalne 2 roky)


Logfile of random's system information tool 1.06 (written by random/random)
Run by 0000_AsT at 2010-01-12 00:37:35
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 33 GB (22%) free of 153 GB
Total RAM: 1022 MB (31% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:38:34, on 12.1.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programy\antiBordel\Avast\aswUpdSv.exe
C:\Programy\antiBordel\Avast\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Programy\antiBordel\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Programy\udrzba\TuneUp\TuneUpUtilitiesService32.exe
C:\Programy\udrzba\TuneUp\TuneUpUtilitiesApp32.exe
C:\WINDOWS\Explorer.EXE
C:\Programy\ANTIBO~1\Avast\ashDisp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Programy\udrzba\Innovative Solutions\Advanced Uninstaller PRO - Version 8\Monitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Programy\antiBordel\SUPERAntiSpyware_Free\SUPERAntiSpyware.exe
C:\Programy\internet\Opera95\opera.exe
C:\Programy\antiBordel\Avast\ashMaiSv.exe
C:\Programy\antiBordel\Avast\ashWebSv.exe
C:\RSIT.exe
C:\Program Files\trend micro\0000_AsT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=61005
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=61005
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avast!] C:\Programy\ANTIBO~1\Avast\ashDisp.exe
O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Programy\antiBordel\Outpost Firewall\feedback.exe" /dump:os_startup
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [OutpostMonitor] "C:\Programy\ANTIBO~1\OUTPOS~1\op_mon.exe" /tray /noservice
O4 - HKCU\..\Run: [Advanced Uninstaller PRO Installation Monitor] "C:\Programy\udrzba\Innovative Solutions\Advanced Uninstaller PRO - Version 8\Monitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Programy\antiBordel\Outpost Firewall\ie_bar.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} (Active602XMLFiller Control) - https://www.mojedatovaschranka.cz/stati ... ctivex.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E1567F7D-755A-4CC9-BBA5-4B71B6C874DF}: NameServer = 10.128.22.65
O20 - AppInit_DLLs: c:\programy\antibo~1\outpos~1\wl_hook.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programy\antiBordel\SUPERAntiSpyware_Free\SASWINLO.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\Programy\ANTIBO~1\OUTPOS~1\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programy\antiBordel\Avast\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programy\antiBordel\Avast\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programy\antiBordel\Avast\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programy\antiBordel\Avast\ashWebSv.exe
O23 - Service: Remote Connections Service (FlexService) - Unknown owner - C:\Program Files\RapidBIT\cisvc.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programy\antiBordel\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Programy\udrzba\TuneUp\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Programy\udrzba\TuneUp\TuneUpUtilitiesService32.exe

--
End of file - 7016 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\tasks\Automatic troubleshooting.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\AutorunsDisabled]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=C:\Programy\ANTIBO~1\Avast\ashDisp.exe [2009-11-25 81000]
"OutpostFeedBack"=C:\Programy\antiBordel\Outpost Firewall\feedback.exe [2009-09-23 436552]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-09-29 61440]
"OutpostMonitor"=C:\Programy\ANTIBO~1\OUTPOS~1\op_mon.exe [2009-12-17 1269632]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Advanced Uninstaller PRO Installation Monitor"=C:\Programy\udrzba\Innovative Solutions\Advanced Uninstaller PRO - Version 8\Monitor.exe [2007-03-05 1231600]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="c:\programy\antibo~1\outpos~1\wl_hook.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Programy\antiBordel\SUPERAntiSpyware_Free\SASWINLO.dll [2009-09-03 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-09-30 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Programy\antiBordel\SUPERAntiSpyware_Free\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programy\internet\p2p\uTorrent\utorrent.exe"="C:\Programy\internet\p2p\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"D:\Games\Racing\TrackMania Nations ESWC\TmNationsESWC.exe"="D:\Games\Racing\TrackMania Nations ESWC\TmNationsESWC.exe:*:Enabled:TmNationsESWC"
"C:\Programy\tiskarny\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Programy\tiskarny\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Programy\tiskarny\HP\Digital Imaging\bin\hpqste08.exe"="C:\Programy\tiskarny\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Programy\tiskarny\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Programy\tiskarny\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Programy\tiskarny\HP\Digital Imaging\bin\hposfx08.exe"="C:\Programy\tiskarny\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Programy\tiskarny\HP\Digital Imaging\bin\hposid01.exe"="C:\Programy\tiskarny\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Programy\tiskarny\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Programy\tiskarny\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Programy\tiskarny\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Programy\tiskarny\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Programy\tiskarny\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Programy\tiskarny\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Programy\tiskarny\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Programy\tiskarny\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Programy\tiskarny\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Programy\tiskarny\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Programy\tiskarny\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Programy\tiskarny\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Programy\tiskarny\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Programy\tiskarny\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Programy\tiskarny\HP\Digital Imaging\bin\hpoews01.exe"="C:\Programy\tiskarny\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Programy\tiskarny\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Programy\tiskarny\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"D:\Games\Racing\FlatOut2\flatout2.exe"="D:\Games\Racing\FlatOut2\flatout2.exe:*:Enabled:flatout2"
"C:\Program Files\Tale of Tales\The Endless Forest 3\ForestViewer.exe"="C:\Program Files\Tale of Tales\The Endless Forest 3\ForestViewer.exe:*:Enabled:ForestViewer"
"Game.exe"="Game.exe:*:Enabled:GostSoul"
"C:\Programy\internet\ICQ6.5\ICQ.exe"="C:\Programy\internet\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Programy\internet\Opera95\opera.exe"="C:\Programy\internet\Opera95\opera.exe:*:Enabled:Opera Internet Browser"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2017-06-09 11:37:58 ----A---- C:\WINDOWS\system32\MSVCR71.dll
2017-06-09 11:37:58 ----A---- C:\WINDOWS\system32\MSVCP71.dll
2017-06-09 11:37:58 ----A---- C:\WINDOWS\system32\MFC71.dll
2010-01-12 00:37:35 ----D---- C:\rsit
2010-01-12 00:37:16 ----A---- C:\RSIT.exe
2010-01-11 02:16:03 ----D---- C:\xxyyzz
2010-01-10 21:38:24 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\JAM Software
2010-01-10 21:13:56 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\JGoodies
2010-01-03 23:17:53 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\DeepVoyage
2010-01-01 13:48:51 ----D---- C:\winxpsp3
2010-01-01 04:36:23 ----D---- C:\Program Files\WinRAR
2010-01-01 03:03:12 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\GPass-4
2010-01-01 02:59:00 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\GPass
2010-01-01 01:11:06 ----D---- C:\WINDOWS\system32\oodag
2009-12-30 18:01:52 ----A---- C:\WINDOWS\system32\TweakUI.exe
2009-12-29 21:51:24 ----N---- C:\WINDOWS\SchedLgU.Txt
2009-12-29 21:43:35 ----D---- C:\Program Files\trend micro
2009-12-29 16:16:22 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\Tor
2009-12-29 16:09:47 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\Vidalia
2009-12-27 03:15:57 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\Air Bandits
2009-12-25 17:10:47 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\Crayon Physics Deluxe
2009-12-25 14:08:29 ----D---- C:\ProgramData
2009-12-24 23:51:10 ----A---- C:\WINDOWS\system32\TURegOpt.exe
2009-12-24 23:51:08 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2009-12-24 23:50:40 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\TuneUp Software
2009-12-24 23:49:03 ----D---- C:\Documents and Settings\All Users\Data aplikací\TuneUp Software
2009-12-24 23:48:45 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2009-12-24 23:48:43 ----A---- C:\Documents and Settings\0000_AsT\Data aplikací\TU2010TrialEN-US.exe
2009-12-18 01:48:24 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\PDM
2009-12-18 01:28:31 ----A---- C:\WINDOWS\system32\RICHED.DLL
2009-12-17 22:42:21 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\uniblue
2009-12-17 15:02:34 ----A---- C:\WINDOWS\system32\VBoxNetFltNotify.dll
2009-12-16 08:02:02 ----A---- C:\WINDOWS\system32\javaws.exe
2009-12-16 08:02:02 ----A---- C:\WINDOWS\system32\javaw.exe
2009-12-16 08:02:02 ----A---- C:\WINDOWS\system32\java.exe
2009-12-16 00:21:31 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\WinRAR
2009-12-16 00:02:42 ----D---- C:\Program Files\DivX
2009-12-15 20:14:12 ----RASH---- C:\BOOT.BAK
2009-12-15 20:13:56 ----RSHD---- C:\cmdcons
2009-12-15 20:13:56 ----A---- C:\WINDOWS\UPGRADE.TXT
2009-12-15 20:13:55 ----D---- C:\WINDOWS\setup.pss
2009-12-15 20:13:13 ----D---- C:\WINDOWS\setupupd
2009-12-15 14:05:27 ----SHD---- C:\RECYCLER

