VIRY.CZ

Dobry den mam problemy s pomalym nacitavanim pc pri zapnuti otvarani internet browseru a nacitavani hier...tak isto mi ide velmi pomaly pc po tom co ho prebudim z usporneho rezimu...kontroloval som pc uz s mnohymi programami malwarebytes,ad-aware,spybot search and destroy,ccleaner,nod32,superantispyware ale este by som chcel skontrolovat log z mojho pc.dakujem velmi pekne,tu je log:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2010-03-14 00:00:13
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 14 GB (7%) free of 200 GB
Total RAM: 3071 MB (82% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:00:50, on 14. 3. 2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\MSI\ADVANC~1\wh_exec.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\System Control Manager\MSIService.exe
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\Administrator\My Documents\Preberanie\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://facebook.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.qip.ru/search?query=%s&from=IE
R3 - URLSearchHook: (no name) - {95289393-33EA-4F8D-B952-483415B9C955} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O4 - HKLM\..\Run: [WheelMouse] C:\MSI\ADVANC~1\wh_exec.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/L ... nstall.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: TeknoGods.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Micro Star SCM - Unknown owner - C:\Program Files\System Control Manager\MSIService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe

--
End of file - 7270 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-616249376-725345543-500Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-616249376-725345543-500UA.job
C:\WINDOWS\tasks\OGALogon.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2009-12-18 61888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-08-04 1586472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-25 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}]
Search Assistant - C:\Program Files\SGPSA\BHO.dll [2009-11-06 293376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{1BB22D38-A411-4B13-A746-C2A4F4EC7344} - Fast Browser Search Toolbar - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll [2009-08-13 2602368]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WheelMouse"=C:\MSI\ADVANC~1\wh_exec.exe [2007-09-13 90112]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-09-11 2054360]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2009-12-18 40368]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-08-19 13762560]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [2007-09-20 202024]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-25 135664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MGSysCtrl]
C:\Program Files\System Control Manager\MGSysCtrl.exe [2008-06-23 794624]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2007-09-20 1836328]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2007-03-01 153136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2009-08-19 13762560]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2009-08-19 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /installquiet []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2009-11-10 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
C:\WINDOWS\RTHDCPL.EXE [2008-05-28 16862720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
c:\program files\steam\steam.exe [2010-02-20 1217872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-25 149280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ServiceLayer"=3
"ProtexisLicensing"=2
"PnkBstrB"=2
"PnkBstrA"=2
"ose"=3
"NMIndexingService"=3
"Nero BackItUp Scheduler 3"=2
"MDM"=2
"JavaQuickStarterService"=2
"idsvc"=3
"Apache2.2"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="TeknoGods.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2009-09-03 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-05 241704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Nero\Nero8\Nero Home\NeroHome.exe"="C:\Program Files\Nero\Nero8\Nero Home\NeroHome.exe:*:Enabled:Nero Home"
"C:\Program Files\World of Warcraft\Repair.exe"="C:\Program Files\World of Warcraft\Repair.exe:*:Enabled:Blizzard Repair Utility"
"C:\Documents and Settings\Administrator\Local Settings\Temp\Blizzard Launcher Temporary - d13246b0\Launcher.exe"="C:\Documents and Settings\Administrator\Local Settings\Temp\Blizzard Launcher Temporary - d13246b0\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\Program Files\World of Warcraft\World of Warcraft\Repair.exe"="C:\Program Files\World of Warcraft\World of Warcraft\Repair.exe:*:Enabled:Blizzard Repair Utility"
"C:\Hry\World of Warcraftzzzzz\World of Warcraft\Repair.exe"="C:\Hry\World of Warcraftzzzzz\World of Warcraft\Repair.exe:*:Enabled:Blizzard Repair Utility"
"C:\Hry\World of Warcraftzzzzz\Repair.exe"="C:\Hry\World of Warcraftzzzzz\Repair.exe:*:Enabled:Blizzard Repair Utility"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"C:\MMOPro Repack\Server\apache\bin\apache.exe"="C:\MMOPro Repack\Server\apache\bin\apache.exe:*:Enabled:Apache HTTP Server"
"C:\MMOPro Repack\Arcemu\arcemu-world.exe"="C:\MMOPro Repack\Arcemu\arcemu-world.exe:*:Enabled:arcemu-world"
"C:\MMOPro Repack\Server\mysql\bin\mysqld.exe"="C:\MMOPro Repack\Server\mysql\bin\mysqld.exe:*:Enabled:mysqld"
"F:\MMOPro Repack\Server\mysql\bin\mysqld.exe"="F:\MMOPro Repack\Server\mysql\bin\mysqld.exe:*:Enabled:mysqld"
"F:\MMOPro Repack\Arcemu\arcemu-world.exe"="F:\MMOPro Repack\Arcemu\arcemu-world.exe:*:Enabled:arcemu-world"
"F:\MMOPro Repack\Server\apache\bin\apache.exe"="F:\MMOPro Repack\Server\apache\bin\apache.exe:*:Enabled:Apache HTTP Server"
"C:\2.4.3 Arcemu Repack\Conan-WoW Repack\Site\mysql\bin\mysqld.exe"="C:\2.4.3 Arcemu Repack\Conan-WoW Repack\Site\mysql\bin\mysqld.exe:*:Enabled:mysqld.exe"
"C:\Conan-WoW Repack\ArcEmu\arcemu-world.exe"="C:\Conan-WoW Repack\ArcEmu\arcemu-world.exe:*:Enabled:arcemu-world"
"C:\Conan-WoW Repack\Site\mysql\bin\mysqld.exe"="C:\Conan-WoW Repack\Site\mysql\bin\mysqld.exe:*:Enabled:mysqld"
"C:\Conan-WoW Repack\ArcEmu\arcemu-logonserver.exe"="C:\Conan-WoW Repack\ArcEmu\arcemu-logonserver.exe:*:Enabled:arcemu-logonserver"
"C:\Conan-WoW Repack1\Site\mysql\bin\mysqld.exe"="C:\Conan-WoW Repack1\Site\mysql\bin\mysqld.exe:*:Enabled:mysqld"
"C:\Conan-WoW Repack1\ArcEmu\arcemu-logonserver.exe"="C:\Conan-WoW Repack1\ArcEmu\arcemu-logonserver.exe:*:Enabled:arcemu-logonserver"
"C:\Conan-WoW Repack1\ArcEmu\arcemu-world.exe"="C:\Conan-WoW Repack1\ArcEmu\arcemu-world.exe:*:Enabled:arcemu-world"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"F:\World of Wacraft\World of Warcraft\Launcher.exe"="F:\World of Wacraft\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher"
"F:\World of Wacraft\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe"="F:\World of Wacraft\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Valve\hl.exe"="C:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"F:\World of Wacraft\World of Warcraft\BackgroundDownloader.exe"="F:\World of Wacraft\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"F:\World of Wacraft\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-enGB-downloader.exe"="F:\World of Wacraft\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\RayV\RayV\RayV.dll"="C:\Program Files\RayV\RayV\RayV.dll:*:Enabled:RayV"
"C:\Program Files\RayV\RayV\RayV.exe"="C:\Program Files\RayV\RayV\RayV.exe:*:Enabled:RayV"
"C:\Documents and Settings\Administrator\Application Data\RayV\Viewer\RayV.dll"="C:\Documents and Settings\Administrator\Application Data\RayV\Viewer\RayV.dll:*:Enabled:RayV"
"C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server"
"C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server"
"F:\World of Wacraft\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-enGB-downloader.exe"="F:\World of Wacraft\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\WINDOWS\system32\dxdiag.exe"="C:\WINDOWS\system32\dxdiag.exe:*:Enabled:Microsoft DirectX Diagnostic Tool"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe"="C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe:*:Enabled:Zoo Tycoon 2 Executable"
"C:\Program Files\Activision\Call of Duty - World at War\CoDWaWmp.exe"="C:\Program Files\Activision\Call of Duty - World at War\CoDWaWmp.exe:*:Enabled:Call of Duty(R) - World at War(TM)"
"C:\Program Files\Activision\Call of Duty - World at War\CoDWaW.exe"="C:\Program Files\Activision\Call of Duty - World at War\CoDWaW.exe:*:Enabled:Call of Duty(R) - World at War(TM)"
"F:\World of Wacraft\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enGB-downloader.exe"="F:\World of Wacraft\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Empire Interactive\FlatOut2\FlatOut2.exe"="C:\Program Files\Empire Interactive\FlatOut2\FlatOut2.exe:*:Enabled:FlatOut2"
"F:\World of Wacraft\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enGB-downloader.exe"="F:\World of Wacraft\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\wowefcko\Launcher.exe"="C:\wowefcko\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\Program Files\Activision\Wolfenstein\MP\Wolf2MP.exe"="C:\Program Files\Activision\Wolfenstein\MP\Wolf2MP.exe:*:Enabled:Wolfenstein(TM)"
"C:\Program Files\Activision\Wolfenstein\MP\Wolf2MPLite.exe"="C:\Program Files\Activision\Wolfenstein\MP\Wolf2MPLite.exe:*:Enabled:Wolfenstein(TM)"
"C:\Program Files\AIM\aim.exe"="C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update"
"C:\Program Files\Activision\Transformers - Revenge of the Fallen\Transformers2.exe"="C:\Program Files\Activision\Transformers - Revenge of the Fallen\Transformers2.exe:*:Enabled:Transformers - Revenge of the Fallen"
"C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\s2gs.exe"="C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\s2gs.exe:*:Enabled:Sacred 2 Game Server"
"C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\sacred2.exe"="C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\sacred2.exe:*:Enabled:Sacred 2"
"C:\Program Files\Codemasters\OF Dragon Rising\OFDR.exe"="C:\Program Files\Codemasters\OF Dragon Rising\OFDR.exe:*:Enabled:OF Dragon Rising"
"C:\Program Files\Eidos\Batman Arkham Asylum\Binaries\ShippingPC-BmGame.exe"="C:\Program Files\Eidos\Batman Arkham Asylum\Binaries\ShippingPC-BmGame.exe:*:Enabled:Batman: Arkham Asylum"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\Steam\steam.exe"="C:\Program Files\Steam\steam.exe:*:Enabled:Steam 732897"
"C:\Program Files\Charles\Charles.exe"="C:\Program Files\Charles\Charles.exe:*:Enabled:Charles Web Debugging Proxy"
"C:\Program Files\Steam\SteamApps\common\zero gear\ZeroGear.bat"="C:\Program Files\Steam\SteamApps\common\zero gear\ZeroGear.bat:*:Enabled:Zero Gear"
"C:\Program Files\Steam\SteamApps\common\zero gear\Server\ZeroGearServer.exe"="C:\Program Files\Steam\SteamApps\common\zero gear\Server\ZeroGearServer.exe:*:Enabled:ZeroGearServer"
"C:\Program Files\Smokin' Guns\smokinguns.exe"="C:\Program Files\Smokin' Guns\smokinguns.exe:*:Enabled:smokinguns"
"C:\Program Files\Steam\SteamApps\common\red orchestra\System\RedOrchestra.exe"="C:\Program Files\Steam\SteamApps\common\red orchestra\System\RedOrchestra.exe:*:Enabled:Red Orchestra: Ostfront 41-45"
"C:\Program Files\Steam\SteamApps\common\call of duty modern warfare 2\iw4sp.exe"="C:\Program Files\Steam\SteamApps\common\call of duty modern warfare 2\iw4sp.exe:*:Enabled:Call of Duty: Modern Warfare 2"
"C:\Program Files\Steam\SteamApps\common\call of duty modern warfare 2\iw4mp.exe"="C:\Program Files\Steam\SteamApps\common\call of duty modern warfare 2\iw4mp.exe:*:Enabled:Call of Duty: Modern Warfare 2 - Multiplayer"
"C:\Program Files\Steam\SteamApps\common\left 4 dead\left4dead.exe"="C:\Program Files\Steam\SteamApps\common\left 4 dead\left4dead.exe:*:Enabled:Left 4 Dead"
"C:\Program Files\EA Games\Battlefield Vietnam\bfvietnam.exe"="C:\Program Files\EA Games\Battlefield Vietnam\bfvietnam.exe:*:Enabled:bfvietnam"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90be2f42-d05a-11dd-aa5e-806d6172696f}]
shell\AutoRun\command - D:\AUTORUN.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{953adcf5-d059-11dd-aa61-c2664dcc7d35}]
shell\AutoRun\command - E:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{953adcf7-d059-11dd-aa61-c2664dcc7d35}]
shell\AutoRun\command - E:\AutoRun.exe


