Win32/Protector.G vírus

Zpráva

Mikey2692 · #1 Příspěvek od **Mikey2692** » 16 úno 2010 21:58

Eset mi to našiel ale nejde to zmazať hádže chybu pri mazaní

Mikey2692 · #2 Příspěvek od **Mikey2692** » 16 úno 2010 22:00

log z RISTU

Logfile of random's system information tool 1.06 (written by random/random)
Run by pc at 2010-02-16 21:59:57
Systém Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 4 GB (7%) free of 60 GB
Total RAM: 1023 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:00:02, on 16.2.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\SyncMan.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\ICQ7.0\ICQ.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\pc\Desktop\RSIT.exe
C:\Documents and Settings\Maminka\My Documents\Preberanie\pc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/icqskins/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SyncMan] C:\WINDOWS\system32\SyncMan.exe
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [SyncMan] C:\Documents and Settings\pc\SyncMan.exe
O4 - HKUS\S-1-5-21-725345543-1604221776-2147196821-1006\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden (User 'Maminka')
O4 - HKUS\S-1-5-21-725345543-1604221776-2147196821-1006\..\Run: [SyncMan] C:\Documents and Settings\Maminka\SyncMan.exe (User 'Maminka')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-725345543-1604221776-2147196821-1006 Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'Maminka')
O4 - S-1-5-21-725345543-1604221776-2147196821-1006 User Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'Maminka')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 12254 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-08-04 1586472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}]
EWPBrowseObject Class - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll [2006-04-18 34304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-13 279664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll [2010-02-13 812528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2006-04-18 552960]

{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-13 279664]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2005-10-24 90112]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]
"SecurDisc"=C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe [2007-11-26 1629480]
"InCD"=C:\Program Files\Nero\Nero 7\InCD\InCD.exe [2007-11-26 1057064]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2007-03-14 71216]
"LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2007-01-08 52256]
"LGODDFU"=C:\Program Files\lg_fwupdate\fwupdate.exe [2009-12-15 557056]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-26 31016]
"SSBkgdUpdate"=C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2003-09-29 155648]
"OpwareSE4"=C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [2006-03-21 69632]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"AdobeCS4ServiceManager"=C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-11-20 110184]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-11-20 12669544]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792]
"SyncMan"=C:\WINDOWS\system32\SyncMan.exe [2010-02-16 42531]
"Regedit32"=C:\WINDOWS\system32\regedit.exe []
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-11-16 2054360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2009-04-13 2387968]
"BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2009-11-07 323392]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-05-02 39408]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe -autorun []
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"ICQ"=C:\Program Files\ICQ7.0\ICQ.exe [2010-02-11 133368]
"SyncMan"=C:\Documents and Settings\pc\SyncMan.exe []

C:\Documents and Settings\pc\Start Menu\Programs\Startup
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
Xfire.lnk - C:\Program Files\Xfire\Xfire.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe"="C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe:*:Enabled:CyberLink PowerDVD"
"C:\Program Files\Xfire\Xfire.exe"="C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire"
"D:\games\Valve\hl.exe"="D:\games\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Documents and Settings\Marek\Desktop\Zbierka\metin 2\metin2.bin"="C:\Documents and Settings\Marek\Desktop\Zbierka\metin 2\metin2.bin:*:Enabled:metin2"
"C:\Program Files\Valve\Steam\SteamApps\92_mikey_92\counter-strike\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\92_mikey_92\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Valve\Steam\SteamApps\92_mikey_92\counter-strike beta\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\92_mikey_92\counter-strike beta\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Valve\Steam\SteamApps\92_mikey_92\deathmatch classic\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\92_mikey_92\deathmatch classic\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Valve\Steam\SteamApps\92_mikey_92\condition zero deleted scenes\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\92_mikey_92\condition zero deleted scenes\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Valve\Steam\SteamApps\92_mikey_92\condition zero\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\92_mikey_92\condition zero\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:bittorrent"
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"D:\games\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe"="D:\games\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32"
"D:\games\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe"="D:\games\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32"
"C:\Program Files\Valve\Steam\SteamApps\92_mikey_92\day of defeat\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\92_mikey_92\day of defeat\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1131a0bf-be55-11de-977b-0013d3ebc109}]
shell\AutoRun\command - G:\USBAutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a55d044-57f5-11de-9688-806d6172696f}]
shell\AutoRun\command - K:\OblivionLauncher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a55d045-57f5-11de-9688-806d6172696f}]
shell\AutoRun\command - L:\setup.exe