======List of files/folders modified in the last 1 months======

2010-01-12 00:37:39 ----D---- C:\WINDOWS\Prefetch
2010-01-12 00:25:21 ----D---- C:\WINDOWS\Temp
2010-01-12 00:25:21 ----D---- C:\WINDOWS
2010-01-11 23:54:49 ----D---- C:\WINDOWS\system32\Filt
2010-01-11 15:55:35 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-10 19:04:51 ----A---- C:\WINDOWS\wincmd.ini
2010-01-10 16:44:17 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\ICQ
2010-01-10 04:02:54 ----SHD---- C:\WINDOWS\Installer
2010-01-10 04:01:36 ----HD---- C:\WINDOWS\inf
2010-01-10 04:01:34 ----D---- C:\WINDOWS\system32\drivers
2010-01-10 04:01:20 ----D---- C:\WINDOWS\system32
2010-01-10 04:01:09 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-01-10 04:00:38 ----D---- C:\Emulation
2010-01-10 03:10:11 ----RD---- C:\Program Files
2010-01-10 03:09:56 ----D---- C:\Documents and Settings\All Users\Data aplikací\Lavasoft
2010-01-10 02:59:08 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-10 02:58:08 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-01-06 19:10:20 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2010-01-05 18:42:56 ----D---- C:\Documents and Settings\All Users\Data aplikací\vsosdk
2010-01-01 06:49:54 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\Vso
2010-01-01 06:49:48 ----A---- C:\Documents and Settings\0000_AsT\Data aplikací\inst.exe
2010-01-01 02:10:20 ----D---- C:\WINDOWS\system32\config
2010-01-01 02:07:34 ----D---- C:\WINDOWS\WinSxS
2009-12-31 13:19:37 ----A---- C:\WINDOWS\system.ini
2009-12-30 18:07:25 ----D---- C:\WINDOWS\Downloaded Installations
2009-12-30 05:27:43 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\codeblocks
2009-12-30 03:13:56 ----RASH---- C:\boot.ini
2009-12-29 11:09:28 ----D---- C:\WINDOWS\Minidump
2009-12-29 11:09:28 ----D---- C:\WINDOWS\Debug
2009-12-29 04:52:14 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\uTorrent
2009-12-28 23:10:44 ----A---- C:\WINDOWS\win.ini
2009-12-28 22:57:52 ----D---- C:\Program Files\Panasonic
2009-12-28 22:57:47 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\Panasonic
2009-12-28 22:49:14 ----D---- C:\Program Files\HP
2009-12-28 22:49:14 ----D---- C:\Program Files\Common Files\HP
2009-12-28 22:45:30 ----D---- C:\WINDOWS\twain_32
2009-12-28 18:23:33 ----RSD---- C:\WINDOWS\assembly
2009-12-25 08:00:42 ----D---- C:\Documents and Settings\0000_AsT\Data aplikací\DivX
2009-12-24 23:51:18 ----SD---- C:\WINDOWS\Tasks
2009-12-16 08:01:59 ----D---- C:\Program Files\Java
2009-12-16 00:13:48 ----D---- C:\Program Files\Google
2009-12-16 00:13:46 ----D---- C:\Documents and Settings\All Users\Data aplikací\Google
2009-12-13 13:11:02 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 42496]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-09-15 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 cdudf_xp;cdudf_xp; C:\WINDOWS\system32\drivers\cdudf_xp.sys [2005-02-04 291456]
R1 DVDVRRdr_xp;DVDVRRdr_xp; C:\WINDOWS\system32\drivers\DVDVRRdr_xp.sys [2005-02-04 141184]
R1 pwd_2k;pwd_2k; C:\WINDOWS\system32\drivers\pwd_2k.sys [2005-02-04 117632]
R1 SandBox;SandBox; \??\C:\WINDOWS\system32\drivers\SandBox.sys []
R1 SASKUTIL;SASKUTIL; \??\C:\Programy\antiBordel\SUPERAntiSpyware_Free\SASKUTIL.sys []
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-11-09 59388]
R1 UDFReadr;UDFReadr; C:\WINDOWS\system32\drivers\UDFReadr.sys [2005-02-04 202368]
R1 VBoxDrv;VirtualBox Service; C:\WINDOWS\system32\DRIVERS\VBoxDrv.sys [2009-12-17 123280]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\WINDOWS\system32\DRIVERS\VBoxUSBMon.sys [2009-12-17 41616]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-18 12032]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-09-15 94160]
R3 afw;Agnitum firewall driver; C:\WINDOWS\system32\DRIVERS\afw.sys [2009-02-18 31128]
R3 afwcore;afwcore; C:\WINDOWS\system32\drivers\afwcore.sys [2009-09-14 256792]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-09-21 2278784]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-09-30 3565056]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-03-19 132608]
R3 dvd_2K;dvd_2K; C:\WINDOWS\system32\drivers\dvd_2K.sys [2005-02-04 24064]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2010-01-01 47360]
R3 SASENUM;SASENUM; \??\C:\Programy\antiBordel\SUPERAntiSpyware_Free\SASENUM.SYS []
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Programy\udrzba\TuneUp\TuneUpUtilitiesDriver32.sys []
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp.sys [2009-12-17 99152]
R3 VBoxNetFlt;VBoxNetFlt Service; C:\WINDOWS\system32\DRIVERS\VBoxNetFlt.sys [2009-12-17 110096]
S1 P3;Ovladač procesoru Intel PentiumIII; C:\WINDOWS\system32\DRIVERS\p3.sys [2008-04-14 46592]
S1 SASDIFSV;SASDIFSV; \??\C:\Programy\antiBordel\SUPERAntiSpyware_Free\SASDIFSV.SYS []