======List of files/folders created in the last 1 months======

2010-03-14 00:00:14 ----D---- C:\Program Files\trend micro
2010-03-14 00:00:13 ----D---- C:\rsit
2010-03-13 22:02:27 ----A---- C:\WINDOWS\ntbtlog.txt
2010-03-13 21:54:04 ----D---- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2010-03-13 21:53:50 ----D---- C:\Program Files\SUPERAntiSpyware
2010-03-13 21:53:50 ----D---- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-03-13 21:23:42 ----D---- C:\Program Files\Adobe
2010-03-13 13:12:45 ----D---- C:\Documents and Settings\Administrator\Application Data\vlc
2010-03-13 11:56:15 ----D---- C:\Documents and Settings\Administrator\Application Data\Bioshock
2010-03-12 23:35:13 ----D---- C:\Program Files\VideoLAN
2010-03-12 22:59:08 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2010-03-12 22:46:39 ----D---- C:\Program Files\2K Games
2010-03-12 22:40:54 ----D---- C:\Documents and Settings\Administrator\Application Data\Auslogics
2010-03-12 22:38:31 ----D---- C:\Program Files\Auslogics
2010-03-10 21:52:53 ----N---- C:\WINDOWS\system32\browserchoice.exe
2010-02-27 23:36:13 ----D---- C:\Program Files\Creative
2010-02-27 23:36:13 ----A---- C:\WINDOWS\system32\eax.dll
2010-02-27 23:36:08 ----A---- C:\WINDOWS\IsUninst.exe
2010-02-27 23:12:49 ----D---- C:\Program Files\Mafia
2010-02-27 23:12:02 ----RA---- C:\WINDOWS\system32\MafiaSetup.exe
2010-02-25 20:10:16 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-02-25 20:10:16 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-24 16:07:03 ----D---- C:\Program Files\Free Offers from Freeze.com
2010-02-22 19:34:10 ----D---- C:\Program Files\EA Sports
2010-02-22 13:31:24 ----D---- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2010-02-22 13:31:16 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2010-02-22 13:31:12 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-02-21 14:04:48 ----A---- C:\Documents and Settings\All Users\Application Data\fiosejgfse.dll
2010-02-15 16:44:15 ----D---- C:\Projekty