======List of files/folders created in the last 1 months======

2010-02-16 21:48:28 ----D---- C:\Documents and Settings\pc\Application Data\ESET
2010-02-16 21:47:58 ----D---- C:\WINDOWS\LastGood
2010-02-16 20:39:59 ----A---- C:\ComboFix.txt
2010-02-16 17:23:06 ----A---- C:\WINDOWS\system32\SyncMan.exe
2010-02-15 22:43:16 ----A---- C:\Boot.bak
2010-02-15 22:43:10 ----RASHD---- C:\cmdcons
2010-02-15 22:41:37 ----A---- C:\WINDOWS\zip.exe
2010-02-15 22:41:37 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-02-15 22:41:37 ----A---- C:\WINDOWS\SWSC.exe
2010-02-15 22:41:37 ----A---- C:\WINDOWS\SWREG.exe
2010-02-15 22:41:37 ----A---- C:\WINDOWS\sed.exe
2010-02-15 22:41:37 ----A---- C:\WINDOWS\PEV.exe
2010-02-15 22:41:37 ----A---- C:\WINDOWS\NIRCMD.exe
2010-02-15 22:41:37 ----A---- C:\WINDOWS\MBR.exe
2010-02-15 22:41:37 ----A---- C:\WINDOWS\grep.exe
2010-02-15 22:28:56 ----D---- C:\Qoobox
2010-02-14 22:24:16 ----RHD---- C:\Documents and Settings\pc\Application Data\SecuROM
2010-02-13 11:21:04 ----A---- C:\WINDOWS\game.ini
2010-02-11 22:18:46 ----D---- C:\Program Files\QuickTime
2010-02-11 22:18:45 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2010-02-11 12:20:20 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-11 12:20:16 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-11 12:18:41 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-11 12:18:37 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-11 12:18:33 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-11 12:18:28 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-11 12:18:22 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-11 12:18:12 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-09 21:00:27 ----D---- C:\ATF
2010-02-08 18:23:26 ----D---- C:\Program Files\Common Files\Skype
2010-02-06 15:18:19 ----D---- C:\Program Files\ICQ7.0
2010-01-30 23:22:15 ----D---- C:\Program Files\DIFX
2010-01-30 23:22:14 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-01-30 23:20:21 ----D---- C:\KP500
2010-01-30 23:19:43 ----A---- C:\WINDOWS\system32\msxml4a.dll
2010-01-30 23:19:43 ----A---- C:\WINDOWS\system32\lgAxconfig.ini
2010-01-30 23:19:43 ----A---- C:\WINDOWS\system32\CommonDL.dll
2010-01-30 23:19:36 ----D---- C:\Documents and Settings\All Users\Application Data\LGMOBILEAX
2010-01-30 22:29:08 ----D---- C:\Documents and Settings\pc\Application Data\Search Settings
2010-01-30 22:29:04 ----D---- C:\Documents and Settings\pc\Application Data\Dealio
2010-01-30 20:23:38 ----D---- C:\Program Files\Application Updater
2010-01-29 20:56:07 ----A---- C:\WINDOWS\BlendSettings.ini
2010-01-28 22:38:41 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2010-01-28 22:38:41 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2010-01-28 22:38:41 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2010-01-28 22:38:41 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2010-01-28 22:38:40 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2010-01-28 22:38:40 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2010-01-28 22:38:40 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2010-01-28 20:10:10 ----D---- C:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
2010-01-28 20:10:02 ----D---- C:\Program Files\NVIDIA Corporation
2010-01-28 20:09:25 ----A---- C:\WINDOWS\system32\OpenCL.dll
2010-01-28 20:09:25 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2010-01-28 20:09:25 ----A---- C:\WINDOWS\system32\nvcuvenc.dll
2010-01-28 20:09:25 ----A---- C:\WINDOWS\system32\nvcuda.dll
2010-01-28 20:09:24 ----A---- C:\WINDOWS\system32\nvcompiler.dll
2010-01-28 20:09:20 ----D---- C:\NVIDIA
2010-01-26 18:51:05 ----D---- C:\Documents and Settings\pc\Application Data\InstallShield
2010-01-22 16:31:40 ----HDC---- C:\WINDOWS\$NtUninstallKB978207$

======List of files/folders modified in the last 1 months======

2010-02-16 21:59:58 ----D---- C:\WINDOWS\temp
2010-02-16 21:58:53 ----D---- C:\Documents and Settings\pc\Application Data\DNA
2010-02-16 21:53:01 ----D---- C:\Program Files\Mozilla Firefox
2010-02-16 21:51:11 ----D---- C:\Documents and Settings\pc\Application Data\ICQ
2010-02-16 21:48:16 ----SHD---- C:\WINDOWS\Installer
2010-02-16 21:48:07 ----HD---- C:\WINDOWS\inf
2010-02-16 21:48:07 ----D---- C:\WINDOWS\system32\drivers
2010-02-16 21:47:58 ----D---- C:\WINDOWS
2010-02-16 21:47:25 ----D---- C:\Program Files\Eset
2010-02-16 21:47:24 ----D---- C:\Documents and Settings\All Users\Application Data\ESET
2010-02-16 21:29:14 ----D---- C:\Documents and Settings\pc\Application Data\Xfire
2010-02-16 21:29:01 ----A---- C:\WINDOWS\lgfwup.ini
2010-02-16 21:28:58 ----D---- C:\Program Files\lg_fwupdate
2010-02-16 21:28:50 ----D---- C:\Program Files\DNA
2010-02-16 20:39:05 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-16 20:36:28 ----A---- C:\WINDOWS\system.ini
2010-02-16 20:36:25 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-16 20:36:17 ----D---- C:\WINDOWS\ERDNT
2010-02-16 20:32:50 ----D---- C:\WINDOWS\system32
2010-02-16 20:32:50 ----D---- C:\WINDOWS\AppPatch
2010-02-16 20:32:48 ----D---- C:\Program Files\Common Files
2010-02-16 20:29:34 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-16 20:27:53 ----RD---- C:\Program Files
2010-02-16 19:46:35 ----D---- C:\WINDOWS\system32\config
2010-02-15 22:54:28 ----D---- C:\WINDOWS\Prefetch
2010-02-15 22:43:16 ----RASH---- C:\boot.ini
2010-02-15 20:19:31 ----D---- C:\Documents and Settings\All Users\Application Data\PC Tools
2010-02-15 20:19:16 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2010-02-14 23:05:31 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-14 22:53:01 ----D---- C:\WINDOWS\system32\DirectX
2010-02-14 22:53:00 ----RSD---- C:\WINDOWS\assembly
2010-02-14 22:24:16 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2010-02-14 21:50:38 ----D---- C:\Documents and Settings\pc\Application Data\Skype
2010-02-14 17:23:51 ----D---- C:\Documents and Settings\pc\Application Data\skypePM
2010-02-13 11:21:14 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2010-02-13 11:21:07 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2010-02-12 15:48:56 ----D---- C:\Documents and Settings\pc\Application Data\vlc
2010-02-11 17:26:07 ----A---- C:\WINDOWS\NeroDigital.ini
2010-02-11 12:20:19 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-11 12:20:18 ----A---- C:\WINDOWS\imsins.BAK
2010-02-08 18:23:35 ----RD---- C:\Program Files\Skype
2010-02-08 18:23:22 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2010-02-06 18:52:18 ----D---- C:\Documents and Settings\pc\Application Data\Adobe
2010-02-06 14:35:00 ----D---- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2010-02-01 20:26:20 ----A---- C:\WINDOWS\system32\MRT.exe
2010-02-01 18:11:09 ----D---- C:\Program Files\LG PC Suite II
2010-01-30 23:23:02 ----D---- C:\WINDOWS\system32\CatRoot
2010-01-30 20:23:37 ----D---- C:\WINDOWS\WinSxS
2010-01-29 22:01:30 ----D---- C:\Program Files\Google
2010-01-29 20:48:55 ----RSD---- C:\WINDOWS\Fonts
2010-01-28 20:11:34 ----D---- C:\WINDOWS\Help
2010-01-28 20:11:16 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-01-28 20:10:34 ----D---- C:\Program Files\AGEIA Technologies
2010-01-28 20:10:07 ----D---- C:\WINDOWS\nview
2010-01-27 20:38:36 ----D---- C:\Program Files\Windows Desktop Search
2010-01-26 18:50:23 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2010-01-26 18:50:16 ----D---- C:\WINDOWS\system32\wbem
2010-01-26 18:50:16 ----D---- C:\WINDOWS\system32\en-US
2010-01-23 12:26:06 ----D---- C:\Program Files\Common Files\Adobe
2010-01-23 12:26:06 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-01-22 16:18:56 ----D---- C:\Program Files\Xfire