S2 ioperm;ioperm support for Cygwin driver; \??\C:\Documents and Settings\0000_AsT\ioperm.sys []
S3 ac97intc;Služba instalace zvukového ovladače Intel(r) (WDM); C:\WINDOWS\system32\drivers\ac97intc.sys [2001-08-17 96256]
S3 ASWFilt;ASWFilt; \??\C:\WINDOWS\system32\Filt\ASWFilt.dll []
S3 catchme;catchme; \??\C:\DOCUME~1\0000_AsT\LOCALS~1\Temp\catchme.sys []
S3 cpuz129;cpuz129; \??\C:\DOCUME~1\0000_AsT\LOCALS~1\Temp\cpuz_x32.sys []
S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-10-24 117760]
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-13 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-13 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-13 21568]
S3 i81x;i81x; C:\WINDOWS\system32\DRIVERS\i81xnt5.sys [2004-08-04 161020]
S3 iAimFP0;iAimFP0; C:\WINDOWS\system32\DRIVERS\wADV01nt.sys [2004-08-04 12415]
S3 iAimFP1;iAimFP1; C:\WINDOWS\system32\DRIVERS\wADV02NT.sys [2004-08-04 12127]
S3 iAimFP2;iAimFP2; C:\WINDOWS\system32\DRIVERS\wADV05NT.sys [2004-08-04 11775]
S3 iAimFP3;iAimFP3; C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys [2004-08-04 12063]
S3 iAimFP4;iAimFP4; C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys [2004-08-04 19455]
S3 iAimFP5;iAimFP5; C:\WINDOWS\system32\DRIVERS\wADV07nt.sys [2004-08-04 11807]
S3 iAimFP6;iAimFP6; C:\WINDOWS\system32\DRIVERS\wADV08nt.sys [2004-08-04 11295]
S3 iAimFP7;iAimFP7; C:\WINDOWS\system32\DRIVERS\wADV09nt.sys [2004-08-04 11871]
S3 iAimTV0;iAimTV0; C:\WINDOWS\system32\DRIVERS\wATV01nt.sys [2004-08-04 29311]
S3 iAimTV1;iAimTV1; C:\WINDOWS\system32\DRIVERS\wATV02NT.sys [2004-08-04 19551]
S3 iAimTV3;iAimTV3; C:\WINDOWS\system32\DRIVERS\wATV04nt.sys [2004-08-04 33599]
S3 iAimTV4;iAimTV4; C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys [2004-08-04 23615]
S3 iAimTV5;iAimTV5; C:\WINDOWS\system32\DRIVERS\wATV10nt.sys [2004-08-04 25471]
S3 iAimTV6;iAimTV6; C:\WINDOWS\system32\DRIVERS\wATV06nt.sys [2004-08-04 22271]
S3 mmc_2K;mmc_2K; C:\WINDOWS\system32\drivers\mmc_2K.sys [2005-02-04 23808]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 npkcrypt;npkcrypt; \??\D:\Games\MMO\L2-cisty\system\npkcrypt.sys []
S3 PCAlertDriver;PCAlertDriver; \??\C:\BIOSTOOLS\NTGLM7X.sys []
S3 PSI;PSI; C:\WINDOWS\system32\DRIVERS\psi_mf.sys [2009-06-17 12648]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 XDva090;XDva090; \??\C:\WINDOWS\system32\XDva090.sys []
S3 XDva143;XDva143; \??\C:\WINDOWS\system32\XDva143.sys []
S3 XDva190;XDva190; \??\C:\WINDOWS\system32\XDva190.sys []
S3 XDva195;XDva195; \??\C:\WINDOWS\system32\XDva195.sys []
S3 XDva219;XDva219; \??\C:\WINDOWS\system32\XDva219.sys []
S3 XDva225;XDva225; \??\C:\WINDOWS\system32\XDva225.sys []
S3 XDva276;XDva276; \??\C:\WINDOWS\system32\XDva276.sys []
S3 XDva279;XDva279; \??\C:\WINDOWS\system32\XDva279.sys []
S4 adpu320;adpu320; C:\WINDOWS\system32\DRIVERS\adpu320.sys [2002-05-09 105472]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2008-04-14 5504]
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-08-05 722416]
S4 Symmpi;Symmpi; C:\WINDOWS\system32\DRIVERS\symmpi.sys [2002-04-04 28416]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 acssrv;Agnitum Client Security Service; C:\Programy\ANTIBO~1\OUTPOS~1\acs.exe [2009-12-17 1338624]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Programy\antiBordel\Avast\aswUpdSv.exe [2009-11-25 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-09-30 602112]
R2 avast! Antivirus;avast! Antivirus; C:\Programy\antiBordel\Avast\ashServ.exe [2009-11-25 138680]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2005-10-22 69632]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2009-04-08 1377536]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Programy\antiBordel\Spyware Terminator\sp_rsser.exe [2009-09-18 487424]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Programy\udrzba\TuneUp\TuneUpUtilitiesService32.exe [2009-12-18 1044808]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Programy\antiBordel\Avast\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Programy\antiBordel\Avast\ashWebSv.exe [2009-11-25 352920]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-09-29 593920]
S2 FlexService;Remote Connections Service; C:\Program Files\RapidBIT\cisvc.exe []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-02 182768]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2009-09-03 3347280]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\Programy\udrzba\TuneUp\TuneUpDefragService.exe [2009-12-24 435016]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 a2free;a-squared Free Service; C:\Programy\antibordel\a-squared Free\a2service.exe [2009-12-28 1858144]
S4 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []

-----------------EOF-----------------

Re: Prevence je prevence

Napsal: 12 led 2010 20:40
od Rudy
Dejte log z ComboFix.
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

Re: Prevence je prevence

Napsal: 13 led 2010 00:22
od j3šť3r
no, nemam cf rad, ale neco nasel

ComboFix 10-01-12.02 - 0000_AsT 12.01.2010 23:57:32.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1022.602 [GMT 1:00]
Spuštěný z: c:\documents and settings\0000_AsT\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100111-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Outpost Firewall Pro *enabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\SIntf16.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-12 do 2010-01-12 )))))))))))))))))))))))))))))))
.

2017-06-09 10:37 . 2003-03-18 20:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2017-06-09 10:37 . 2003-03-18 19:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2017-06-09 10:37 . 2003-02-21 03:42 348160 ----a-w- c:\windows\system32\MSVCR71.dll
2010-01-11 23:37 . 2010-01-11 23:38 -------- d-----w- C:\rsit
2010-01-11 23:37 . 2010-01-11 23:37 781909 ----a-w- C:\RSIT.exe
2010-01-11 01:16 . 2010-01-12 19:15 -------- d-----w- C:\xxyyzz
2010-01-10 03:03 . 2010-01-10 03:14 -------- d-----w- c:\documents and settings\0000_AsT\.VirtualBox
2010-01-10 03:01 . 2009-12-17 14:02 123280 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2010-01-10 03:00 . 2009-12-17 14:02 41616 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2010-01-01 12:48 . 2010-01-01 13:21 -------- d-----w- C:\winxpsp3
2010-01-01 00:11 . 2010-01-01 00:11 -------- d-----w- c:\windows\system32\oodag
2009-12-30 17:01 . 2003-06-25 15:05 266360 ----a-w- c:\windows\system32\TweakUI.exe
2009-12-29 20:43 . 2010-01-11 23:38 -------- d-----w- c:\program files\trend micro
2009-12-29 20:38 . 2009-12-29 20:38 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-12-25 13:08 . 2009-12-25 13:08 -------- d-----w- C:\ProgramData
2009-12-24 22:51 . 2009-12-17 23:14 30536 ----a-w- c:\windows\system32\TURegOpt.exe
2009-12-24 22:51 . 2009-12-17 23:08 30024 ----a-w- c:\windows\system32\uxtuneup.dll
2009-12-18 00:28 . 1998-05-11 19:01 240944 ----a-w- c:\windows\system32\RICHED.DLL
2009-12-17 14:02 . 2009-12-17 14:02 99152 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2009-12-17 14:02 . 2009-12-17 14:02 133648 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll
2009-12-17 14:02 . 2009-12-17 14:02 110096 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys
2009-12-15 23:51 . 2009-11-12 13:27 90221 ----a-w- c:\windows\system32\The Endless Forest 3.scr
2009-12-15 23:37 . 2009-12-15 23:37 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-12-15 23:02 . 2009-12-15 23:10 -------- d-----w- c:\program files\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-10 01:59 . 2007-06-09 09:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-01 05:49 . 2007-06-09 11:04 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-12-28 21:57 . 2007-06-27 20:27 -------- d-----w- c:\program files\Panasonic
2009-12-28 21:49 . 2007-07-05 16:20 -------- d-----w- c:\program files\Common Files\HP
2009-12-28 21:49 . 2007-07-05 16:16 -------- d-----w- c:\program files\HP
2009-12-16 07:01 . 2007-06-09 09:22 -------- d-----w- c:\program files\Java
2009-12-15 23:13 . 2007-08-17 10:52 -------- d-----w- c:\program files\Google
2009-12-13 12:11 . 2004-09-06 14:23 82664 ----a-w- c:\windows\system32\perfc005.dat
2009-12-13 12:11 . 2004-09-06 14:23 438160 ----a-w- c:\windows\system32\perfh005.dat
2009-11-23 23:17 . 2009-11-09 15:04 -------- d-----w- c:\program files\Pando Networks
2009-11-23 23:14 . 2008-01-29 00:16 -------- d-----w- c:\program files\VDMSound
2009-11-21 05:40 . 2007-06-09 09:42 -------- d-----w- c:\program files\ATI Technologies
2009-11-09 03:21 . 2009-11-09 03:21 59388 ----a-w- c:\windows\system32\drivers\scdemu.sys
2009-11-01 04:38 . 2008-03-09 12:07 65536 ----a-w- c:\windows\IFinst27.exe
2009-10-29 07:43 . 2004-08-17 22:49 916480 ------w- c:\windows\system32\wininet.dll
2009-10-21 05:40 . 2004-08-17 22:49 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:40 . 2004-08-17 22:49 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-07-16 04:33 . 2009-07-16 04:33 2 ----a-w- c:\program files\mshexc.bmp
2009-07-13 10:15 . 2009-07-13 10:18 1615732 ----a-w- c:\program files\ProcessExplorer.zip
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced Uninstaller PRO Installation Monitor"="c:\programy\udrzba\Innovative Solutions\Advanced Uninstaller PRO - Version 8\Monitor.exe" [2007-03-05 1231600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\programy\ANTIBO~1\Avast\ashDisp.exe" [2009-11-24 81000]
"OutpostFeedBack"="c:\programy\antiBordel\Outpost Firewall\feedback.exe" [2009-09-23 436552]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-29 61440]
"OutpostMonitor"="c:\programy\ANTIBO~1\OUTPOS~1\op_mon.exe" [2009-12-17 1269632]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programy\antiBordel\SUPERAntiSpyware_Free\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 14:21 548352 ----a-w- c:\programy\antiBordel\SUPERAntiSpyware_Free\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programy\\internet\\p2p\\uTorrent\\utorrent.exe"=
"d:\\Games\\Racing\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"c:\\Programy\\tiskarny\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Programy\\tiskarny\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programy\\tiskarny\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Programy\\tiskarny\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Programy\\tiskarny\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Programy\\tiskarny\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"d:\\Games\\Racing\\FlatOut2\\flatout2.exe"=
"c:\\Program Files\\Tale of Tales\\The Endless Forest 3\\ForestViewer.exe"=
"Game.exe"= Game.exe:GostSoul
"c:\\Programy\\internet\\ICQ6.5\\ICQ.exe"=
"c:\\Programy\\internet\\Opera95\\opera.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26033:TCP"= 26033:TCP:uTorrent
"17403:TCP"= 17403:TCP:BitComet 17403 TCP
"17403:UDP"= 17403:UDP:BitComet 17403 UDP
"58676:TCP"= 58676:TCP:Pando Media Booster
"58676:UDP"= 58676:UDP:Pando Media Booster