======List of files/folders modified in the last 1 months======

2010-03-14 00:00:29 ----D---- C:\WINDOWS\Temp
2010-03-14 00:00:14 ----RD---- C:\Program Files
2010-03-13 23:48:52 ----D---- C:\WINDOWS\Prefetch
2010-03-13 23:22:48 ----D---- C:\Program Files\Mozilla Firefox
2010-03-13 23:22:41 ----D---- C:\Hry
2010-03-13 22:04:47 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-13 22:02:27 ----D---- C:\WINDOWS
2010-03-13 22:00:56 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-13 21:54:00 ----SHD---- C:\Config.Msi
2010-03-13 21:53:59 ----SHD---- C:\WINDOWS\Installer
2010-03-13 21:53:01 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-03-13 21:48:40 ----SH---- C:\boot.ini
2010-03-13 21:48:40 ----A---- C:\WINDOWS\win.ini
2010-03-13 21:48:40 ----A---- C:\WINDOWS\system.ini
2010-03-13 21:45:42 ----D---- C:\Documents and Settings\Administrator\Application Data\Skype
2010-03-13 21:45:33 ----D---- C:\Program Files\Steam
2010-03-13 21:41:20 ----D---- C:\Documents and Settings\Administrator\Application Data\skypePM
2010-03-13 21:37:01 ----D---- C:\WINDOWS\pss
2010-03-13 21:23:56 ----D---- C:\WINDOWS\WinSxS
2010-03-13 21:23:52 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-03-13 21:22:36 ----D---- C:\Program Files\Common Files\Adobe
2010-03-13 21:21:31 ----D---- C:\WINDOWS\system32
2010-03-13 16:23:12 ----HD---- C:\Program Files\InstallShield Installation Information
2010-03-13 15:59:23 ----D---- C:\Program Files\EA Games
2010-03-13 13:54:07 ----RD---- C:\hudba
2010-03-13 13:25:52 ----D---- C:\WINDOWS\system32\LogFiles
2010-03-13 11:59:25 ----D---- C:\cela plocha
2010-03-12 23:33:38 ----D---- C:\WINDOWS\Debug
2010-03-12 23:33:36 ----D---- C:\WINDOWS\Minidump
2010-03-12 23:23:56 ----D---- C:\Program Files\Activision
2010-03-12 23:02:02 ----HD---- C:\WINDOWS\inf
2010-03-12 23:01:33 ----RSD---- C:\WINDOWS\assembly
2010-03-12 23:00:34 ----D---- C:\WINDOWS\system32\DirectX
2010-03-12 22:42:31 ----A---- C:\WINDOWS\NeroDigital.ini
2010-03-12 21:59:33 ----D---- C:\Program Files\Rockstar Games
2010-03-10 22:48:52 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-03-10 22:48:51 ----D---- C:\Program Files\Movie Maker
2010-03-10 22:47:33 ----HD---- C:\WINDOWS\$hf_mig$
2010-03-02 06:30:12 ----A---- C:\WINDOWS\system32\MRT.exe
2010-02-25 00:05:30 ----D---- C:\WINDOWS\system32\drivers
2010-02-23 18:16:47 ----D---- C:\Documents and Settings\Administrator\Application Data\Adobe
2010-02-23 14:55:44 ----D---- C:\Program Files\Charles
2010-02-23 14:55:20 ----D---- C:\WINDOWS\SHELLNEW
2010-02-22 20:10:35 ----D---- C:\Program Files\Oberon Media
2010-02-22 20:10:34 ----D---- C:\Program Files\DivX
2010-02-22 17:31:04 ----D---- C:\Program Files\Electronic Arts
2010-02-22 13:49:43 ----D---- C:\WINDOWS\SM56Setup
2010-02-15 22:14:35 ----RD---- C:\ingexe
2010-02-15 16:12:10 ----SD---- C:\Documents and Settings\Administrator\Application Data\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-09-11 108792]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2009-09-11 96408]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS []
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-09-11 116008]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 enecir;ENE CIR Receiver; C:\WINDOWS\system32\DRIVERS\enecir.sys [2008-12-22 54784]
R3 enecirhid;ENE CIR HID Receiver; C:\WINDOWS\system32\DRIVERS\enecirhid.sys [2008-12-22 11264]
R3 enecirhidma;ENE CIR HIDmini Filter; C:\WINDOWS\system32\DRIVERS\enecirhidma.sys [2008-12-22 5632]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-06-02 4752384]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NETw5x32;Intel(R) Wireless WiFi Link Adapter Driver for Windows XP 32 Bit ; C:\WINDOWS\system32\DRIVERS\NETw5x32.sys [2008-04-28 3626112]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-08-19 7968448]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\WINDOWS\system32\drivers\nvhda32.sys [2009-05-11 56480]
R3 O2MDRDR;O2MDRDR; C:\WINDOWS\system32\DRIVERS\o2media.sys [2008-12-22 51288]
R3 O2SDRDR;O2SDRDR; C:\WINDOWS\system32\DRIVERS\o2sd.sys [2008-12-22 43608]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-12-22 106368]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
R3 whfltr2k;WheelMouse USB Lower Filter Driver; C:\WINDOWS\system32\DRIVERS\whfltr2k.sys [2007-01-25 6784]
S3 abcgozws;abcgozws; C:\WINDOWS\system32\drivers\abcgozws.sys []
S3 acvt1qp3;acvt1qp3; C:\WINDOWS\system32\drivers\acvt1qp3.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 FsUsbExDisk;FsUsbExDisk; \??\C:\WINDOWS\system32\FsUsbExDisk.SYS []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-09-06 25280]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2006-10-30 88960]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 s116bus;Sony Ericsson Device 116 driver (WDM); C:\WINDOWS\system32\DRIVERS\s116bus.sys [2007-04-03 83336]
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
S3 SCREAMINGBDRIVER;Screaming Bee Audio; C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2008-11-22 23064]
S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 smserial;smserial; C:\WINDOWS\system32\DRIVERS\smserial.sys []
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 teamviewervpn;TeamViewer VPN Adapter; C:\WINDOWS\system32\DRIVERS\teamviewervpn.sys [2008-01-25 25088]
S3 tosporte;Bluetooth COM Port; C:\WINDOWS\system32\DRIVERS\tosporte.sys []
S3 tosrfbd;Bluetooth RFBUS; C:\WINDOWS\system32\DRIVERS\tosrfbd.sys []
S3 tosrfbnp;Bluetooth RFBNEP; C:\WINDOWS\System32\Drivers\tosrfbnp.sys []
S3 Tosrfcom;Bluetooth RFCOMM; C:\WINDOWS\System32\Drivers\tosrfcom.sys []
S3 Tosrfhid;Bluetooth RFHID; C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys []
S3 tosrfnds;Bluetooth Personal Area Network; C:\WINDOWS\system32\DRIVERS\tosrfnds.sys []
S3 TosRfSnd;Bluetooth Audio; C:\WINDOWS\system32\drivers\tosrfsnd.sys []
S3 Tosrfusb;Bluetooth USB Controller; C:\WINDOWS\system32\DRIVERS\tosrfusb.sys []
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 usbvideo;USB Video Device (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
S3 WSIMD;wsimd Service; C:\WINDOWS\system32\DRIVERS\wsimd.sys []
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-09-11 735960]
R2 Micro Star SCM;Micro Star SCM; C:\Program Files\System Control Manager\MSIService.exe [2008-06-09 159744]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-08-19 168004]
R2 o2flash;O2Micro Flash Memory Card Service; C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe [2008-12-22 65536]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-09-11 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 Apache2.2;Apache2.2; C:\MMOPro Repack\Server\apache\bin\apache.exe -k runservice []
S4 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-25 153376]
S4 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
S4 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-09-20 853288]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2007-09-20 382248]
S4 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S4 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2008-12-22 66872]
S4 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2008-12-22 107832]
S4 ProtexisLicensing;ProtexisLicensing; C:\WINDOWS\system32\PSIService.exe [2007-06-05 177704]
S4 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]

-----------------EOF-----------------

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

ComboFix 10-03-13.03 - Administrator . 03. 2010 16:02:34.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3071.2679 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Fast Browser Search
c:\program files\Fast Browser Search\1.bat
c:\program files\Fast Browser Search\about.html
c:\program files\Fast Browser Search\affid.dat
c:\program files\Fast Browser Search\basis.xml
c:\program files\Fast Browser Search\basis_br.xml
c:\program files\Fast Browser Search\basis_de.xml
c:\program files\Fast Browser Search\basis_en.xml
c:\program files\Fast Browser Search\basis_es.xml
c:\program files\Fast Browser Search\IE\basis.xml
c:\program files\Fast Browser Search\IE\basis_fr.xml
c:\program files\Fast Browser Search\IE\basis_it.xml
c:\program files\Fast Browser Search\IE\basis_nr.xml
c:\program files\Fast Browser Search\IE\basis_pt.xml
c:\program files\Fast Browser Search\IE\basis_ru.xml
c:\program files\Fast Browser Search\IE\basis_tr.xml
c:\program files\Fast Browser Search\IE\BHO.dll
c:\program files\Fast Browser Search\IE\ClearRecycleBin.exe
c:\program files\Fast Browser Search\IE\error.html
c:\program files\Fast Browser Search\IE\FBSPlugin.dll
c:\program files\Fast Browser Search\IE\fbsProtection.xml
c:\program files\Fast Browser Search\IE\FbsSearchProvider.xml
c:\program files\Fast Browser Search\IE\FbsSearchProviderIE8.exe
c:\program files\Fast Browser Search\IE\FBStoolbar.dll
c:\program files\Fast Browser Search\IE\fbstoolbar.jar
c:\program files\Fast Browser Search\IE\fbstoolbar.manifest
c:\program files\Fast Browser Search\tbs_include_script_003175.js
c:\program files\Fast Browser Search\tbs_include_script_005064.js
c:\program files\Fast Browser Search\tbs_include_script_012817.js
c:\program files\Fast Browser Search\Toolbar Help.htm
c:\program files\Fast Browser Search\ToolBarBHO.dll
c:\program files\Fast Browser Search\uninstall.exe
c:\program files\Fast Browser Search\uninstalSGP.exe
c:\program files\Fast Browser Search\uninstalSGPU.exe
c:\program files\Fast Browser Search\update.exe
c:\program files\Fast Browser Search\version.txt
c:\program files\Cheat Engine\dbk32.sys
c:\program files\Search Guard Plus
c:\program files\Search Guard Plus\fbsProtection.xml
c:\program files\Search Guard Plus\fbsSearchProvider.xml
c:\program files\Search Guard Plus\FbsSearchProviderIE8.exe
c:\program files\Search Guard PlusU
c:\program files\SGPSA
c:\program files\SGPSA\BHO.dll

.
((((((((((((((((((((((((( Files Created from 2010-02-14 to 2010-03-14 )))))))))))))))))))))))))))))))
.

2010-03-13 23:00 . 2010-03-13 23:00 -------- d-----w- c:\program files\trend micro
2010-03-13 23:00 . 2010-03-13 23:01 -------- d-----w- C:\rsit
2010-03-13 20:54 . 2010-03-13 20:54 52224 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-03-13 20:54 . 2010-03-13 20:54 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-03-13 20:54 . 2010-03-13 20:54 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-03-13 20:54 . 2010-03-13 20:54 18944 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
2010-03-13 20:53 . 2010-03-13 20:53 65024 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
2010-03-13 20:53 . 2010-03-13 20:53 5120 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF16.exe
2010-03-13 20:53 . 2010-03-13 20:53 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-03-13 20:53 . 2010-03-13 20:53 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-03-13 16:19 . 2010-03-13 16:19 4 ----a-w- C:\loadcounter.dat
2010-03-13 15:28 . 2010-03-13 15:28 553 ----a-w- c:\windows\eReg.dat
2010-03-13 12:12 . 2010-03-13 23:43 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc
2010-03-13 10:56 . 2010-03-14 11:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\Bioshock
2010-03-12 22:35 . 2010-03-12 22:35 -------- d-----w- c:\program files\VideoLAN
2010-03-12 21:59 . 2010-03-12 21:59 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-03-12 21:46 . 2010-03-12 21:46 -------- d-----w- c:\program files\2K Games
2010-03-12 21:40 . 2010-03-12 21:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\Auslogics
2010-03-12 21:38 . 2010-03-12 22:34 -------- d-----w- c:\program files\Auslogics
2010-03-10 20:52 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-10 20:52 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-02-27 22:36 . 2010-02-27 22:36 -------- d-----w- c:\program files\Creative
2010-02-27 22:36 . 2002-06-06 13:38 139264 ----a-w- c:\windows\system32\eax.dll
2010-02-27 22:36 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-02-27 22:12 . 2010-02-27 22:37 -------- d-----w- c:\program files\Mafia
2010-02-27 22:12 . 2002-08-29 16:33 319488 ----a-r- c:\windows\system32\MafiaSetup.exe
2010-02-25 19:10 . 2010-03-12 22:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-25 19:10 . 2010-02-25 20:00 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-02-24 15:07 . 2010-02-25 19:35 -------- d-----w- c:\program files\Free Offers from Freeze.com
2010-02-22 18:34 . 2010-02-22 18:34 -------- d-----w- c:\program files\EA Sports
2010-02-22 12:31 . 2010-02-22 12:31 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-02-22 12:31 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-22 12:31 . 2010-02-22 12:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-22 12:31 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-22 12:31 . 2010-02-22 12:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-21 17:43 . 2010-02-21 17:43 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-02-21 13:04 . 2010-02-21 13:06 1048 ----a-w- c:\documents and settings\All Users\Application Data\fiosejgfse.dll
2010-02-21 12:44 . 2010-02-21 12:44 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-15 15:44 . 2010-03-08 19:39 -------- d-----w- C:\Projekty

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-14 15:06 . 2009-11-26 15:33 -------- d-----w- c:\program files\Cheat Engine
2010-03-14 14:53 . 2009-01-01 16:43 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype
2010-03-14 00:16 . 2009-11-14 23:01 -------- d-----w- c:\program files\Steam
2010-03-13 23:44 . 2009-01-01 16:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM
2010-03-13 20:53 . 2009-01-01 20:38 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-03-13 20:22 . 2008-12-22 15:23 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-13 15:23 . 2008-12-22 18:56 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-13 14:59 . 2009-04-12 19:02 -------- d-----w- c:\program files\EA Games
2010-03-12 22:23 . 2009-09-21 18:33 -------- d-----w- c:\program files\Activision
2010-03-12 20:59 . 2008-12-24 21:03 -------- d-----w- c:\program files\Rockstar Games
2010-02-28 18:14 . 2010-02-28 18:14 32 ----a-w- c:\documents and settings\All Users\Application Data\ezsid.dat
2010-02-23 13:55 . 2009-12-27 02:02 -------- d-----w- c:\program files\Charles
2010-02-22 19:10 . 2009-09-06 21:40 -------- d-----w- c:\program files\Oberon Media
2010-02-22 19:10 . 2009-08-15 22:43 -------- d-----w- c:\program files\DivX
2010-02-22 16:31 . 2009-04-17 13:03 -------- d-----w- c:\program files\Electronic Arts
2010-02-08 20:03 . 2010-02-08 20:01 -------- d-----w- c:\program files\Smokin' Guns
2010-01-29 22:58 . 2010-01-29 22:58 -------- d-----w- c:\program files\Mad Scientist Productions
2010-01-19 16:21 . 2009-04-12 19:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts
2010-01-19 16:20 . 2010-01-19 16:20 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-19 16:19 . 2010-01-19 16:21 38784 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-19 16:19 . 2010-01-19 16:20 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-18 14:44 . 2009-11-28 17:38 -------- d-----w- c:\program files\Farm Helper
2009-12-31 16:50 . 2004-08-04 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-23 20:23 . 2009-12-02 16:41 338 ----a-w- c:\documents and settings\Administrator\Application Data\settings.dat
2009-12-21 19:14 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2008-12-22 18:29 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-05-13 21:55 . 2009-05-13 21:55 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-13 21:55 . 2009-05-13 21:55 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-03-06 21:19 . 2008-12-22 15:27 88 --sh--r- c:\windows\system32\6F50A44ED8.sys
2009-03-06 21:19 . 2008-12-22 15:27 2984 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WheelMouse"="c:\msi\ADVANC~1\wh_exec.exe" [2007-09-13 90112]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-11 2054360]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-19 13762560]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-08 128512]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 12:43 69632 ------r- c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-09-20 14:35 202024 ----a-w- c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-11-25 21:10 135664 ----atw- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MGSysCtrl]
2008-06-23 12:25 794624 ----a-w- c:\program files\System Control Manager\MGSysCtrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2007-09-20 08:51 1836328 ----a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 14:57 153136 ----a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2009-08-19 13:40 13762560 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2009-08-19 13:40 86016 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2009-08-19 13:41 1657376 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-05-28 08:52 16862720 ------r- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11 25623336 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 15:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-02-20 11:05 1217872 ----a-w- c:\program files\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-07-25 03:23 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ServiceLayer"=3 (0x3)
"ProtexisLicensing"=2 (0x2)
"PnkBstrB"=2 (0x2)
"PnkBstrA"=2 (0x2)
"ose"=3 (0x3)
"NMIndexingService"=3 (0x3)
"Nero BackItUp Scheduler 3"=2 (0x2)
"MDM"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"Apache2.2"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"f:\\World of Wacraft\\World of Warcraft\\Launcher.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"f:\\World of Wacraft\\World of Warcraft\\BackgroundDownloader.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enGB-downloader.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enGB-downloader.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enGB-downloader.exe"=
"c:\\Program Files\\Empire Interactive\\FlatOut2\\FlatOut2.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enGB-downloader.exe"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MP.exe"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MPLite.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Activision\\Transformers - Revenge of the Fallen\\Transformers2.exe"=
"c:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"=
"c:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"=
"c:\\Program Files\\Codemasters\\OF Dragon Rising\\OFDR.exe"=
"c:\\Program Files\\Eidos\\Batman Arkham Asylum\\Binaries\\ShippingPC-BmGame.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\zero gear\\ZeroGear.bat"=
"c:\\Program Files\\Steam\\SteamApps\\common\\zero gear\\Server\\ZeroGearServer.exe"=
"c:\\Program Files\\Smokin' Guns\\smokinguns.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\red orchestra\\System\\RedOrchestra.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\EA Games\\Battlefield Vietnam\\bfvietnam.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:Blizzard2
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11. 9. 2009 6:23 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [11. 9. 2009 6:26 96408]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17. 2. 2010 10:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [17. 2. 2010 10:15 66632]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [11. 9. 2009 6:24 735960]
R3 enecir;ENE CIR Receiver;c:\windows\system32\drivers\enecir.sys [22. 12. 2008 16:01 54784]
R3 enecirhid;ENE CIR HID Receiver;c:\windows\system32\drivers\enecirhid.sys [22. 12. 2008 16:01 11264]
R3 enecirhidma;ENE CIR HIDmini Filter;c:\windows\system32\drivers\enecirhidma.sys [22. 12. 2008 16:01 5632]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [9. 6. 2008 2:23 56480]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [22. 12. 2008 16:02 51288]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [22. 12. 2008 16:02 43608]
R3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\drivers\whfltr2k.sys [25. 1. 2007 16:45 6784]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12. 4. 2009 19:13 721904]
S2 Micro Star SCM;Micro Star SCM;c:\program files\System Control Manager\MSIService.exe [22. 12. 2008 16:24 159744]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [17. 8. 2009 23:05 36608]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [17. 2. 2010 10:15 12872]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [22. 11. 2008 11:53 23064]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers\teamviewervpn.sys [25. 1. 2008 10:12 25088]
S4 Apache2.2;Apache2.2;"c:\mmopro repack\Server\apache\bin\apache.exe" -k runservice --> c:\mmopro repack\Server\apache\bin\apache.exe [?]
.
Contents of the 'Scheduled Tasks' folder

2010-03-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-03-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-616249376-725345543-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-25 21:10]

2010-03-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-616249376-725345543-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-25 21:10]

2010-03-14 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://facebook.com/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\6814iyal.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/resul ... EF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.wowhead.com
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/resul ... D32741}&q=
FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-14 16:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1004336348-616249376-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a1,52,b3,c7,37,b2,67,4a,af,e3,e0,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a1,52,b3,c7,37,b2,67,4a,af,e3,e0,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a1,52,b3,c7,37,b2,67,4a,af,e3,e0,\

[HKEY_USERS\S-1-5-21-1004336348-616249376-725345543-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:22,e4,af,b2,1c,64,c2,17,2b,58,5d,de,84,9e,7f,c3,72,bb,f5,2f,54,19,a2,
c8,36,85,2c,f4,22,7e,4b,e1,f2,9c,8f,73,a4,c6,dd,96,79,32,dd,04,c5,d2,8e,20,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22

[HKEY_USERS\S-1-5-21-1004336348-616249376-725345543-500\Software\SecuROM\License information*]
"datasecu"=hex:6d,b1,72,aa,a6,d9,3c,01,d9,e7,ab,38,c6,4f,53,90,13,69,35,34,a9,
6c,3c,dd,f8,8f,fa,d1,fb,f5,35,b6,0d,0b,15,99,84,81,16,ba,01,ef,a6,6c,5d,39,\
"rkeysecu"=hex:0a,da,72,43,f5,9a,ec,e3,2d,f0,2f,8c,19,b7,76,1e
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1652)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-03-14 16:10:09
ComboFix-quarantined-files.txt 2010-03-14 15:09

Pre-Run: 17 023 176 704 bytes free
Post-Run: 26 adresárov, 17 028 636 672 voľných bajtov

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 523652D5E41D69D7B27367B95E5B343C

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\windows\system32\6F50A44ED8.sys

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

ComboFix 10-03-13.03 - Administrator . 03. 2010 23:01:32.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3071.2619 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active


file zipped: c:\windows\system32\6F50A44ED8.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\6F50A44ED8.sys

.
((((((((((((((((((((((((( Files Created from 2010-02-14 to 2010-03-14 )))))))))))))))))))))))))))))))
.

2010-03-13 23:00 . 2010-03-13 23:00 -------- d-----w- c:\program files\trend micro
2010-03-13 23:00 . 2010-03-13 23:01 -------- d-----w- C:\rsit
2010-03-13 20:54 . 2010-03-13 20:54 52224 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-03-13 20:54 . 2010-03-13 20:54 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-03-13 20:54 . 2010-03-13 20:54 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-03-13 20:54 . 2010-03-13 20:54 18944 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
2010-03-13 20:53 . 2010-03-13 20:53 65024 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
2010-03-13 20:53 . 2010-03-13 20:53 5120 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF16.exe
2010-03-13 20:53 . 2010-03-13 20:53 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-03-13 20:53 . 2010-03-13 20:53 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-03-13 16:19 . 2010-03-13 16:19 4 ----a-w- C:\loadcounter.dat
2010-03-13 15:28 . 2010-03-13 15:28 553 ----a-w- c:\windows\eReg.dat
2010-03-13 12:12 . 2010-03-13 23:43 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc
2010-03-13 10:56 . 2010-03-14 11:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\Bioshock
2010-03-12 22:35 . 2010-03-12 22:35 -------- d-----w- c:\program files\VideoLAN
2010-03-12 21:59 . 2010-03-12 21:59 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-03-12 21:46 . 2010-03-12 21:46 -------- d-----w- c:\program files\2K Games
2010-03-12 21:40 . 2010-03-12 21:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\Auslogics
2010-03-12 21:38 . 2010-03-12 22:34 -------- d-----w- c:\program files\Auslogics
2010-03-10 20:52 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-10 20:52 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-02-27 22:36 . 2010-02-27 22:36 -------- d-----w- c:\program files\Creative
2010-02-27 22:36 . 2002-06-06 13:38 139264 ----a-w- c:\windows\system32\eax.dll
2010-02-27 22:36 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-02-27 22:12 . 2010-02-27 22:37 -------- d-----w- c:\program files\Mafia
2010-02-27 22:12 . 2002-08-29 16:33 319488 ----a-r- c:\windows\system32\MafiaSetup.exe
2010-02-25 19:10 . 2010-03-12 22:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-25 19:10 . 2010-02-25 20:00 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-02-24 15:07 . 2010-02-25 19:35 -------- d-----w- c:\program files\Free Offers from Freeze.com
2010-02-22 18:34 . 2010-02-22 18:34 -------- d-----w- c:\program files\EA Sports
2010-02-22 12:31 . 2010-02-22 12:31 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-02-22 12:31 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-22 12:31 . 2010-02-22 12:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-22 12:31 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-22 12:31 . 2010-02-22 12:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-21 17:43 . 2010-02-21 17:43 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-02-21 13:04 . 2010-02-21 13:06 1048 ----a-w- c:\documents and settings\All Users\Application Data\fiosejgfse.dll
2010-02-21 12:44 . 2010-02-21 12:44 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-15 15:44 . 2010-03-14 21:38 -------- d-----w- C:\Projekty

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-14 21:57 . 2009-01-01 16:43 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype
2010-03-14 16:40 . 2009-11-14 23:01 -------- d-----w- c:\program files\Steam
2010-03-14 15:06 . 2009-11-26 15:33 -------- d-----w- c:\program files\Cheat Engine
2010-03-13 23:44 . 2009-01-01 16:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM
2010-03-13 20:53 . 2009-01-01 20:38 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-03-13 20:22 . 2008-12-22 15:23 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-13 15:23 . 2008-12-22 18:56 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-13 14:59 . 2009-04-12 19:02 -------- d-----w- c:\program files\EA Games
2010-03-12 22:23 . 2009-09-21 18:33 -------- d-----w- c:\program files\Activision
2010-03-12 20:59 . 2008-12-24 21:03 -------- d-----w- c:\program files\Rockstar Games
2010-02-28 18:14 . 2010-02-28 18:14 32 ----a-w- c:\documents and settings\All Users\Application Data\ezsid.dat
2010-02-23 13:55 . 2009-12-27 02:02 -------- d-----w- c:\program files\Charles
2010-02-22 19:10 . 2009-09-06 21:40 -------- d-----w- c:\program files\Oberon Media
2010-02-22 19:10 . 2009-08-15 22:43 -------- d-----w- c:\program files\DivX
2010-02-22 16:31 . 2009-04-17 13:03 -------- d-----w- c:\program files\Electronic Arts
2010-02-08 20:03 . 2010-02-08 20:01 -------- d-----w- c:\program files\Smokin' Guns
2010-01-29 22:58 . 2010-01-29 22:58 -------- d-----w- c:\program files\Mad Scientist Productions
2010-01-19 16:21 . 2009-04-12 19:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts
2010-01-19 16:20 . 2010-01-19 16:20 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-19 16:19 . 2010-01-19 16:21 38784 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-19 16:19 . 2010-01-19 16:20 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-18 14:44 . 2009-11-28 17:38 -------- d-----w- c:\program files\Farm Helper
2009-12-31 16:50 . 2004-08-04 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-23 20:23 . 2009-12-02 16:41 338 ----a-w- c:\documents and settings\Administrator\Application Data\settings.dat
2009-12-21 19:14 . 2004-08-04 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2008-12-22 18:29 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-05-13 21:55 . 2009-05-13 21:55 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-13 21:55 . 2009-05-13 21:55 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-03-06 21:19 . 2008-12-22 15:27 2984 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-03-14_15.07.27 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-22 15:22 . 2010-03-10 21:51 23040 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 23040 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 61440 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 61440 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 27136 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 27136 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 11264 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 11264 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 86016 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 86016 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 12288 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 12288 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 4096 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 4096 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-11-05 11:02 . 2008-11-05 11:02 119296 c:\windows\Installer\9ae228.msp
+ 2008-12-22 15:22 . 2010-03-14 18:03 409600 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 409600 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 286720 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 286720 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 249856 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 249856 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 794624 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 794624 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 135168 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 135168 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 593920 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 593920 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\accicons.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WheelMouse"="c:\msi\ADVANC~1\wh_exec.exe" [2007-09-13 90112]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-11 2054360]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-19 13762560]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-08 128512]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 12:43 69632 ------r- c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-09-20 14:35 202024 ----a-w- c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-11-25 21:10 135664 ----atw- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MGSysCtrl]
2008-06-23 12:25 794624 ----a-w- c:\program files\System Control Manager\MGSysCtrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2007-09-20 08:51 1836328 ----a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 14:57 153136 ----a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2009-08-19 13:40 13762560 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2009-08-19 13:40 86016 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2009-08-19 13:41 1657376 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-05-28 08:52 16862720 ------r- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11 25623336 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 15:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-02-20 11:05 1217872 ----a-w- c:\program files\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-07-25 03:23 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ServiceLayer"=3 (0x3)
"ProtexisLicensing"=2 (0x2)
"PnkBstrB"=2 (0x2)
"PnkBstrA"=2 (0x2)
"ose"=3 (0x3)
"NMIndexingService"=3 (0x3)
"Nero BackItUp Scheduler 3"=2 (0x2)
"MDM"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"Apache2.2"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"f:\\World of Wacraft\\World of Warcraft\\Launcher.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"f:\\World of Wacraft\\World of Warcraft\\BackgroundDownloader.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enGB-downloader.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enGB-downloader.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enGB-downloader.exe"=
"c:\\Program Files\\Empire Interactive\\FlatOut2\\FlatOut2.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enGB-downloader.exe"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MP.exe"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MPLite.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Activision\\Transformers - Revenge of the Fallen\\Transformers2.exe"=
"c:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"=
"c:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"=
"c:\\Program Files\\Codemasters\\OF Dragon Rising\\OFDR.exe"=
"c:\\Program Files\\Eidos\\Batman Arkham Asylum\\Binaries\\ShippingPC-BmGame.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\zero gear\\ZeroGear.bat"=
"c:\\Program Files\\Steam\\SteamApps\\common\\zero gear\\Server\\ZeroGearServer.exe"=
"c:\\Program Files\\Smokin' Guns\\smokinguns.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\red orchestra\\System\\RedOrchestra.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\EA Games\\Battlefield Vietnam\\bfvietnam.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:Blizzard2
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11. 9. 2009 6:23 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [11. 9. 2009 6:26 96408]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17. 2. 2010 10:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [17. 2. 2010 10:15 66632]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [11. 9. 2009 6:24 735960]
R3 enecir;ENE CIR Receiver;c:\windows\system32\drivers\enecir.sys [22. 12. 2008 16:01 54784]
R3 enecirhid;ENE CIR HID Receiver;c:\windows\system32\drivers\enecirhid.sys [22. 12. 2008 16:01 11264]
R3 enecirhidma;ENE CIR HIDmini Filter;c:\windows\system32\drivers\enecirhidma.sys [22. 12. 2008 16:01 5632]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [9. 6. 2008 2:23 56480]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [22. 12. 2008 16:02 51288]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [22. 12. 2008 16:02 43608]
R3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\drivers\whfltr2k.sys [25. 1. 2007 16:45 6784]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12. 4. 2009 19:13 721904]
S2 Micro Star SCM;Micro Star SCM;c:\program files\System Control Manager\MSIService.exe [22. 12. 2008 16:24 159744]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [17. 8. 2009 23:05 36608]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [17. 2. 2010 10:15 12872]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [22. 11. 2008 11:53 23064]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers\teamviewervpn.sys [25. 1. 2008 10:12 25088]
S4 Apache2.2;Apache2.2;"c:\mmopro repack\Server\apache\bin\apache.exe" -k runservice --> c:\mmopro repack\Server\apache\bin\apache.exe [?]
.
Contents of the 'Scheduled Tasks' folder

2010-03-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-03-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-616249376-725345543-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-25 21:10]

2010-03-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-616249376-725345543-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-25 21:10]

2010-03-14 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://facebook.com/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\6814iyal.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/resul ... EF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.wowhead.com
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/resul ... D32741}&q=
FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-14 23:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1004336348-616249376-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a1,52,b3,c7,37,b2,67,4a,af,e3,e0,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a1,52,b3,c7,37,b2,67,4a,af,e3,e0,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a1,52,b3,c7,37,b2,67,4a,af,e3,e0,\

[HKEY_USERS\S-1-5-21-1004336348-616249376-725345543-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:22,e4,af,b2,1c,64,c2,17,2b,58,5d,de,84,9e,7f,c3,72,bb,f5,2f,54,19,a2,
c8,36,85,2c,f4,22,7e,4b,e1,f2,9c,8f,73,a4,c6,dd,96,79,32,dd,04,c5,d2,8e,20,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22

[HKEY_USERS\S-1-5-21-1004336348-616249376-725345543-500\Software\SecuROM\License information*]
"datasecu"=hex:6d,b1,72,aa,a6,d9,3c,01,d9,e7,ab,38,c6,4f,53,90,13,69,35,34,a9,
6c,3c,dd,f8,8f,fa,d1,fb,f5,35,b6,0d,0b,15,99,84,81,16,ba,01,ef,a6,6c,5d,39,\
"rkeysecu"=hex:0a,da,72,43,f5,9a,ec,e3,2d,f0,2f,8c,19,b7,76,1e
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1776)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-03-14 23:09:42
ComboFix-quarantined-files.txt 2010-03-14 22:09
ComboFix2.txt 2010-03-14 15:10

Pre-Run: 17 035 448 320 bytes free
Post-Run: 26 adresárov, 16 991 387 648 voľných bajtov

- - End Of File - - 90B48E0C06E964D56D187BD825DA5DBE
Upload was successful

Ještě jednou spusťte CF tímto skriptem:

Collect::
c:\documents and settings\All Users\Application Data\fiosejgfse.dll

Ok,dakujem Vam Rudy, budem pokracovat "zajtra" resp. po praci lebo dnes uz nemam cas..este raz dakujem

Dobry vecer, tu je ten log :

ComboFix 10-03-13.03 - Administrator . 03. 2010 18:31:54.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3071.2677 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active


file zipped: c:\documents and settings\All Users\Application Data\fiosejgfse.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\fiosejgfse.dll
C:\LOG.TXT

.
((((((((((((((((((((((((( Files Created from 2010-02-15 to 2010-03-15 )))))))))))))))))))))))))))))))
.

2010-03-13 23:00 . 2010-03-13 23:00 -------- d-----w- c:\program files\trend micro
2010-03-13 23:00 . 2010-03-13 23:01 -------- d-----w- C:\rsit
2010-03-13 20:54 . 2010-03-13 20:54 52224 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-03-13 20:54 . 2010-03-13 20:54 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-03-13 20:54 . 2010-03-13 20:54 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-03-13 20:54 . 2010-03-13 20:54 18944 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
2010-03-13 20:53 . 2010-03-13 20:53 65024 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
2010-03-13 20:53 . 2010-03-13 20:53 5120 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF16.exe
2010-03-13 20:53 . 2010-03-13 20:53 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-03-13 20:53 . 2010-03-13 20:53 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-03-13 16:19 . 2010-03-13 16:19 4 ----a-w- C:\loadcounter.dat
2010-03-13 15:28 . 2010-03-13 15:28 553 ----a-w- c:\windows\eReg.dat
2010-03-13 12:12 . 2010-03-15 11:59 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc
2010-03-13 10:56 . 2010-03-15 12:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\Bioshock
2010-03-12 22:35 . 2010-03-12 22:35 -------- d-----w- c:\program files\VideoLAN
2010-03-12 21:59 . 2010-03-12 21:59 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-03-12 21:46 . 2010-03-12 21:46 -------- d-----w- c:\program files\2K Games
2010-03-12 21:40 . 2010-03-12 21:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\Auslogics
2010-03-12 21:38 . 2010-03-12 22:34 -------- d-----w- c:\program files\Auslogics
2010-03-10 20:52 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-10 20:52 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-02-27 22:36 . 2010-02-27 22:36 -------- d-----w- c:\program files\Creative
2010-02-27 22:36 . 2002-06-06 13:38 139264 ----a-w- c:\windows\system32\eax.dll
2010-02-27 22:36 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-02-27 22:12 . 2010-02-27 22:37 -------- d-----w- c:\program files\Mafia
2010-02-27 22:12 . 2002-08-29 16:33 319488 ----a-r- c:\windows\system32\MafiaSetup.exe
2010-02-25 19:10 . 2010-03-12 22:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-25 19:10 . 2010-02-25 20:00 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-02-24 15:07 . 2010-02-25 19:35 -------- d-----w- c:\program files\Free Offers from Freeze.com
2010-02-22 18:34 . 2010-02-22 18:34 -------- d-----w- c:\program files\EA Sports
2010-02-22 12:31 . 2010-02-22 12:31 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-02-22 12:31 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-22 12:31 . 2010-02-22 12:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-22 12:31 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-22 12:31 . 2010-02-22 12:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-21 17:43 . 2010-02-21 17:43 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-02-21 12:44 . 2010-02-21 12:44 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-15 15:44 . 2010-03-14 21:38 -------- d-----w- C:\Projekty

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-15 17:28 . 2009-01-01 16:43 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype
2010-03-15 17:24 . 2009-01-01 16:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM
2010-03-14 16:40 . 2009-11-14 23:01 -------- d-----w- c:\program files\Steam
2010-03-14 15:06 . 2009-11-26 15:33 -------- d-----w- c:\program files\Cheat Engine
2010-03-13 20:53 . 2009-01-01 20:38 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-03-13 20:22 . 2008-12-22 15:23 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-13 15:23 . 2008-12-22 18:56 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-13 14:59 . 2009-04-12 19:02 -------- d-----w- c:\program files\EA Games
2010-03-12 22:23 . 2009-09-21 18:33 -------- d-----w- c:\program files\Activision
2010-03-12 20:59 . 2008-12-24 21:03 -------- d-----w- c:\program files\Rockstar Games
2010-02-28 18:14 . 2010-02-28 18:14 32 ----a-w- c:\documents and settings\All Users\Application Data\ezsid.dat
2010-02-23 13:55 . 2009-12-27 02:02 -------- d-----w- c:\program files\Charles
2010-02-22 19:10 . 2009-09-06 21:40 -------- d-----w- c:\program files\Oberon Media
2010-02-22 19:10 . 2009-08-15 22:43 -------- d-----w- c:\program files\DivX
2010-02-22 16:31 . 2009-04-17 13:03 -------- d-----w- c:\program files\Electronic Arts
2010-02-08 20:03 . 2010-02-08 20:01 -------- d-----w- c:\program files\Smokin' Guns
2010-01-29 22:58 . 2010-01-29 22:58 -------- d-----w- c:\program files\Mad Scientist Productions
2010-01-19 16:21 . 2009-04-12 19:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts
2010-01-19 16:20 . 2010-01-19 16:20 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-19 16:19 . 2010-01-19 16:21 38784 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-19 16:19 . 2010-01-19 16:20 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-18 14:44 . 2009-11-28 17:38 -------- d-----w- c:\program files\Farm Helper
2009-12-31 16:50 . 2004-08-04 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-23 20:23 . 2009-12-02 16:41 338 ----a-w- c:\documents and settings\Administrator\Application Data\settings.dat
2009-12-21 19:14 . 2004-08-04 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2008-12-22 18:29 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-05-13 21:55 . 2009-05-13 21:55 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-13 21:55 . 2009-05-13 21:55 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-03-06 21:19 . 2008-12-22 15:27 2984 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-03-14_15.07.27 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-22 15:22 . 2010-03-10 21:51 23040 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 23040 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 61440 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 61440 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 27136 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 27136 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 11264 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 11264 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 86016 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 86016 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 12288 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 12288 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 4096 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 4096 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-11-05 11:02 . 2008-11-05 11:02 119296 c:\windows\Installer\9ae228.msp
+ 2008-12-22 15:22 . 2010-03-14 18:03 409600 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 409600 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 286720 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 286720 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 249856 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 249856 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 794624 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 794624 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 135168 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 135168 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-12-22 15:22 . 2010-03-14 18:03 593920 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2008-12-22 15:22 . 2010-03-10 21:51 593920 c:\windows\Installer\{9011041B-6000-11D3-8CFE-0150048383C9}\accicons.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WheelMouse"="c:\msi\ADVANC~1\wh_exec.exe" [2007-09-13 90112]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-11 2054360]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-19 13762560]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-08 128512]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 12:43 69632 ------r- c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-09-20 14:35 202024 ----a-w- c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-11-25 21:10 135664 ----atw- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MGSysCtrl]
2008-06-23 12:25 794624 ----a-w- c:\program files\System Control Manager\MGSysCtrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2007-09-20 08:51 1836328 ----a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 14:57 153136 ----a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2009-08-19 13:40 13762560 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2009-08-19 13:40 86016 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2009-08-19 13:41 1657376 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-05-28 08:52 16862720 ------r- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11 25623336 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 15:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-02-20 11:05 1217872 ----a-w- c:\program files\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-07-25 03:23 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ServiceLayer"=3 (0x3)
"ProtexisLicensing"=2 (0x2)
"PnkBstrB"=2 (0x2)
"PnkBstrA"=2 (0x2)
"ose"=3 (0x3)
"NMIndexingService"=3 (0x3)
"Nero BackItUp Scheduler 3"=2 (0x2)
"MDM"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"Apache2.2"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"f:\\World of Wacraft\\World of Warcraft\\Launcher.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"f:\\World of Wacraft\\World of Warcraft\\BackgroundDownloader.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enGB-downloader.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enGB-downloader.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enGB-downloader.exe"=
"c:\\Program Files\\Empire Interactive\\FlatOut2\\FlatOut2.exe"=
"f:\\World of Wacraft\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enGB-downloader.exe"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MP.exe"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MPLite.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Activision\\Transformers - Revenge of the Fallen\\Transformers2.exe"=
"c:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"=
"c:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"=
"c:\\Program Files\\Codemasters\\OF Dragon Rising\\OFDR.exe"=
"c:\\Program Files\\Eidos\\Batman Arkham Asylum\\Binaries\\ShippingPC-BmGame.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\zero gear\\ZeroGear.bat"=
"c:\\Program Files\\Steam\\SteamApps\\common\\zero gear\\Server\\ZeroGearServer.exe"=
"c:\\Program Files\\Smokin' Guns\\smokinguns.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\red orchestra\\System\\RedOrchestra.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\EA Games\\Battlefield Vietnam\\bfvietnam.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:Blizzard2
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11. 9. 2009 6:23 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [11. 9. 2009 6:26 96408]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17. 2. 2010 10:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [17. 2. 2010 10:15 66632]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [11. 9. 2009 6:24 735960]
R3 enecir;ENE CIR Receiver;c:\windows\system32\drivers\enecir.sys [22. 12. 2008 16:01 54784]
R3 enecirhid;ENE CIR HID Receiver;c:\windows\system32\drivers\enecirhid.sys [22. 12. 2008 16:01 11264]
R3 enecirhidma;ENE CIR HIDmini Filter;c:\windows\system32\drivers\enecirhidma.sys [22. 12. 2008 16:01 5632]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [9. 6. 2008 2:23 56480]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [22. 12. 2008 16:02 51288]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [22. 12. 2008 16:02 43608]
R3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\drivers\whfltr2k.sys [25. 1. 2007 16:45 6784]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12. 4. 2009 19:13 721904]
S2 Micro Star SCM;Micro Star SCM;c:\program files\System Control Manager\MSIService.exe [22. 12. 2008 16:24 159744]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [17. 8. 2009 23:05 36608]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [17. 2. 2010 10:15 12872]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [22. 11. 2008 11:53 23064]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers\teamviewervpn.sys [25. 1. 2008 10:12 25088]
S4 Apache2.2;Apache2.2;"c:\mmopro repack\Server\apache\bin\apache.exe" -k runservice --> c:\mmopro repack\Server\apache\bin\apache.exe [?]
.
Contents of the 'Scheduled Tasks' folder

2010-03-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-03-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-616249376-725345543-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-25 21:10]

2010-03-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-616249376-725345543-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-25 21:10]

2010-03-15 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://facebook.com/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\6814iyal.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/resul ... EF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.wowhead.com
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/resul ... D32741}&q=
FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-15 18:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1004336348-616249376-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a1,52,b3,c7,37,b2,67,4a,af,e3,e0,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a1,52,b3,c7,37,b2,67,4a,af,e3,e0,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a1,52,b3,c7,37,b2,67,4a,af,e3,e0,\

[HKEY_USERS\S-1-5-21-1004336348-616249376-725345543-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:cf,67,5a,fc,36,74,80,5c,34,93,da,47,4c,fb,b2,49,29,0c,b4,74,ad,bc,b6,
a8,4d,f5,26,e1,1c,5f,a7,80,da,4a,c2,4f,78,71,ee,f4,0e,f4,6b,6e,96,fe,4b,56,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22

[HKEY_USERS\S-1-5-21-1004336348-616249376-725345543-500\Software\SecuROM\License information*]
"datasecu"=hex:6d,b1,72,aa,a6,d9,3c,01,d9,e7,ab,38,c6,4f,53,90,13,69,35,34,a9,
6c,3c,dd,f8,8f,fa,d1,fb,f5,35,b6,0d,0b,15,99,84,81,16,ba,01,ef,a6,6c,5d,39,\
"rkeysecu"=hex:0a,da,72,43,f5,9a,ec,e3,2d,f0,2f,8c,19,b7,76,1e
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1684)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-03-15 18:40:15
ComboFix-quarantined-files.txt 2010-03-15 17:40
ComboFix2.txt 2010-03-14 22:10
ComboFix3.txt 2010-03-14 15:10

Pre-Run: 16 950 661 120 bytes free
Post-Run: 26 adresárov, 16 909 914 112 voľných bajtov

- - End Of File - - FCAE4E5D9C4A67E6C0C6D9B61E9B8314
Upload was successful

Log již vypadá čistý. Nastala nějaká změna?

Velmi vyrazne zmeny som nepostrehol ale ta rychlost pc mohla byt sposobena aj inymi faktormi nez virusmi, tak dakujem

Zkuste ještě sken IceSword: http://www.viry.cz/forum/viewtopic.php?f=29&t=11394 . Dejte logy Process a Kernel Module.