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 36352]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-11-16 108792]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-11-16 55768]
R1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys [2007-11-26 36776]
R1 incdrm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys [2007-11-26 38440]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2009-04-23 5632]
R1 WS2IFSL;Prostredie podpory poskytovateľa služby Windows Socket 2.0 Non-IFS Service; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-02-28 12032]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-11-16 116520]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-12-18 135048]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-10-26 3786944]
R3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-01-08 33096]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-11-21 10235968]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-04-05 33536]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-04-05 12928]
R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2004-04-13 70144]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys [2007-11-26 118952]
S3 aorxpu65;aorxpu65; C:\WINDOWS\system32\drivers\aorxpu65.sys []
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-08-21 17480]
S3 mbr;mbr; \??\C:\DOCUME~1\Maminka\LOCALS~1\Temp\mbr.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000]
S3 usbbus;LGE Mobile Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys [2009-08-21 13056]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 UsbDiag;LGE Mobile USB Serial Port; C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys [2009-08-21 20864]
S3 USBModem;LGE Mobile USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys [2009-08-21 24960]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2004-08-11 18944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Application Updater;Application Updater; C:\Program Files\Application Updater\ApplicationUpdater.exe [2010-01-08 380928]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-11-16 735960]
R2 InCDsrv;InCD Helper; C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe [2007-11-26 1554728]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2009-04-13 73728]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-11-20 154216]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-02-13 66872]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2010-02-13 103736]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-05-14 272024]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-08-10 133104]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-04-23 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-11-16 20680]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-01-03 655624]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-02 182768]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-09-17 800040]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2009-01-07 348752]
S3 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2009-01-21 1095560]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

#3 Příspěvek od **motji** » 17 úno 2010 00:18

Dobré ranko

obsah tohoto logu vložte zde
- C:\ComboFix.txt

v jakém souboru ho vir hlásí?

Mikey2692 · #4 Příspěvek od **Mikey2692** » 17 úno 2010 21:26

posielam protokol z antivírusu 17.2.2010 21:23:48 Rezidentná ochrana súbor C:\WINDOWS\system32\drivers\cdrom.sys Win32/Protector.G vírus nemožno liečiť PC-803230D31695\pc Táto skutočnosť bola zistená pri pokuse o prístup k súboru aplikáciou: C:\WINDOWS\system32\svchost.exe.

Mikey2692 · #5 Příspěvek od **Mikey2692** » 17 úno 2010 21:27

ComboFix 10-02-12.01 - Maminka . 02. 2010 20:30:06.7.1 - x86
Systém Microsoft Windows XP Home Edition 5.1.2600.3.1250.421.1033.18.1023.745 [GMT 1:00]
Running from: c:\documents and settings\Maminka\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Maminka\Desktop\CFScript.txt.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Maminka\Application Data\Dealio
c:\documents and settings\Maminka\Application Data\Dealio\res\widgets.xml
c:\documents and settings\Maminka\Application Data\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml
c:\documents and settings\Maminka\Application Data\Search Settings
c:\documents and settings\Maminka\Application Data\Search Settings\kb130\temp\ws-14655.log
c:\documents and settings\Maminka\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\documents and settings\Marek\Application Data\Dealio
c:\documents and settings\Marek\Application Data\Dealio\res\widgets.xml
c:\documents and settings\Marek\Application Data\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml
c:\documents and settings\Marek\Application Data\Search Settings
c:\documents and settings\Marek\Application Data\Search Settings\kb130\temp\ws-14654.log
c:\documents and settings\Marek\Application Data\Search Settings\kb130\temp\ws-14655.log

Infected copy of c:\windows\system32\drivers\cdrom.sys was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\cdrom.sys

.
((((((((((((((((((((((((( Files Created from 2010-01-16 to 2010-02-16 )))))))))))))))))))))))))))))))
.

2010-02-16 19:36 . 2010-02-16 19:36 97696 -c--a-w- c:\windows\system32\dllcache\cdrom.sys
2010-02-16 16:23 . 2010-02-16 16:23 42531 ----a-w- c:\windows\system32\SyncMan.exe
2010-02-16 16:23 . 2010-02-16 16:23 42531 ----a-w- c:\documents and settings\NetworkService\SyncMan.exe
2010-02-14 18:58 . 2010-02-14 18:58 -------- d-----w- c:\documents and settings\Marek\Application Data\Apple Computer
2010-02-14 18:57 . 2010-02-14 18:57 -------- d-----w- c:\documents and settings\Marek\Local Settings\Application Data\Apple Computer
2010-02-14 18:31 . 2010-02-14 18:31 -------- d-----w- c:\documents and settings\Marek\Local Settings\Application Data\AOL
2010-02-11 21:18 . 2010-02-11 21:19 -------- d-----w- c:\program files\QuickTime
2010-02-11 21:18 . 2010-02-11 21:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-02-09 20:00 . 2010-02-09 20:00 -------- d-----w- C:\ATF
2010-02-08 17:23 . 2010-02-08 17:23 -------- d-----w- c:\program files\Common Files\Skype
2010-02-06 14:18 . 2010-02-14 20:25 -------- d-----w- c:\program files\ICQ7.0
2010-01-30 22:22 . 2010-01-30 22:22 -------- d-----w- c:\program files\DIFX
2010-01-30 22:22 . 2010-01-30 22:22 -------- dc----w- c:\windows\system32\DRVSTORE
2010-01-30 22:22 . 2009-05-12 14:53 16896 ----a-w- c:\windows\system32\drivers\FlashUsb.sys
2010-01-30 22:20 . 2010-01-30 22:20 -------- d-----w- C:\KP500
2010-01-30 22:19 . 2010-01-27 00:12 935872 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\B2C_Client\LGUserCSTool.exe
2010-01-30 22:19 . 2010-01-22 05:43 499712 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\B2C_Client\LGMUpgradeDL.dll
2010-01-30 22:19 . 2010-01-15 04:24 59328 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\LGMLauncher.exe
2010-01-30 22:19 . 2009-11-19 07:28 90112 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\B2C_Client\LGMobileDL.dll
2010-01-30 22:19 . 2009-11-04 03:57 206792 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\B2C_Client\B2CAppUninstall.exe
2010-01-30 22:19 . 2009-10-06 06:12 24576 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\B2C_Client\LGMobileDLRapi.dll
2010-01-30 22:19 . 2009-06-15 06:21 182208 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe
2010-01-30 22:19 . 2006-05-04 07:33 53248 ----a-w- c:\windows\system32\CommonDL.dll
2010-01-30 22:19 . 2005-10-04 00:39 44544 ----a-w- c:\windows\system32\msxml4a.dll
2010-01-30 22:19 . 2010-01-30 22:19 -------- d-----w- c:\documents and settings\All Users\Application Data\LGMOBILEAX
2010-01-30 19:23 . 2010-01-30 19:23 -------- d-----w- c:\program files\Application Updater
2010-01-28 21:38 . 2009-09-04 16:44 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2010-01-28 21:38 . 2009-09-04 16:44 238936 ----a-w- c:\windows\system32\xactengine3_5.dll
2010-01-28 21:38 . 2009-09-04 16:29 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll
2010-01-28 21:38 . 2009-09-04 16:29 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2010-01-28 21:38 . 2009-09-04 16:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2010-01-28 21:38 . 2009-09-04 16:29 235344 ----a-w- c:\windows\system32\d3dx11_42.dll
2010-01-28 21:38 . 2009-09-04 16:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2010-01-28 19:10 . 2010-01-28 19:10 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2010-01-28 19:10 . 2010-01-28 19:11 -------- d-----w- c:\program files\NVIDIA Corporation
2010-01-28 19:09 . 2009-11-21 02:34 69632 ----a-w- c:\windows\system32\OpenCL.dll
2010-01-28 19:09 . 2009-11-21 02:34 4038656 ----a-w- c:\windows\system32\nvcuda.dll
2010-01-28 19:09 . 2009-11-21 02:34 2259560 ----a-w- c:\windows\system32\nvcuvid.dll
2010-01-28 19:09 . 2009-11-21 02:34 1989224 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-01-28 19:09 . 2009-11-21 02:34 11374592 ----a-w- c:\windows\system32\nvcompiler.dll
2010-01-28 19:09 . 2009-11-21 02:34 2293286 ----a-w- c:\windows\system32\nvdata.bin
2010-01-28 19:09 . 2010-01-28 19:09 -------- d-----w- C:\NVIDIA
2010-01-28 18:32 . 2010-01-28 18:32 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-01-28 18:32 . 2010-01-28 18:32 552 ----a-w- c:\windows\system32\d3d8caps.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-16 19:36 . 2009-04-15 08:45 -------- d-----w- c:\program files\lg_fwupdate
2010-02-16 19:36 . 2006-02-28 12:00 97696 ----a-w- c:\windows\system32\drivers\cdrom.sys
2010-02-16 18:34 . 2009-04-15 15:54 -------- d-----w- c:\program files\DNA
2010-02-15 21:38 . 2009-04-15 11:37 -------- d-----w- c:\program files\Eset
2010-02-15 19:19 . 2009-05-29 17:30 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2010-02-15 19:19 . 2009-05-29 17:31 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-15 18:37 . 2009-04-27 18:06 69232 ----a-w- c:\documents and settings\Maminka\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-15 17:53 . 2009-05-02 19:34 -------- d-----w- c:\documents and settings\Marek\Application Data\Skype
2010-02-15 16:18 . 2009-05-02 19:39 -------- d-----w- c:\documents and settings\Marek\Application Data\skypePM
2010-02-14 22:05 . 2009-04-15 07:13 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-14 21:24 . 2009-05-09 12:37 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-02-14 18:31 . 2009-04-16 19:05 -------- d-----w- c:\documents and settings\Marek\Application Data\ICQ
2010-02-13 10:21 . 2009-05-08 11:38 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-02-13 10:21 . 2009-05-08 11:37 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-02-13 10:21 . 2009-05-08 11:37 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-02-08 17:23 . 2009-05-02 19:34 -------- d-----r- c:\program files\Skype
2010-02-08 17:23 . 2009-05-02 19:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-02-06 13:35 . 2009-05-20 13:22 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2010-02-01 17:11 . 2009-10-21 19:01 -------- d-----w- c:\program files\LG PC Suite II
2010-01-29 21:01 . 2009-05-02 19:34 -------- d-----w- c:\program files\Google
2010-01-28 19:11 . 2009-11-14 21:49 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-28 19:10 . 2009-11-14 21:49 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-27 19:38 . 2009-05-21 14:24 -------- d-----w- c:\program files\Windows Desktop Search
2010-01-23 11:26 . 2009-04-23 18:52 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-22 15:18 . 2009-04-15 14:37 -------- d-----w- c:\program files\Xfire
2010-01-18 14:32 . 2009-04-28 17:25 69232 ----a-w- c:\documents and settings\Marek\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-03 23:01 . 2010-01-03 23:01 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-01-03 22:52 . 2010-01-03 22:52 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-03 22:48 . 2010-01-03 22:48 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-12-31 16:50 . 2006-02-28 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-26 21:37 . 2009-12-26 21:37 -------- d-----w- c:\program files\ICQ6Toolbar
2009-12-26 21:37 . 2009-12-26 21:37 -------- d-----w- c:\documents and settings\All Users\Application Data\ICQ
2009-12-25 16:39 . 2009-12-25 16:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2009-12-22 23:59 . 2009-12-22 23:59 41872 ----a-w- c:\windows\system32\xfcodec.dll
2009-12-22 05:21 . 2006-02-28 12:00 667136 ------w- c:\windows\system32\wininet.dll
2009-12-22 05:20 . 2006-02-28 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-12-16 18:43 . 2009-04-14 15:34 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-15 22:14 . 2009-04-15 08:45 16384 ----a-w- c:\windows\system32\lgfwunis.exe
2009-12-14 07:08 . 2006-02-28 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-04 18:22 . 2006-02-28 12:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:11 . 2006-02-28 12:00 1291776 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:11 . 2004-08-04 00:56 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:07 . 2006-02-28 12:00 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2001-08-17 22:36 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2006-02-28 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07 . 2006-02-28 12:00 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2004-08-04 00:56 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-21 15:51 . 2006-02-28 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-21 02:34 . 2009-04-15 11:19 592488 ----a-w- c:\windows\system32\nvudisp.exe
2009-11-21 02:34 . 2007-06-28 22:43 6282752 ----a-w- c:\windows\system32\nv4_disp.dll
2009-11-21 02:34 . 2007-06-28 22:43 182888 ----a-w- c:\windows\system32\nvcodins.dll
2009-11-21 02:34 . 2007-06-28 22:43 182888 ----a-w- c:\windows\system32\nvcod.dll
2009-11-21 02:34 . 2007-06-28 22:43 13602816 ----a-w- c:\windows\system32\nvoglnt.dll
2009-11-21 02:34 . 2007-06-28 22:43 1056768 ----a-w- c:\windows\system32\nvapi.dll
2009-11-21 02:34 . 2007-06-28 22:43 10235968 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-11-19 20:42 . 2009-04-15 07:07 592488 ----a-w- c:\windows\system32\NVUNINST.EXE
.

((((((((((((((((((((((((((((( SnapShot@2010-02-15_21.53.49 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-16 19:36 . 2010-02-16 19:36 16384 c:\windows\temp\Perflib_Perfdata_4a0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-04-13 2387968]
"SyncMan"="c:\documents and settings\Maminka\SyncMan.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-10-24 90112]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-11-26 1629480]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-11-26 1057064]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2009-12-15 557056]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 155648]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 69632]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-11-20 110184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-20 12669544]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"SyncMan"="c:\windows\system32\SyncMan.exe" [2010-02-16 42531]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Marek\Start Menu\Programs\Startup\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

c:\documents and settings\Maminka\Start Menu\Programs\Startup\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"d:\\games\\Valve\\hl.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Documents and Settings\\Marek\\Desktop\\Zbierka\\metin 2\\metin2.bin"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\92_mikey_92\\counter-strike\\hl.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\92_mikey_92\\counter-strike beta\\hl.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\92_mikey_92\\deathmatch classic\\hl.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\92_mikey_92\\condition zero deleted scenes\\hl.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\92_mikey_92\\condition zero\\hl.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"d:\\games\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"d:\\games\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\92_mikey_92\\day of defeat\\hl.exe"=
"c:\\Program Files\\ICQ7.0\\ICQ.exe"=
"c:\\Program Files\\ICQ7.0\\aolload.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58722:TCP"= 58722:TCP:Pando Media Booster
"58722:UDP"= 58722:UDP:Pando Media Booster
"3094:UDP"= 3094:UDP:Windows Media Format SDK (firefox.exe)
"3095:UDP"= 3095:UDP:Windows Media Format SDK (firefox.exe)
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [29. 5. 2009 18:31 130936]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23. 8. 2009 16:47 722416]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [8. 1. 2010 0:51 380928]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10. 8. 2009 15:38 133104]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [29. 5. 2009 18:30 348752]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-04-13 13:08 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2009-11-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-10 14:38]

2010-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-10 14:38]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe" //eml:c:\docume~1\Maminka\LOCALS~1\Temp\noname.eml
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{88EB38EF-4D2C-436D-ABD3-56B232674062} - c:\program files\ICQ7.0\ICQ.exe
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
FF - ProfilePath - c:\documents and settings\Maminka\Application Data\Mozilla\Firefox\Profiles\ag9dv4iu.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=966134&p=
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Regedit32 - c:\windows\system32\regedit.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-16 20:36
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x86FDB1F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7660f28
\Driver\ACPI -> ACPI.sys @ 0xf73dacb8
\Driver\atapi -> atapi.sys @ 0xf7395b40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xf7264bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7253a0d
SendHandler -> NDIS.sys @ 0xf7267b40
user & kernel MBR OK

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2728)
c:\program files\ScanSoft\OmniPageSE4.0\OpHookSE4.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\PnkBstrB.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-02-16 20:39:59 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-16 19:39
ComboFix2.txt 2010-02-16 18:51
ComboFix3.txt 2010-02-15 21:57
ComboFix4.txt 2009-09-06 11:26

Pre-Run: 4 725 157 888 bytes free
Post-Run: 4 687 491 072 voľných bajtov

- - End Of File - - BA3E23DF0CF87FA2C24C0C7ADB256F91

#6 Příspěvek od **motji** » 17 úno 2010 21:37

Používáte Daemon nebo alcohol?

Dejte soubor otestovat na http://www.virustotal.com

c:\windows\system32\drivers\cdrom.sys
c:\windows\system32\dllcache\cdrom.sys

-Na virustotalu dáte procházet, a do spodního okénka nakopírujete přímo cestu k souboru a dáte odeslat
-z prohlížeče zkopírujete adresu ke stránce s výsledky

Ještě antivir něco hlásí?

Mikey2692 · #7 Příspěvek od **Mikey2692** » 17 úno 2010 21:48

používal som aj aj ale nedávno som to odstránil lebo sa mi to stále sralo do combofixu ked som tu riešil závažný problém s kompom

Mikey2692 · #8 Příspěvek od **Mikey2692** » 17 úno 2010 21:50

na virustotale mi to hádže len 0 bytes size received / Se ha recibido un archivo vacio a ked to tam chcem uploadnúť tak sa mi do toho stále sere antivirus a zakazuje mi to mám ho skúsiť vypnúť ?

Mikey2692 · #9 Příspěvek od **Mikey2692** » 17 úno 2010 21:58

hlásí mi to asi tak každých desať minút priebežne...

#10 Příspěvek od **motji** » 17 úno 2010 21:59

Předpokládám že oba soubory. Vydržte chvilku, seženu Vám čisté kopie

Mikey2692 · #11 Příspěvek od **Mikey2692** » 17 úno 2010 22:01

jj obidva súbory mi to robia

#12 Příspěvek od **motji** » 17 úno 2010 22:15

Dodržte přesně postup

Z přílohy si stahněte soubor v raru, rozbalte ho a soubor uložte přímo na disk C, tak aby cesta k němu byla c:\cdrom.sys

Stáhněte Avenger
http://swandog46.geekstogo.com/avenger.exe

-spustíte program a potvrdíte kliknutím na ok,tím potvrzujete, že všechny činnosti s tím spojené činíte na vlastní riziko.
-Po odkliknutí se objeví hlavní okno programu,do bílého okna něj zkopírujte tento skript:

Kód: Vybrat vše

Begin copying here:
Files to move:
c:\cdrom.sys | c:\windows\system32\drivers\cdrom.sys

-zaškrtněte políčko scan for rootkits

a klikněte na tlačítko Execute.
-Potom se objeví okno,kde kliknutím Yes potvrdíte spuštění skriptu. Pak znovu tlačítkem yes potvrdíte restart počítače.
-Po restartu by se měl otevřít poznámkový blok s logem o vykonání skriptu, bude také uložený v C:\avenger.txt.
-Log vložte sem

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše


FCOPY::
c:\windows\system32\drivers\cdrom.sys | c:\windows\system32\dllcache\cdrom.sys

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:

Obrázek

-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

Pak znovu otestujte na http://www.virustotal.com
c:\windows\system32\drivers\cdrom.sys
c:\windows\system32\dllcache\cdrom.sys

Mikey2692 · #13 Příspěvek od **Mikey2692** » 17 úno 2010 22:31

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File move operation "c:\cdrom.sys|c:\windows\system32\drivers\cdrom.sys" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

Mikey2692 · #14 Příspěvek od **Mikey2692** » 17 úno 2010 22:55

ComboFix 10-02-12.01 - pc 17.02.2010 22:43:01.8.1 - x86
Systém Microsoft Windows XP Home Edition 5.1.2600.3.1250.421.1033.18.1023.692 [GMT 1:00]
Running from: c:\documents and settings\pc\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\pc\Desktop\CFScript.txt.txt
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\documents and settings\Maminka\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\documents and settings\Marek\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\documents and settings\pc\oashdihasidhasuidhiasdhiashdiuasdhasd

Infected copy of c:\windows\system32\drivers\cdrom.sys was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\cdrom.sys

.
((((((((((((((((((((((((( Files Created from 2010-01-17 to 2010-02-17 )))))))))))))))))))))))))))))))
.

2010-02-17 21:50 . 2010-02-17 21:50 97696 -c--a-w- c:\windows\system32\dllcache\cdrom.sys
2010-02-17 17:36 . 2010-02-17 17:36 -------- d-----w- c:\documents and settings\Marek\Application Data\ESET
2010-02-16 16:23 . 2010-02-16 16:23 42531 ----a-w- c:\windows\system32\SyncMan.exe
2010-02-16 16:23 . 2010-02-16 16:23 42531 ----a-w- c:\documents and settings\NetworkService\SyncMan.exe
2010-02-14 18:58 . 2010-02-14 18:58 -------- d-----w- c:\documents and settings\Marek\Application Data\Apple Computer
2010-02-14 18:57 . 2010-02-14 18:57 -------- d-----w- c:\documents and settings\Marek\Local Settings\Application Data\Apple Computer
2010-02-14 18:31 . 2010-02-14 18:31 -------- d-----w- c:\documents and settings\Marek\Local Settings\Application Data\AOL
2010-02-11 21:18 . 2010-02-11 21:19 -------- d-----w- c:\program files\QuickTime
2010-02-11 21:18 . 2010-02-11 21:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-02-09 20:00 . 2010-02-09 20:00 -------- d-----w- C:\ATF
2010-02-08 17:23 . 2010-02-08 17:23 -------- d-----w- c:\program files\Common Files\Skype
2010-02-06 14:18 . 2010-02-17 21:29 -------- d-----w- c:\program files\ICQ7.0
2010-01-30 22:22 . 2010-01-30 22:22 -------- d-----w- c:\program files\DIFX
2010-01-30 22:22 . 2010-01-30 22:22 -------- dc----w- c:\windows\system32\DRVSTORE
2010-01-30 22:22 . 2009-05-12 14:53 16896 ----a-w- c:\windows\system32\drivers\FlashUsb.sys
2010-01-30 22:20 . 2010-01-30 22:20 -------- d-----w- C:\KP500
2010-01-30 22:19 . 2010-01-27 00:12 935872 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\B2C_Client\LGUserCSTool.exe
2010-01-30 22:19 . 2010-01-22 05:43 499712 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\B2C_Client\LGMUpgradeDL.dll
2010-01-30 22:19 . 2010-01-15 04:24 59328 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\LGMLauncher.exe
2010-01-30 22:19 . 2009-11-19 07:28 90112 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\B2C_Client\LGMobileDL.dll
2010-01-30 22:19 . 2009-11-04 03:57 206792 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\B2C_Client\B2CAppUninstall.exe
2010-01-30 22:19 . 2009-10-06 06:12 24576 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\B2C_Client\LGMobileDLRapi.dll
2010-01-30 22:19 . 2009-06-15 06:21 182208 ----a-w- c:\documents and settings\All Users\Application Data\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe
2010-01-30 22:19 . 2006-05-04 07:33 53248 ----a-w- c:\windows\system32\CommonDL.dll
2010-01-30 22:19 . 2005-10-04 00:39 44544 ----a-w- c:\windows\system32\msxml4a.dll
2010-01-30 22:19 . 2010-01-30 22:19 -------- d-----w- c:\documents and settings\All Users\Application Data\LGMOBILEAX
2010-01-30 19:23 . 2010-01-30 19:23 -------- d-----w- c:\program files\Application Updater
2010-01-28 21:38 . 2009-09-04 16:44 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2010-01-28 21:38 . 2009-09-04 16:44 238936 ----a-w- c:\windows\system32\xactengine3_5.dll
2010-01-28 21:38 . 2009-09-04 16:29 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll
2010-01-28 21:38 . 2009-09-04 16:29 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2010-01-28 21:38 . 2009-09-04 16:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2010-01-28 21:38 . 2009-09-04 16:29 235344 ----a-w- c:\windows\system32\d3dx11_42.dll
2010-01-28 21:38 . 2009-09-04 16:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2010-01-28 19:10 . 2010-01-28 19:10 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2010-01-28 19:10 . 2010-01-28 19:11 -------- d-----w- c:\program files\NVIDIA Corporation
2010-01-28 19:09 . 2009-11-21 02:34 69632 ----a-w- c:\windows\system32\OpenCL.dll
2010-01-28 19:09 . 2009-11-21 02:34 4038656 ----a-w- c:\windows\system32\nvcuda.dll
2010-01-28 19:09 . 2009-11-21 02:34 2259560 ----a-w- c:\windows\system32\nvcuvid.dll
2010-01-28 19:09 . 2009-11-21 02:34 1989224 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-01-28 19:09 . 2009-11-21 02:34 11374592 ----a-w- c:\windows\system32\nvcompiler.dll
2010-01-28 19:09 . 2009-11-21 02:34 2293286 ----a-w- c:\windows\system32\nvdata.bin
2010-01-28 19:09 . 2010-01-28 19:09 -------- d-----w- C:\NVIDIA
2010-01-28 18:32 . 2010-01-28 18:32 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-01-28 18:32 . 2010-01-28 18:32 552 ----a-w- c:\windows\system32\d3d8caps.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-17 21:50 . 2009-04-15 08:45 -------- d-----w- c:\program files\lg_fwupdate
2010-02-17 21:50 . 2006-02-28 12:00 97696 ----a-w- c:\windows\system32\drivers\cdrom.sys
2010-02-17 21:50 . 2009-04-15 15:54 -------- d-----w- c:\program files\DNA
2010-02-17 19:09 . 2009-05-02 19:34 -------- d-----w- c:\documents and settings\Marek\Application Data\Skype
2010-02-17 17:37 . 2009-05-02 19:39 -------- d-----w- c:\documents and settings\Marek\Application Data\skypePM
2010-02-16 20:47 . 2009-04-15 11:37 -------- d-----w- c:\program files\Eset
2010-02-16 20:47 . 2009-08-18 16:33 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2010-02-15 19:19 . 2009-05-29 17:30 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2010-02-15 19:19 . 2009-05-29 17:31 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-15 18:37 . 2009-04-27 18:06 69232 ----a-w- c:\documents and settings\Maminka\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-14 22:05 . 2009-04-15 07:13 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-14 21:24 . 2009-05-09 12:37 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-02-14 18:31 . 2009-04-16 19:05 -------- d-----w- c:\documents and settings\Marek\Application Data\ICQ
2010-02-13 10:21 . 2009-05-08 11:38 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-02-13 10:21 . 2009-05-08 11:37 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-02-13 10:21 . 2009-05-08 11:37 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-02-08 17:23 . 2009-05-02 19:34 -------- d-----r- c:\program files\Skype
2010-02-08 17:23 . 2009-05-02 19:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-02-06 13:35 . 2009-05-20 13:22 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2010-02-01 17:11 . 2009-10-21 19:01 -------- d-----w- c:\program files\LG PC Suite II
2010-01-29 21:01 . 2009-05-02 19:34 -------- d-----w- c:\program files\Google
2010-01-28 19:11 . 2009-11-14 21:49 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-28 19:10 . 2009-11-14 21:49 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-27 19:38 . 2009-05-21 14:24 -------- d-----w- c:\program files\Windows Desktop Search
2010-01-23 11:26 . 2009-04-23 18:52 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-22 15:18 . 2009-04-15 14:37 -------- d-----w- c:\program files\Xfire
2010-01-18 14:32 . 2009-04-28 17:25 69232 ----a-w- c:\documents and settings\Marek\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-08 07:13 . 2010-01-08 07:13 33096 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2010-01-03 23:01 . 2010-01-03 23:01 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-01-03 22:52 . 2010-01-03 22:52 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-03 22:48 . 2010-01-03 22:48 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-12-31 16:50 . 2006-02-28 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-26 21:37 . 2009-12-26 21:37 -------- d-----w- c:\program files\ICQ6Toolbar
2009-12-26 21:37 . 2009-12-26 21:37 -------- d-----w- c:\documents and settings\All Users\Application Data\ICQ
2009-12-25 16:39 . 2009-12-25 16:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2009-12-22 23:59 . 2009-12-22 23:59 41872 ----a-w- c:\windows\system32\xfcodec.dll
2009-12-22 05:21 . 2006-02-28 12:00 667136 ------w- c:\windows\system32\wininet.dll
2009-12-22 05:20 . 2006-02-28 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-12-18 14:02 . 2009-12-18 14:02 135048 ----a-w- c:\windows\system32\drivers\epfw.sys
2009-12-16 18:43 . 2009-04-14 15:34 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-15 22:14 . 2009-04-15 08:45 16384 ----a-w- c:\windows\system32\lgfwunis.exe
2009-12-14 07:08 . 2006-02-28 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-04 18:22 . 2006-02-28 12:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:11 . 2006-02-28 12:00 1291776 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:11 . 2004-08-04 00:56 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:07 . 2006-02-28 12:00 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2001-08-17 22:36 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2006-02-28 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07 . 2006-02-28 12:00 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2004-08-04 00:56 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-21 15:51 . 2006-02-28 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-21 02:34 . 2009-04-15 11:19 592488 ----a-w- c:\windows\system32\nvudisp.exe
2009-11-21 02:34 . 2007-06-28 22:43 6282752 ----a-w- c:\windows\system32\nv4_disp.dll
2009-11-21 02:34 . 2007-06-28 22:43 182888 ----a-w- c:\windows\system32\nvcodins.dll
2009-11-21 02:34 . 2007-06-28 22:43 182888 ----a-w- c:\windows\system32\nvcod.dll
2009-11-21 02:34 . 2007-06-28 22:43 13602816 ----a-w- c:\windows\system32\nvoglnt.dll
2009-11-21 02:34 . 2007-06-28 22:43 1056768 ----a-w- c:\windows\system32\nvapi.dll
2009-11-21 02:34 . 2007-06-28 22:43 10235968 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-02-15_21.53.49 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-17 21:50 . 2010-02-17 21:50 16384 c:\windows\temp\Perflib_Perfdata_2a0.dat
+ 2009-11-16 08:06 . 2009-11-16 08:06 55768 c:\windows\system32\drivers\epfwtdi.sys
+ 2010-02-16 20:48 . 2010-02-16 20:48 97360 c:\windows\Installer\{A32D29EB-F9F5-4F35-87F5-B638F818B0B0}\egui.exe
+ 2010-02-16 20:48 . 2010-02-16 20:48 10134 c:\windows\Installer\{A32D29EB-F9F5-4F35-87F5-B638F818B0B0}\callmsi.exe
+ 2009-11-16 08:03 . 2009-11-16 08:03 108792 c:\windows\system32\drivers\ehdrv.sys
+ 2009-11-16 07:56 . 2009-11-16 07:56 116520 c:\windows\system32\drivers\eamon.sys
+ 2010-02-16 20:48 . 2010-02-16 20:48 1140736 c:\windows\Installer\4178e0.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-04-13 2387968]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-07 323392]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-02 39408]
"SyncMan"="c:\documents and settings\pc\SyncMan.exe" [BU]
"ICQ"="c:\program files\ICQ7.0\ICQ.exe" [2010-02-11 133368]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-10-24 90112]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-11-26 1629480]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-11-26 1057064]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2009-12-15 557056]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 155648]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 69632]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-11-20 110184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-20 12669544]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"SyncMan"="c:\windows\system32\SyncMan.exe" [2010-02-16 42531]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-11-16 2054360]
"Regedit32"="c:\windows\system32\regedit.exe" [BU]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Marek\Start Menu\Programs\Startup\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

c:\documents and settings\Maminka\Start Menu\Programs\Startup\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"d:\\games\\Valve\\hl.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Documents and Settings\\Marek\\Desktop\\Zbierka\\metin 2\\metin2.bin"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\92_mikey_92\\counter-strike\\hl.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\92_mikey_92\\counter-strike beta\\hl.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\92_mikey_92\\deathmatch classic\\hl.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\92_mikey_92\\condition zero deleted scenes\\hl.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\92_mikey_92\\condition zero\\hl.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"d:\\games\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"d:\\games\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\92_mikey_92\\day of defeat\\hl.exe"=
"c:\\Program Files\\ICQ7.0\\ICQ.exe"=
"c:\\Program Files\\ICQ7.0\\aolload.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58722:TCP"= 58722:TCP:Pando Media Booster
"58722:UDP"= 58722:UDP:Pando Media Booster
"3094:UDP"= 3094:UDP:Windows Media Format SDK (firefox.exe)
"3095:UDP"= 3095:UDP:Windows Media Format SDK (firefox.exe)
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [29.5.2009 18:31 130936]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23.8.2009 16:47 722416]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 9:03 108792]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [8.1.2010 0:51 380928]
R2 ekrn;ESET Service;c:\program files\Eset\ESET Smart Security\ekrn.exe [16.11.2009 9:04 735960]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10.8.2009 15:38 133104]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [29.5.2009 18:30 348752]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-04-13 13:08 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2009-11-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-10 14:38]

2010-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-10 14:38]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://start.icq.com/icqskins/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {{88EB38EF-4D2C-436D-ABD3-56B232674062} - c:\program files\ICQ7.0\ICQ.exe
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
FF - ProfilePath - c:\documents and settings\pc\Application Data\Mozilla\Firefox\Profiles\jxcd50ug.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://pokec.azet.sk/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=966134&p=
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
HKCU-Run-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\daemon.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-17 22:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x871DA1F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7560f28
\Driver\ACPI -> ACPI.sys @ 0xf72dacb8
\Driver\atapi -> atapi.sys @ 0xf7295b40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xf7164bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7153a0d
SendHandler -> NDIS.sys @ 0xf7167b40
user & kernel MBR OK

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2292)
c:\program files\ScanSoft\OmniPageSE4.0\OpHookSE4.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\wdfmgr.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\RUNDLL32.EXE
.
**************************************************************************
.
Completion time: 2010-02-17 22:55:19 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-17 21:55
ComboFix2.txt 2010-02-16 19:39
ComboFix3.txt 2010-02-16 18:51
ComboFix4.txt 2010-02-15 21:57
ComboFix5.txt 2010-02-17 21:42

Pre-Run: 4 468 625 408 bytes free
Post-Run: 5 607 849 984 voľných bajtov

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 030502DE241EE66818222524AA640FAA

Mikey2692 · #15 Příspěvek od **Mikey2692** » 17 úno 2010 22:58

nič stále mi hádžu to isté obidva súbory..

VIRY.CZ

Win32/Protector.G vírus

Win32/Protector.G vírus

Re: Win32/Protector.G vírus

Re: Win32/Protector.G vírus

Re: Win32/Protector.G vírus

Re: Win32/Protector.G vírus

Re: Win32/Protector.G vírus

Re: Win32/Protector.G vírus

Re: Win32/Protector.G vírus

Re: Win32/Protector.G vírus

Re: Win32/Protector.G vírus

Re: Win32/Protector.G vírus

Re: Win32/Protector.G vírus

Re: Win32/Protector.G vírus

Re: Win32/Protector.G vírus

Re: Win32/Protector.G vírus