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [21.4.2009 8:51 114768]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [18.7.2009 21:44 714112]
R1 SASDIFSV;SASDIFSV;c:\programy\antiBordel\SUPERAntiSpyware_Free\sasdifsv.sys [12.10.2009 21:24 9968]
R1 SASKUTIL;SASKUTIL;c:\programy\antiBordel\SUPERAntiSpyware_Free\SASKUTIL.SYS [12.10.2009 21:24 74480]
R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [10.1.2010 4:01 123280]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [10.1.2010 4:00 41616]
R2 acssrv;Agnitum Client Security Service;c:\programy\ANTIBO~1\OUTPOS~1\acs.exe [18.7.2009 21:43 1338624]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [21.4.2009 8:51 20560]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\programy\udrzba\TuneUp\TuneUpUtilitiesService32.exe [18.12.2009 0:12 1044808]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [18.7.2009 21:43 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [18.7.2009 21:44 256792]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\programy\udrzba\TuneUp\TuneUpUtilitiesDriver32.sys [14.10.2009 7:24 10064]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [17.12.2009 15:02 99152]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\drivers\VBoxNetFlt.sys [17.12.2009 15:02 110096]
S2 FlexService;Remote Connections Service;"c:\program files\RapidBIT\cisvc.exe" --> c:\program files\RapidBIT\cisvc.exe [?]
S2 ioperm;ioperm support for Cygwin driver;\??\c:\documents and settings\0000_AsT\ioperm.sys --> c:\documents and settings\0000_AsT\ioperm.sys [?]
S3 ASWFilt;ASWFilt;c:\windows\system32\Filt\ASWFilt.dll [18.7.2009 21:44 33920]
S3 cpuz129;cpuz129;\??\c:\docume~1\0000_AsT\LOCALS~1\Temp\cpuz_x32.sys --> c:\docume~1\0000_AsT\LOCALS~1\Temp\cpuz_x32.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 PCAlertDriver;PCAlertDriver;\??\c:\biostools\NTGLM7X.sys --> c:\biostools\NTGLM7X.sys [?]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [17.6.2009 13:20 12648]
S3 SASENUM;SASENUM;c:\programy\antiBordel\SUPERAntiSpyware_Free\SASENUM.SYS [12.10.2009 21:24 7408]
S3 XDva090;XDva090;\??\c:\windows\system32\XDva090.sys --> c:\windows\system32\XDva090.sys [?]
S3 XDva143;XDva143;\??\c:\windows\system32\XDva143.sys --> c:\windows\system32\XDva143.sys [?]
S3 XDva190;XDva190;\??\c:\windows\system32\XDva190.sys --> c:\windows\system32\XDva190.sys [?]
S3 XDva195;XDva195;\??\c:\windows\system32\XDva195.sys --> c:\windows\system32\XDva195.sys [?]
S3 XDva219;XDva219;\??\c:\windows\system32\XDva219.sys --> c:\windows\system32\XDva219.sys [?]
S3 XDva225;XDva225;\??\c:\windows\system32\XDva225.sys --> c:\windows\system32\XDva225.sys [?]
S3 XDva276;XDva276;\??\c:\windows\system32\XDva276.sys --> c:\windows\system32\XDva276.sys [?]
S3 XDva279;XDva279;\??\c:\windows\system32\XDva279.sys --> c:\windows\system32\XDva279.sys [?]
S4 a2free;a-squared Free Service;c:\programy\antiBordel\a-squared Free\a2service.exe [9.6.2007 21:40 1858144]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23.6.2007 17:22 722416]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-01-12 c:\windows\Tasks\Automatic troubleshooting.job
- c:\programy\udrzba\TuneUp\TuneUpSystemStatusCheck.exe [2009-12-17 23:18]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uInternet Settings,ProxyOverride = local
TCP: {E1567F7D-755A-4CC9-BBA5-4B71B6C874DF} = 10.128.22.65
DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} - hxxps://www.mojedatovaschranka.cz/static/pages/ ... ctivex.cab
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Zanzarah - d:\games\ADVENT~1\Zanzarah\Uninst.isu



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-13 00:07
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2166819133-578384987-1342130508-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F5CFED98-4311-B335-1CA9-076711A33094}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):ce,b6,1b,13,9b,8c,e7,dd,8a,fd,87,f1,52,a6,22,0a,34,3f,01,19,10,
48,c1,74,99,d3,92,de,db,8e,fb,64,82,dd,1a,ba,cf,6e,f3,24,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{d1b30faf-42ab-4d08-8649-2e1a88c20f58}]
@Denied: (Full) (Everyone)
"Model"=dword:000000df
"Therad"=dword:00000001
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,ef,03,46,d2,46,aa,b7,81,46,8f,3c,f2,5c,68,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="B9BA807909285B587F51E04C9BA7C83A26FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3DA2D97226D213B5558EDD5E5BE2F6E6673C57700120D9174B37BFC6F76D2BA3AC502632D129AEA6DA11C2F5F98A67ADDB3EB76F14670399DA0AE90440771E4C06D92A1A2821D96AD32339A561D6BEB2FECD0EBE9D86725EE6A576D1AC9BBC8F34EBFED3480757DAD6653411B9621C534602AC88491CEDB2209765CFFB3887088E23F096279B08F880226D2BCD6F5B1AB4FAD914D509EF4C0EECAC42046F37303E9DC0C04D637DAAC0AC13087B828D759ED7D1D396F4A441093832102C2935E9447F24525AA581395B5748E1B46578B6AC4143D873C8ED0DBF11D2C67090A17971F1C2EF7D6F8E52667CA11800A59215DADECF5A6633620EB3915F94E1154D86ED1E3C637C105406D07729AA7893092CFB5E903200A7490ABA589A4EA3E83F9DB3369E19311CB5CA572A5E41CB44BCF732F10F61E2D9A227FE083DEAEF8432AF11EB7122886B4AFA0FF8B1253B1142DC78CFCB89C5C51E70FC47F20811A293102AF6AB33829A5ED1604C89C31E97E19F9930B8F1F5A8A2D507415CE468C18878F514BC25378A70728590C02EDE38186CB8D1BC05D085C8ABC3A38C64E926E4843D0383F4CD5D36E11036A41C7B9816D048F5B2D2C9215E272CA18C8F9E55B4B49F8655C304FB9409E133F6E686A23E3E1462EA8C698665648EF2D691A11CB56E11657B572A94A8B434FDED0C2502AC8CB561270AC90592630C50DD3A23085A78576EB316281441189295B4AD14A8AAF51E3F9EC51AAC50881BF9037E68ED4A000EEEAE8E74B1E2C7DCF8E7129E4B3A9815CE7DDF1ED3BA190531A0F449E45F16A23A90721F6244BC45AD9AA3A8E38F7630E4E199AD16254266BD81DA3246A72DD7297394C665D0D456BCD0EDA72E94F5DEDA5EDB33D094913469658FA33266204696E37021B8A75169B187A4A72D6262DF10FAAEAE26C07CB1048196B00C122AD762E29F79221ED8AF1E2B1EC424CD69C8E43244B27C9959F85EFC97827B54EA4A716666AB28B9F1AB951DD2B29DD79E01BEF26D667E3FE378D073DFD56B0D6831A9D528A897B70CB632B4E137E63B76480821A1851988B97136765D7A894D0A73770F6DF50285F87B8E3C0C2D1063CBACAD927ADF7EFDE07AEB0926554B5D1C4C4AE2E32D38C86CF9CD6FB8826F70DE94239239D7A5DCBF7C55A271DCE5B5CF4916175AFAD6D801069303EF389CB8CF385B603F65C896A1355831199FD407B8CED2E3C822363F3448871C6166F5432724D1AF1492E45236B6E0929F3C59324F91FA77C776F73D67BBD6535E361CCCCDB904266200BDE711E6DC9B286773CE701E8E71126180C65E2FB3385CE6F44611"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1740)
c:\programy\antiBordel\SUPERAntiSpyware_Free\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2796)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\Shellex.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\programy\antiBordel\Avast\aswUpdSv.exe
c:\programy\antiBordel\Avast\ashServ.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\oodag.exe
c:\windows\system32\HPZipm12.exe
c:\programy\antiBordel\Spyware Terminator\sp_rsser.exe
c:\programy\antiBordel\Avast\ashMaiSv.exe
c:\programy\antiBordel\Avast\ashWebSv.exe
c:\programy\udrzba\TuneUp\TuneUpUtilitiesApp32.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Celkový čas: 2010-01-13 00:14:19 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-12 23:14

Před spuštěním: Volných bajtů: 30 445 023 232
Po spuštění: Volných bajtů: 30 384 328 704

- - End Of File - - D34682042E4806C65DC1460770D128D5

Re: Prevence je prevence

Napsal: 13 led 2010 20:59
od Rudy
Otevřte poznámkový blok a zkopírujte do něj:
Collect::
c:\windows\system32\XDva090.sys
c:\windows\system32\XDva143.sys
c:\windows\system32\XDva190.sys
c:\windows\system32\XDva195.sys
c:\windows\system32\XDva219.sys
c:\windows\system32\XDva225.sys
c:\windows\system32\XDva276.sys
c:\windows\system32\XDva279.sys

Driver::
XDva090
XDva143
XDva190
XDva195
XDva219
XDva225
XDva276
XDva279
Uložte na plochu jako CFScript.txt. pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek

Re: Prevence je prevence

Napsal: 14 led 2010 00:14
od j3šť3r
Zmeny od vcera - windows se aktualizoval a cf taky (po wins jsem to povazoval za uzitecny) + zrusil jsem porty ve winfw pro bitcomet a pando.
Pred spustenim cf navic vypinam sebeobranu outposta (bylo to vypnuto i pri 1. pouziti), ale jen do dalsiho resetu.


ComboFix 10-01-13.07 - 0000_AsT 13.01.2010 23:44:11.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1022.590 [GMT 1:00]
Spuštěný z: c:\documents and settings\0000_AsT\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\0000_AsT\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100113-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Outpost Firewall Pro *enabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_XDVA090
-------\Legacy_XDVA143
-------\Legacy_XDVA190
-------\Legacy_XDVA195
-------\Legacy_XDVA219
-------\Legacy_XDVA225
-------\Legacy_XDVA276
-------\Legacy_XDVA279
-------\Service_XDva090
-------\Service_XDva143
-------\Service_XDva190
-------\Service_XDva195
-------\Service_XDva219
-------\Service_XDva225
-------\Service_XDva276
-------\Service_XDva279


((((((((((((((((((((((((( Soubory vytvořené od 2009-12-13 do 2010-01-13 )))))))))))))))))))))))))))))))
.

2017-06-09 10:37 . 2003-03-18 20:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2017-06-09 10:37 . 2003-03-18 19:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2017-06-09 10:37 . 2003-02-21 03:42 348160 ----a-w- c:\windows\system32\MSVCR71.dll
2010-01-13 06:14 . 2009-11-21 16:03 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2010-01-11 23:37 . 2010-01-11 23:38 -------- d-----w- C:\rsit
2010-01-11 23:37 . 2010-01-11 23:37 781909 ----a-w- C:\RSIT.exe
2010-01-11 01:16 . 2010-01-12 19:15 -------- d-----w- C:\xxyyzz
2010-01-10 03:03 . 2010-01-10 03:14 -------- d-----w- c:\documents and settings\0000_AsT\.VirtualBox
2010-01-10 03:01 . 2009-12-17 14:02 123280 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2010-01-10 03:00 . 2009-12-17 14:02 41616 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2010-01-01 12:48 . 2010-01-01 13:21 -------- d-----w- C:\winxpsp3
2010-01-01 00:11 . 2010-01-01 00:11 -------- d-----w- c:\windows\system32\oodag
2009-12-30 17:01 . 2003-06-25 15:05 266360 ----a-w- c:\windows\system32\TweakUI.exe
2009-12-29 20:43 . 2010-01-11 23:38 -------- d-----w- c:\program files\trend micro
2009-12-29 20:38 . 2009-12-29 20:38 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-12-25 13:08 . 2009-12-25 13:08 -------- d-----w- C:\ProgramData
2009-12-24 22:51 . 2009-12-17 23:14 30536 ----a-w- c:\windows\system32\TURegOpt.exe
2009-12-24 22:51 . 2009-12-17 23:08 30024 ----a-w- c:\windows\system32\uxtuneup.dll
2009-12-18 00:28 . 1998-05-11 19:01 240944 ----a-w- c:\windows\system32\RICHED.DLL
2009-12-17 14:02 . 2009-12-17 14:02 99152 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2009-12-17 14:02 . 2009-12-17 14:02 133648 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll
2009-12-17 14:02 . 2009-12-17 14:02 110096 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys
2009-12-15 23:51 . 2009-11-12 13:27 90221 ----a-w- c:\windows\system32\The Endless Forest 3.scr
2009-12-15 23:37 . 2009-12-15 23:37 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-12-15 23:02 . 2009-12-15 23:10 -------- d-----w- c:\program files\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-10 01:59 . 2007-06-09 09:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-01 05:49 . 2007-06-09 11:04 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-12-28 21:57 . 2007-06-27 20:27 -------- d-----w- c:\program files\Panasonic
2009-12-28 21:49 . 2007-07-05 16:20 -------- d-----w- c:\program files\Common Files\HP
2009-12-28 21:49 . 2007-07-05 16:16 -------- d-----w- c:\program files\HP
2009-12-16 07:01 . 2007-06-09 09:22 -------- d-----w- c:\program files\Java
2009-12-15 23:13 . 2007-08-17 10:52 -------- d-----w- c:\program files\Google
2009-12-13 12:11 . 2004-09-06 14:23 82664 ----a-w- c:\windows\system32\perfc005.dat
2009-12-13 12:11 . 2004-09-06 14:23 438160 ----a-w- c:\windows\system32\perfh005.dat
2009-11-23 23:17 . 2009-11-09 15:04 -------- d-----w- c:\program files\Pando Networks
2009-11-23 23:14 . 2008-01-29 00:16 -------- d-----w- c:\program files\VDMSound
2009-11-21 16:03 . 2004-08-17 22:49 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-21 05:40 . 2007-06-09 09:42 -------- d-----w- c:\program files\ATI Technologies
2009-11-09 03:21 . 2009-11-09 03:21 59388 ----a-w- c:\windows\system32\drivers\scdemu.sys
2009-11-01 04:38 . 2008-03-09 12:07 65536 ----a-w- c:\windows\IFinst27.exe
2009-10-29 07:43 . 2004-08-17 22:49 916480 ------w- c:\windows\system32\wininet.dll
2009-10-21 05:40 . 2004-08-17 22:49 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:40 . 2004-08-17 22:49 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-07-16 04:33 . 2009-07-16 04:33 2 ----a-w- c:\program files\mshexc.bmp
2009-07-13 10:15 . 2009-07-13 10:18 1615732 ----a-w- c:\program files\ProcessExplorer.zip
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced Uninstaller PRO Installation Monitor"="c:\programy\udrzba\Innovative Solutions\Advanced Uninstaller PRO - Version 8\Monitor.exe" [2007-03-05 1231600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\programy\ANTIBO~1\Avast\ashDisp.exe" [2009-11-24 81000]
"OutpostFeedBack"="c:\programy\antiBordel\Outpost Firewall\feedback.exe" [2009-09-23 436552]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-29 61440]
"OutpostMonitor"="c:\programy\ANTIBO~1\OUTPOS~1\op_mon.exe" [2009-12-17 1269632]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programy\antiBordel\SUPERAntiSpyware_Free\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 14:21 548352 ----a-w- c:\programy\antiBordel\SUPERAntiSpyware_Free\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programy\\internet\\p2p\\uTorrent\\utorrent.exe"=
"d:\\Games\\Racing\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"c:\\Programy\\tiskarny\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Programy\\tiskarny\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programy\\tiskarny\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Programy\\tiskarny\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Programy\\tiskarny\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Programy\\tiskarny\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"d:\\Games\\Racing\\FlatOut2\\flatout2.exe"=
"c:\\Program Files\\Tale of Tales\\The Endless Forest 3\\ForestViewer.exe"=
"Game.exe"= Game.exe:GostSoul
"c:\\Programy\\internet\\ICQ6.5\\ICQ.exe"=
"c:\\Programy\\internet\\Opera95\\opera.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26033:TCP"= 26033:TCP:uTorrent

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [21.4.2009 8:51 114768]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [18.7.2009 21:44 714112]
R1 SASDIFSV;SASDIFSV;c:\programy\antiBordel\SUPERAntiSpyware_Free\sasdifsv.sys [12.10.2009 21:24 9968]
R1 SASKUTIL;SASKUTIL;c:\programy\antiBordel\SUPERAntiSpyware_Free\SASKUTIL.SYS [12.10.2009 21:24 74480]
R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [10.1.2010 4:01 123280]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [10.1.2010 4:00 41616]
R2 acssrv;Agnitum Client Security Service;c:\programy\ANTIBO~1\OUTPOS~1\acs.exe [18.7.2009 21:43 1338624]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [21.4.2009 8:51 20560]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\programy\udrzba\TuneUp\TuneUpUtilitiesService32.exe [18.12.2009 0:12 1044808]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [18.7.2009 21:43 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [18.7.2009 21:44 256792]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\programy\udrzba\TuneUp\TuneUpUtilitiesDriver32.sys [14.10.2009 7:24 10064]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [17.12.2009 15:02 99152]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\drivers\VBoxNetFlt.sys [17.12.2009 15:02 110096]
S2 FlexService;Remote Connections Service;"c:\program files\RapidBIT\cisvc.exe" --> c:\program files\RapidBIT\cisvc.exe [?]
S2 ioperm;ioperm support for Cygwin driver;\??\c:\documents and settings\0000_AsT\ioperm.sys --> c:\documents and settings\0000_AsT\ioperm.sys [?]
S3 ASWFilt;ASWFilt;c:\windows\system32\Filt\ASWFilt.dll [18.7.2009 21:44 33920]
S3 cpuz129;cpuz129;\??\c:\docume~1\0000_AsT\LOCALS~1\Temp\cpuz_x32.sys --> c:\docume~1\0000_AsT\LOCALS~1\Temp\cpuz_x32.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 PCAlertDriver;PCAlertDriver;\??\c:\biostools\NTGLM7X.sys --> c:\biostools\NTGLM7X.sys [?]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [17.6.2009 13:20 12648]
S3 SASENUM;SASENUM;c:\programy\antiBordel\SUPERAntiSpyware_Free\SASENUM.SYS [12.10.2009 21:24 7408]
S4 a2free;a-squared Free Service;c:\programy\antiBordel\a-squared Free\a2service.exe [9.6.2007 21:40 1858144]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23.6.2007 17:22 722416]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-01-13 c:\windows\Tasks\Automatic troubleshooting.job
- c:\programy\udrzba\TuneUp\TuneUpSystemStatusCheck.exe [2009-12-17 23:18]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uInternet Settings,ProxyOverride = local
TCP: {E1567F7D-755A-4CC9-BBA5-4B71B6C874DF} = 10.128.22.65
DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} - hxxps://www.mojedatovaschranka.cz/static/pages/ ... ctivex.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-13 23:54
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2166819133-578384987-1342130508-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F5CFED98-4311-B335-1CA9-076711A33094}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):ce,b6,1b,13,9b,8c,e7,dd,8a,fd,87,f1,52,a6,22,0a,34,3f,01,19,10,
48,c1,74,99,d3,92,de,db,8e,fb,64,82,dd,1a,ba,cf,6e,f3,24,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{d1b30faf-42ab-4d08-8649-2e1a88c20f58}]
@Denied: (Full) (Everyone)
"Model"=dword:000000df
"Therad"=dword:00000001
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,ef,03,46,d2,46,aa,b7,81,46,8f,3c,f2,5c,68,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="B9BA807909285B587F51E04C9BA7C83A26FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3DA2D97226D213B5558EDD5E5BE2F6E6673C57700120D9174B37BFC6F76D2BA3AC502632D129AEA6DA11C2F5F98A67ADDB3EB76F14670399DA0AE90440771E4C06D92A1A2821D96AD32339A561D6BEB2FECD0EBE9D86725EE6A576D1AC9BBC8F34EBFED3480757DAD6653411B9621C534602AC88491CEDB2209765CFFB3887088E23F096279B08F880226D2BCD6F5B1AB4FAD914D509EF4C0EECAC42046F37303E9DC0C04D637DAAC0AC13087B828D759ED7D1D396F4A441093832102C2935E9447F24525AA581395B5748E1B46578B6AC4143D873C8ED0DBF11D2C67090A17971F1C2EF7D6F8E52667CA11800A59215DADECF5A6633620EB3915F94E1154D86ED1E3C637C105406D07729AA7893092CFB5E903200A7490ABA589A4EA3E83F9DB3369E19311CB5CA572A5E41CB44BCF732F10F61E2D9A227FE083DEAEF8432AF11EB7122886B4AFA0FF8B1253B1142DC78CFCB89C5C51E70FC47F20811A293102AF6AB33829A5ED1604C89C31E97E19F9930B8F1F5A8A2D507415CE468C18878F514BC25378A70728590C02EDE38186CB8D1BC05D085C8ABC3A38C64E926E4843D0383F4CD5D36E11036A41C7B9816D048F5B2D2C9215E272CA18C8F9E55B4B49F8655C304FB9409E133F6E686A23E3E1462EA8C698665648EF2D691A11CB56E11657B572A94A8B434FDED0C2502AC8CB561270AC90592630C50DD3A23085A78576EB316281441189295B4AD14A8AAF51E3F9EC51AAC50881BF9037E68ED4A000EEEAE8E74B1E2C7DCF8E7129E4B3A9815CE7DDF1ED3BA190531A0F449E45F16A23A90721F6244BC45AD9AA3A8E38F7630E4E199AD16254266BD81DA3246A72DD7297394C665D0D456BCD0EDA72E94F5DEDA5EDB33D094913469658FA33266204696E37021B8A75169B187A4A72D6262DF10FAAEAE26C07CB1048196B00C122AD762E29F79221ED8AF1E2B1EC424CD69C8E43244B27C9959F85EFC97827B54EA4A716666AB28B9F1AB951DD2B29DD79E01BEF26D667E3FE378D073DFD56B0D6831A9D528A897B70CB632B4E137E63B76480821A1851988B97136765D7A894D0A73770F6DF50285F87B8E3C0C2D1063CBACAD927ADF7EFDE07AEB0926554B5D1C4C4AE2E32D38C86CF9CD6FB8826F70DE94239239D7A5DCBF7C55A271DCE5B5CF4916175AFAD6D801069303EF389CB8CF385B603F65C896A1355831199FD407B8CED2E3C822363F3448871C6166F5432724D1AF1492E45236B6E0929F3C59324F91FA77C776F73D67BBD6535E361CCCCDB904266200BDE711E6DC9B286773CE701E8E71126180C65E2FB3385CE6F44611"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1764)
c:\programy\antiBordel\SUPERAntiSpyware_Free\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3188)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\Shellex.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\programy\antiBordel\Avast\aswUpdSv.exe
c:\programy\antiBordel\Avast\ashServ.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\oodag.exe
c:\windows\system32\HPZipm12.exe
c:\programy\antiBordel\Spyware Terminator\sp_rsser.exe
c:\programy\antiBordel\Avast\ashMaiSv.exe
c:\programy\antiBordel\Avast\ashWebSv.exe
c:\programy\udrzba\TuneUp\TuneUpUtilitiesApp32.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Celkový čas: 2010-01-14 00:00:02 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-13 22:59
ComboFix2.txt 2010-01-12 23:14

Před spuštěním: Volných bajtů: 30 272 417 792
Po spuštění: Volných bajtů: 30 236 655 616

- - End Of File - - E74E2122D28489037200F04071AB8691

Re: Prevence je prevence

Napsal: 14 led 2010 19:31
od Rudy
Log již vypadá čistý.

Re: Prevence je prevence

Napsal: 14 led 2010 21:06
od j3šť3r
Díky moc. A pro příště se napravim, a nechám si to tu kontrolovat častěji. :wink:

Re: Prevence je prevence

Napsal: 14 led 2010 22:31
od Rudy
OK. :) A nemáte zač!
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz