Prosím o kontrolu-nedostanu se na stránky

Zpráva

Warden75 · #1 Příspěvek od **Warden75** » 25 úno 2010 13:38

Zdravím,neaktualizuje se mi nod32 a ani se nemohu dostat na stránky esetu

Prosím o kontrolu logu z Combofix

ComboFix 10-02-24.03 - MM 25.02.2010 13:28:36.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2043.1660 [GMT 1:00]
Spuštěný z: c:\documents and settings\MM\Plocha\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\1e00f0be.exe
c:\windows\system32\stacsv.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-25 do 2010-02-25 )))))))))))))))))))))))))))))))
.

2010-02-25 11:02 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-02-25 11:02 . 2009-11-25 10:19 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-02-25 11:02 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-02-25 11:02 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-02-25 11:02 . 2010-02-25 11:02 -------- d-----w- c:\program files\Avira
2010-02-25 09:09 . 2010-02-25 09:09 -------- d-----w- c:\program files\City Interactive
2010-02-24 17:53 . 2010-02-24 17:53 -------- d-----w- c:\windows\system32\wbem\Repository
2010-02-24 17:52 . 2010-02-24 17:52 -------- d-----w- c:\program files\Rockstar Games
2010-02-23 20:42 . 2010-02-24 17:52 -------- d-----w- c:\program files\NVIDIA Corporation
2010-02-23 20:41 . 2010-01-12 04:03 2283526 ----a-w- c:\windows\system32\nvdata.bin
2010-02-23 20:41 . 2010-02-23 20:41 -------- d-----w- C:\NVIDIA
2010-02-23 19:42 . 2010-02-23 19:42 -------- d-----w- c:\program files\Ubisoft
2010-02-20 08:50 . 2010-02-20 08:50 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-02-20 05:51 . 2010-02-20 05:51 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-02-20 05:51 . 2010-02-20 05:51 -------- d-----w- c:\program files\Common Files\wm
2010-02-20 04:45 . 2004-08-18 08:34 442368 ----a-r- c:\windows\system32\vp6vfw.dll
2010-02-13 19:49 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-13 19:49 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-13 19:49 . 2010-02-13 19:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-12 11:24 . 2010-02-12 11:24 -------- d-----w- c:\program files\Common Files\Java
2010-02-06 07:28 . 2010-02-06 07:28 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-06 06:37 . 2008-04-14 07:51 4255 ------w- c:\windows\system32\drivers\adv01nt5.dll
2010-02-06 06:36 . 2008-04-13 23:16 59136 ------w- c:\windows\system32\drivers\rfcomm.sys
2010-02-04 18:59 . 2010-02-04 20:02 -------- d-----w- c:\program files\Playlogic
2010-02-03 18:41 . 2010-02-09 21:11 -------- d-----w- c:\program files\Return to Castle Wolfenstein
2010-02-02 06:35 . 2010-02-02 06:36 -------- d-----w- c:\program files\The KMPlayer
2010-02-01 11:25 . 2010-02-01 12:24 -------- d-----w- c:\windows\system32\drivers\umdf
2010-02-01 11:24 . 2010-02-01 11:24 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-02-01 06:19 . 2010-02-01 06:19 -------- d-----w- c:\windows\WW2 Time of Wrath
2010-02-01 05:14 . 2010-02-01 05:14 -------- d-----w- c:\windows\65F1CF6331E0450B96F34A88BE7361A6.TMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-24 18:45 . 2009-10-09 07:48 -------- d-----w- c:\program files\Activision
2010-02-24 17:52 . 2009-10-08 14:49 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-23 20:42 . 2009-10-08 14:49 -------- d-----w- c:\program files\AGEIA Technologies
2010-02-20 13:23 . 2009-10-09 07:53 138464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-02-20 13:23 . 2009-10-09 07:52 111928 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-02-20 09:49 . 2009-10-08 15:09 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-12 11:24 . 2009-10-08 15:13 -------- d-----w- c:\program files\Java
2010-02-12 11:24 . 2001-10-25 14:00 78052 ----a-w- c:\windows\system32\perfc005.dat
2010-02-12 11:24 . 2001-10-25 14:00 429024 ----a-w- c:\windows\system32\perfh005.dat
2010-02-06 06:44 . 2009-10-08 14:32 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-06 06:44 . 2009-10-08 14:32 2740 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-02-01 13:44 . 2009-10-08 14:42 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-26 08:13 . 2010-01-26 08:13 -------- d-----w- c:\program files\OpenAL
2010-01-26 08:13 . 2009-10-16 17:05 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2010-01-26 08:13 . 2009-10-16 17:05 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2010-01-19 12:05 . 2009-10-09 07:52 682280 ----a-w- c:\windows\system32\pbsvc.exe
2010-01-19 12:05 . 2009-10-09 07:52 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-01-19 06:14 . 2009-10-08 15:12 -------- d-----w- c:\program files\CCleaner
2010-01-14 08:50 . 2010-01-14 08:49 475136 ------w- c:\windows\Setup1.exe
2010-01-14 08:50 . 2010-01-14 08:49 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-01-04 14:14 . 2010-01-04 14:14 -------- d-----w- c:\program files\Opera
2010-01-03 22:05 . 2010-01-03 22:05 -------- d-----w- c:\program files\Intelore
2010-01-02 17:15 . 2009-11-15 14:28 -------- d-----w- c:\program files\rajce
2009-12-31 16:50 . 2004-08-03 21:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2004-08-17 13:49 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-17 16:14 . 2009-10-08 15:13 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-17 07:42 . 2009-10-08 14:29 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2004-08-17 13:49 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 10:11 . 2004-08-17 13:45 2147328 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:11 . 2004-08-17 15:45 2025984 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2004-08-03 21:15 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-12-03 18:22 . 2009-12-03 18:23 737280 ----a-w- c:\windows\iun6002.exe
2009-11-27 17:14 . 2004-08-17 13:49 1294336 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:14 . 2004-08-17 15:49 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:09 . 2001-10-25 14:00 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:09 . 2001-10-24 12:25 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:09 . 2004-08-17 15:49 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:09 . 2004-08-17 13:49 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:09 . 2004-08-17 13:49 84992 ----a-w- c:\windows\system32\avifil32.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640]
"nwiz"="nwiz.exe" [2009-02-09 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-09 86016]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-07-15 458844]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11 25623336 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Nexon\\NEXON_EU_Downloader\\NEXON_EU_Downloader_Engine.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonEU\\NGM\\NGM.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MP.exe"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MPLite.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [25.2.2010 12:02 108289]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [8.10.2009 15:41 244368]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21.10.2009 16:21 691696]
.
Obsah adresáře 'Naplánované úlohy'

2010-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.novinky.cz/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
FF - ProfilePath - c:\documents and settings\MM\Data aplikací\Mozilla\Firefox\Profiles\de3wvenv.default\
FF - prefs.js: browser.startup.homepage - http://www.novinky.cz
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1220945662-764733703-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:b7,84,2b,69,40,05,ed,9e,75,57,dc,93,d6,5c,1f,2c,93,6c,77,dd,be,
04,4a,f7,5b,3b,3b,39,ff,dc,17,f7,9e,ab,16,47,8e,3c,e4,24,2a,88,4c,aa,7f,24,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
Celkový čas: 2010-02-25 13:31:50
ComboFix-quarantined-files.txt 2010-02-25 12:31

Před spuštěním: Volných bajtů: 174 848 995 328
Po spuštění: Volných bajtů: 174 852 005 888

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptOut

- - End Of File - - EBBC1629D45B705489976D8C7E0C7C69

#2 Příspěvek od **JaRon** » 25 úno 2010 13:53

no teda neviem v tomto logu po NOD-e ani chyru, ani slychu

bezi tam Avira - odinstaluj ju a skus NOD nainstalovat nanovo

Warden75 · #3 Příspěvek od **Warden75** » 26 úno 2010 19:38

Zkusil jsem znovu nainstalovat nod,nic aktualizace neběžely,na stránky esetu se vůbec nedostanu.Projel jsem to Avirou kzerá něco našla,ale problém trval.Navíc se nedostanu na další stránky kde by to mělo jít bez problému např. AB radio,Virus bulletin....Tak jsem to ted zkusil ještě projet kasperským a nic.......Malwerbytes taky nic nenašel....Tož nevím......

ComboFix 10-02-26.01 - MM 26.02.2010 19:22:51.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2043.1644 [GMT 1:00]
Spuštěný z: c:\documents and settings\MM\Plocha\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-01-26 do 2010-02-26 )))))))))))))))))))))))))))))))
.

2010-02-26 17:19 . 2010-02-26 17:19 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2010-02-26 17:19 . 2010-02-26 17:19 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2010-02-26 17:18 . 2010-02-26 17:18 -------- d-----w- c:\program files\Kaspersky Lab
2010-02-26 09:06 . 2010-02-26 09:06 -------- d-----w- c:\program files\Unlocker
2010-02-25 11:02 . 2009-11-25 10:19 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-02-25 09:09 . 2010-02-25 09:09 -------- d-----w- c:\program files\City Interactive
2010-02-24 17:53 . 2010-02-24 17:53 -------- d-----w- c:\windows\system32\wbem\Repository
2010-02-24 17:52 . 2010-02-24 17:52 -------- d-----w- c:\program files\Rockstar Games
2010-02-23 20:42 . 2010-02-24 17:52 -------- d-----w- c:\program files\NVIDIA Corporation
2010-02-23 20:41 . 2010-01-12 04:03 2283526 ----a-w- c:\windows\system32\nvdata.bin
2010-02-23 20:41 . 2010-02-23 20:41 -------- d-----w- C:\NVIDIA
2010-02-23 19:42 . 2010-02-23 19:42 -------- d-----w- c:\program files\Ubisoft
2010-02-20 08:50 . 2010-02-20 08:50 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-02-20 05:51 . 2010-02-20 05:51 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-02-20 05:51 . 2010-02-20 05:51 -------- d-----w- c:\program files\Common Files\wm
2010-02-20 04:45 . 2004-08-18 08:34 442368 ----a-r- c:\windows\system32\vp6vfw.dll
2010-02-13 19:49 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-13 19:49 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-13 19:49 . 2010-02-13 19:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-12 11:24 . 2010-02-12 11:24 -------- d-----w- c:\program files\Common Files\Java
2010-02-06 07:28 . 2010-02-06 07:28 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-06 06:37 . 2008-04-14 07:51 4255 ------w- c:\windows\system32\drivers\adv01nt5.dll
2010-02-06 06:36 . 2008-04-13 23:16 59136 ------w- c:\windows\system32\drivers\rfcomm.sys
2010-02-04 18:59 . 2010-02-04 20:02 -------- d-----w- c:\program files\Playlogic
2010-02-03 18:41 . 2010-02-09 21:11 -------- d-----w- c:\program files\Return to Castle Wolfenstein
2010-02-02 06:35 . 2010-02-02 06:36 -------- d-----w- c:\program files\The KMPlayer
2010-02-01 11:25 . 2010-02-01 12:24 -------- d-----w- c:\windows\system32\drivers\umdf
2010-02-01 11:24 . 2010-02-01 11:24 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-02-01 06:19 . 2010-02-01 06:19 -------- d-----w- c:\windows\WW2 Time of Wrath
2010-02-01 05:14 . 2010-02-01 05:14 -------- d-----w- c:\windows\65F1CF6331E0450B96F34A88BE7361A6.TMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-24 18:45 . 2009-10-09 07:48 -------- d-----w- c:\program files\Activision
2010-02-24 17:52 . 2009-10-08 14:49 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-23 20:42 . 2009-10-08 14:49 -------- d-----w- c:\program files\AGEIA Technologies
2010-02-20 13:23 . 2009-10-09 07:53 138464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-02-20 13:23 . 2009-10-09 07:52 111928 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-02-20 09:49 . 2009-10-08 15:09 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-12 11:24 . 2009-10-08 15:13 -------- d-----w- c:\program files\Java
2010-02-12 11:24 . 2001-10-25 14:00 78052 ----a-w- c:\windows\system32\perfc005.dat
2010-02-12 11:24 . 2001-10-25 14:00 429024 ----a-w- c:\windows\system32\perfh005.dat
2010-02-06 06:44 . 2009-10-08 14:32 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-06 06:44 . 2009-10-08 14:32 2740 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-02-01 13:44 . 2009-10-08 14:42 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-26 08:13 . 2010-01-26 08:13 -------- d-----w- c:\program files\OpenAL
2010-01-26 08:13 . 2009-10-16 17:05 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2010-01-26 08:13 . 2009-10-16 17:05 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2010-01-19 12:05 . 2009-10-09 07:52 682280 ----a-w- c:\windows\system32\pbsvc.exe
2010-01-19 12:05 . 2009-10-09 07:52 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-01-19 06:14 . 2009-10-08 15:12 -------- d-----w- c:\program files\CCleaner
2010-01-14 08:50 . 2010-01-14 08:49 475136 ------w- c:\windows\Setup1.exe
2010-01-14 08:50 . 2010-01-14 08:49 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-01-04 14:14 . 2010-01-04 14:14 -------- d-----w- c:\program files\Opera
2010-01-03 22:05 . 2010-01-03 22:05 -------- d-----w- c:\program files\Intelore
2010-01-02 17:15 . 2009-11-15 14:28 -------- d-----w- c:\program files\rajce
2009-12-31 16:50 . 2004-08-03 21:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2004-08-17 13:49 916480 ------w- c:\windows\system32\wininet.dll
2009-12-17 16:14 . 2009-10-08 15:13 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-17 07:42 . 2009-10-08 14:29 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2004-08-17 13:49 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 10:11 . 2004-08-17 13:45 2147328 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:11 . 2004-08-17 15:45 2025984 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2004-08-03 21:15 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-12-03 18:22 . 2009-12-03 18:23 737280 ----a-w- c:\windows\iun6002.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-02-25_12.30.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-26 18:27 . 2010-02-26 18:27 16384 c:\windows\Temp\Perflib_Perfdata_730.dat
+ 2009-09-09 18:01 . 2009-09-09 18:01 27675 c:\windows\system32\drivers\klopp.dat
+ 2009-10-02 18:39 . 2009-10-02 18:39 19472 c:\windows\system32\drivers\klmouflt.sys
+ 2009-09-14 13:42 . 2009-09-14 13:42 32272 c:\windows\system32\drivers\klim5.sys
+ 2009-10-14 20:18 . 2009-10-14 20:18 36880 c:\windows\system32\drivers\klbg.sys
+ 2010-02-01 12:23 . 2010-02-25 12:52 303104 c:\windows\system32\Restore\rstrlog.dat
+ 2009-10-20 19:34 . 2009-10-20 19:34 219664 c:\windows\system32\klogon.dll
+ 2010-02-26 17:18 . 2010-02-26 17:23 315408 c:\windows\system32\drivers\klif.sys
+ 2009-09-01 14:29 . 2009-09-01 14:29 128016 c:\windows\system32\drivers\kl1.sys
+ 2010-02-26 17:19 . 2010-02-26 17:19 3400704 c:\windows\Installer\2c35b.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640]
"nwiz"="nwiz.exe" [2009-02-09 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-09 86016]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-07-15 458844]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2009-10-26 15872]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" [2009-10-20 340456]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11 25623336 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Nexon\\NEXON_EU_Downloader\\NEXON_EU_Downloader_Engine.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonEU\\NGM\\NGM.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MP.exe"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MPLite.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [14.10.2009 21:18 36880]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21.10.2009 16:21 691696]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [8.10.2009 15:41 244368]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [14.9.2009 14:42 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2.10.2009 19:39 19472]
.
Obsah adresáře 'Naplánované úlohy'

2010-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.novinky.cz/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
FF - ProfilePath - c:\documents and settings\MM\Data aplikací\Mozilla\Firefox\Profiles\de3wvenv.default\
FF - prefs.js: browser.startup.homepage - www.novinky.cz
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-26 19:28
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys prosync1.sys hal.dll sfsync02.sys atapi.sys spvc.sys >>UNKNOWN [0x8A63A938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba12cf28
\Driver\ACPI -> ACPI.sys @ 0xb9e74cb8
\Driver\atapi -> prosync1.sys @ 0xba5b0661
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Intel(R) 82567LF-2 Gigabit Network Connection -> SendCompleteHandler -> NDIS.sys @ 0xb9d12bb0
PacketIndicateHandler -> NDIS.sys @ 0xb9d1fa21
SendHandler -> NDIS.sys @ 0xb9cfd87b
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1220945662-764733703-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:b7,84,2b,69,40,05,ed,9e,75,57,dc,93,d6,5c,1f,2c,93,6c,77,dd,be,
04,4a,f7,5b,3b,3b,39,ff,dc,17,f7,9e,ab,16,47,8e,3c,e4,24,2a,88,4c,aa,7f,24,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(1944)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\idt\wdm\STacSV.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2010-02-26 19:31:57 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-02-26 18:31
ComboFix2.txt 2010-02-25 12:31

Před spuštěním: Volných bajtů: 182 175 125 504
Po spuštění: Volných bajtů: 182 077 763 584

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptOut

- - End Of File - - 3EE6840B1081BFD6EA7B4BA8625305B6

Warden75 · #4 Příspěvek od **Warden75** » 26 úno 2010 20:00

MBAM log

Malwarebytes' Anti-Malware 1.44
Verze databáze: 3796
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

26.2.2010 19:58:16
mbam-log-2010-02-26 (19-58-16).txt

Typ kontroly: Kompletní kontrola (C:\|D:\|)
Zkontrolované objekty: 170777
Uplynulý čas: 17 minute(s), 1 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)

Warden75 · #5 Příspěvek od **Warden75** » 28 úno 2010 14:17

Mrkl by se na to někdo prosím?
Díky

#6 Příspěvek od **motji** » 01 bře 2010 20:50

Dobrý večer

Záskok za kolegu

Stahněte a použijte
http://go.microsoft.com/?linkid=9668866
-restartujte počítač a zkuste, zda se na stránky Esetu dostanete.

Poprosím o nový log ze rsitu

Warden75 · #7 Příspěvek od **Warden75** » 01 bře 2010 21:07

Dobrý večer,
tak jsem to zkusil a nic.Zde je RSIT log

Logfile of random's system information tool 1.06 (written by random/random)
Run by MM at 2010-03-01 21:04:53
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 159 GB (40%) free of 400 GB
Total RAM: 2043 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:05:08, on 1.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\wdm\STacSV.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe
C:\Documents and Settings\MM\Plocha\RSIT.exe
C:\Program Files\trend micro\MM.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.novinky.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\STacSV.exe

--
End of file - 5841 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll [2009-10-20 68112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-01-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll [2009-10-20 268816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-01-11 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-10-30 1019336]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-02-09 13680640]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-02-09 86016]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2009-07-01 37888]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2009-07-15 458844]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"UnlockerAssistant"=C:\Program Files\Unlocker\UnlockerAssistant.exe [2009-10-26 15872]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe [2009-10-20 340456]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2009-10-20 219664]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe"="C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe:*:Enabled:NEXON_EU_Downloader_Engine"
"C:\Documents and Settings\All Users\Data aplikací\NexonEU\NGM\NGM.exe"="C:\Documents and Settings\All Users\Data aplikací\NexonEU\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Activision\Wolfenstein\MP\Wolf2MP.exe"="C:\Program Files\Activision\Wolfenstein\MP\Wolf2MP.exe:*:Enabled:Wolfenstein(TM) "
"C:\Program Files\Activision\Wolfenstein\MP\Wolf2MPLite.exe"="C:\Program Files\Activision\Wolfenstein\MP\Wolf2MPLite.exe:*:Enabled:Wolfenstein(TM) "
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe"="C:\Program Files\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe:*:Enabled:Battlefield: Bad Company™ 2"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Combat Arms EU\CombatArms.exe"="D:\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe"
"D:\Combat Arms EU\Engine.exe"="D:\Combat Arms EU\Engine.exe:*Enabled:Engine.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-03-01 21:04:53 ----D---- C:\rsit
2010-03-01 21:04:53 ----D---- C:\Program Files\trend micro
2010-02-28 20:31:17 ----D---- C:\Documents and Settings\All Users\Data aplikací\Ubisoft
2010-02-28 20:21:15 ----D---- C:\Documents and Settings\MM\Data aplikací\InstallShield
2010-02-28 11:55:29 ----A---- C:\WINDOWS\system32\pbsvc_bc2.exe
2010-02-28 11:22:37 ----A---- C:\WINDOWS\system32\XAudio2_6.dll
2010-02-28 11:22:37 ----A---- C:\WINDOWS\system32\XAPOFX1_4.dll
2010-02-28 11:22:37 ----A---- C:\WINDOWS\system32\xactengine3_6.dll
2010-02-28 11:22:36 ----A---- C:\WINDOWS\system32\X3DAudio1_7.dll
2010-02-28 11:20:39 ----HD---- C:\WINDOWS\msdownld.tmp
2010-02-28 07:40:51 ----SHD---- C:\RECYCLER
2010-02-26 19:21:51 ----RASHD---- C:\cmdcons
2010-02-26 18:18:22 ----D---- C:\Program Files\Kaspersky Lab
2010-02-26 18:18:22 ----D---- C:\Documents and Settings\All Users\Data aplikací\Kaspersky Lab
2010-02-26 18:13:03 ----D---- C:\Documents and Settings\All Users\Data aplikací\Kaspersky Lab Setup Files
2010-02-26 10:06:54 ----D---- C:\Program Files\Unlocker
2010-02-25 13:27:29 ----A---- C:\Boot.bak
2010-02-25 13:26:29 ----A---- C:\WINDOWS\zip.exe
2010-02-25 13:26:29 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-02-25 13:26:29 ----A---- C:\WINDOWS\SWSC.exe
2010-02-25 13:26:29 ----A---- C:\WINDOWS\SWREG.exe
2010-02-25 13:26:29 ----A---- C:\WINDOWS\sed.exe
2010-02-25 13:26:29 ----A---- C:\WINDOWS\PEV.exe
2010-02-25 13:26:29 ----A---- C:\WINDOWS\NIRCMD.exe
2010-02-25 13:26:29 ----A---- C:\WINDOWS\MBR.exe
2010-02-25 13:26:29 ----A---- C:\WINDOWS\grep.exe
2010-02-25 13:26:08 ----D---- C:\WINDOWS\ERDNT
2010-02-25 10:09:52 ----D---- C:\Program Files\City Interactive
2010-02-24 18:52:16 ----D---- C:\Program Files\Rockstar Games
2010-02-24 08:32:19 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-02-23 21:42:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\NVIDIA Corporation
2010-02-23 21:42:01 ----D---- C:\Program Files\NVIDIA Corporation
2010-02-23 21:41:19 ----D---- C:\NVIDIA
2010-02-23 21:12:06 ----DC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$
2010-02-23 20:42:44 ----D---- C:\Program Files\Ubisoft
2010-02-20 09:50:47 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-02-20 09:50:23 ----D---- C:\Program Files\Adobe
2010-02-20 06:51:53 ----D---- C:\Program Files\Common Files\wm
2010-02-20 05:45:10 ----RA---- C:\WINDOWS\system32\vp6vfw.dll
2010-02-13 20:49:57 ----D---- C:\Documents and Settings\MM\Data aplikací\Malwarebytes
2010-02-13 20:49:52 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-02-13 20:49:51 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-02-12 12:24:51 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sun
2010-02-12 12:24:50 ----D---- C:\Program Files\Common Files\Java
2010-02-12 12:24:37 ----A---- C:\WINDOWS\system32\javaws.exe
2010-02-12 12:24:37 ----A---- C:\WINDOWS\system32\javaw.exe
2010-02-12 12:24:37 ----A---- C:\WINDOWS\system32\java.exe
2010-02-10 05:16:29 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-10 05:16:24 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-10 05:15:29 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-10 05:15:26 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-10 05:15:21 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-10 05:15:17 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-10 05:15:12 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-10 05:15:07 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-10 05:14:59 ----HDC---- C:\WINDOWS\$NtUninstallKB977165$
2010-02-07 07:17:54 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2010-02-07 07:17:41 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2010-02-06 08:28:05 ----D---- C:\WINDOWS\Prefetch
2010-02-06 08:25:26 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2010-02-06 08:24:41 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2010-02-06 08:23:55 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2010-02-06 08:23:08 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2010-02-06 08:22:20 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2010-02-06 08:21:35 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2010-02-06 08:20:49 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2010-02-06 08:20:03 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2010-02-06 08:19:17 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2010-02-06 08:18:30 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2010-02-06 08:17:46 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2010-02-06 08:16:59 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$
2010-02-06 08:16:13 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-02-06 08:15:26 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2010-02-06 08:14:40 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2010-02-06 08:13:54 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2010-02-06 08:13:06 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2010-02-06 08:12:19 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-02-06 08:11:34 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2010-02-06 08:10:50 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2010-02-06 08:10:06 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2010-02-06 08:09:20 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2010-02-06 08:08:34 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2010-02-06 08:07:48 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2010-02-06 08:07:03 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2010-02-06 08:06:19 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$
2010-02-06 08:05:30 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2010-02-06 08:04:40 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2010-02-06 08:03:54 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2010-02-06 08:03:08 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2010-02-06 08:02:23 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2010-02-06 08:01:39 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2010-02-06 08:00:54 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2010-02-06 08:00:10 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2010-02-06 07:59:23 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2010-02-06 07:58:38 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2010-02-06 07:57:52 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2010-02-06 07:57:03 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2010-02-06 07:56:16 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-02-06 07:55:31 ----HDC---- C:\WINDOWS\$NtUninstallKB973687_1$
2010-02-06 07:54:45 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2010-02-06 07:54:01 ----HDC---- C:\WINDOWS\$NtUninstallKB974112_1$
2010-02-06 07:53:17 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2010-02-06 07:52:34 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2010-02-06 07:51:50 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2010-02-06 07:51:01 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2010-02-06 07:50:15 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2010-02-06 07:49:31 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2010-02-06 07:48:47 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2010-02-06 07:48:02 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2010-02-06 07:47:20 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2010-02-06 07:46:33 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2010-02-06 07:45:50 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2010-02-06 07:45:04 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2010-02-06 07:42:47 ----N---- C:\WINDOWS\system32\smtpapi.dll
2010-02-06 07:42:47 ----N---- C:\WINDOWS\system32\rwnh.dll
2010-02-06 07:42:47 ----N---- C:\WINDOWS\system32\comsdupd.exe
2010-02-06 07:42:45 ----N---- C:\WINDOWS\system32\azroles.dll
2010-02-06 07:42:45 ----N---- C:\WINDOWS\system32\ativvaxx.dll
2010-02-06 07:42:45 ----N---- C:\WINDOWS\system32\ativtmxx.dll
2010-02-06 07:42:45 ----N---- C:\WINDOWS\system32\ati3duag.dll
2010-02-06 07:42:45 ----N---- C:\WINDOWS\system32\ati3d1ag.dll
2010-02-06 07:42:45 ----N---- C:\WINDOWS\system32\ati2dvag.dll
2010-02-06 07:42:45 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
2010-02-06 07:42:45 ----N---- C:\WINDOWS\system32\ati2cqag.dll
2010-02-06 07:42:45 ----N---- C:\WINDOWS\system32\aaclient.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\eapsvc.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\eapqec.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\eappprxy.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\eapphost.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\eappgnui.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\eappcfg.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\eapp3hst.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\eapolqec.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\dot3ui.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\dot3svc.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\dot3msm.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\dot3dlg.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\dot3cfg.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\dot3api.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\dimsroam.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\dimsntfy.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\dhcpqec.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\credssp.dll
2010-02-06 07:42:44 ----N---- C:\WINDOWS\system32\bitsprx4.dll
2010-02-06 07:42:43 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
2010-02-06 07:42:42 ----N---- C:\WINDOWS\system32\l2gpstore.dll
2010-02-06 07:42:42 ----N---- C:\WINDOWS\system32\kmsvc.dll
2010-02-06 07:42:42 ----N---- C:\WINDOWS\system32\kbdpash.dll
2010-02-06 07:42:42 ----N---- C:\WINDOWS\system32\kbdnepr.dll
2010-02-06 07:42:42 ----N---- C:\WINDOWS\system32\kbdiultn.dll
2010-02-06 07:42:42 ----N---- C:\WINDOWS\system32\kbdbhc.dll
2010-02-06 07:42:41 ----N---- C:\WINDOWS\system32\napmontr.dll
2010-02-06 07:42:41 ----N---- C:\WINDOWS\system32\napipsec.dll
2010-02-06 07:42:41 ----N---- C:\WINDOWS\system32\mtxparhd.dll
2010-02-06 07:42:41 ----N---- C:\WINDOWS\system32\msshavmsg.dll
2010-02-06 07:42:41 ----N---- C:\WINDOWS\system32\mssha.dll
2010-02-06 07:42:41 ----N---- C:\WINDOWS\system32\mmcperf.exe
2010-02-06 07:42:41 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
2010-02-06 07:42:41 ----N---- C:\WINDOWS\system32\mmcex.dll
2010-02-06 07:42:41 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2010-02-06 07:42:41 ----N---- C:\WINDOWS\system32\mdmxsdk.dll
2010-02-06 07:42:40 ----N---- C:\WINDOWS\system32\rhttpaa.dll
2010-02-06 07:42:40 ----N---- C:\WINDOWS\system32\rasqec.dll
2010-02-06 07:42:40 ----N---- C:\WINDOWS\system32\qutil.dll
2010-02-06 07:42:40 ----N---- C:\WINDOWS\system32\qcliprov.dll
2010-02-06 07:42:40 ----N---- C:\WINDOWS\system32\qagentrt.dll
2010-02-06 07:42:40 ----N---- C:\WINDOWS\system32\qagent.dll
2010-02-06 07:42:40 ----N---- C:\WINDOWS\system32\onex.dll
2010-02-06 07:42:40 ----N---- C:\WINDOWS\system32\napstat.exe
2010-02-06 07:42:39 ----N---- C:\WINDOWS\system32\slserv.exe
2010-02-06 07:42:39 ----N---- C:\WINDOWS\system32\slrundll.exe
2010-02-06 07:42:39 ----N---- C:\WINDOWS\system32\slgen.dll
2010-02-06 07:42:39 ----N---- C:\WINDOWS\system32\slextspk.dll
2010-02-06 07:42:39 ----N---- C:\WINDOWS\system32\slcoinst.dll
2010-02-06 07:42:39 ----N---- C:\WINDOWS\system32\setupn.exe
2010-02-06 07:42:39 ----N---- C:\WINDOWS\system32\s3gnb.dll
2010-02-06 07:42:38 ----N---- C:\WINDOWS\system32\tspkg.dll
2010-02-06 07:42:38 ----N---- C:\WINDOWS\system32\tsgqec.dll
2010-02-06 07:42:37 ----N---- C:\WINDOWS\system32\wlanapi.dll
2010-02-06 07:42:36 ----N---- C:\WINDOWS\slrundll.exe
2010-02-06 07:42:35 ----D---- C:\WINDOWS\system32\cs
2010-02-06 07:42:35 ----D---- C:\WINDOWS\l2schemas
2010-02-06 07:42:34 ----D---- C:\WINDOWS\system32\bits
2010-02-06 07:37:09 ----D---- C:\WINDOWS\network diagnostic
2010-02-06 07:35:30 ----A---- C:\WINDOWS\002927_.tmp
2010-02-06 07:33:52 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2010-02-04 19:59:18 ----D---- C:\Program Files\Playlogic
2010-02-03 19:41:32 ----D---- C:\Program Files\Return to Castle Wolfenstein
2010-02-02 09:40:34 ----D---- C:\Documents and Settings\MM\Data aplikací\Help
2010-02-02 07:35:21 ----D---- C:\Program Files\The KMPlayer

======List of files/folders modified in the last 1 months======

2010-03-01 21:04:53 ----RD---- C:\Program Files
2010-03-01 21:01:42 ----D---- C:\WINDOWS\Temp
2010-03-01 21:01:41 ----D---- C:\Program Files\Mozilla Firefox
2010-03-01 21:00:38 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-01 20:59:43 ----SHD---- C:\WINDOWS\Installer
2010-03-01 20:59:39 ----D---- C:\Config.Msi
2010-03-01 19:13:24 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2010-03-01 05:07:21 ----D---- C:\WINDOWS
2010-02-28 22:11:27 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-28 20:31:04 ----D---- C:\WINDOWS\system32\DirectX
2010-02-28 20:31:03 ----HD---- C:\WINDOWS\inf
2010-02-28 20:30:54 ----RSD---- C:\WINDOWS\assembly
2010-02-28 20:21:30 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-28 16:21:00 ----SD---- C:\WINDOWS\Tasks
2010-02-28 16:00:36 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-02-28 15:14:09 ----A---- C:\WINDOWS\NeroDigital.ini
2010-02-28 12:19:59 ----D---- C:\WINDOWS\system32
2010-02-28 11:55:29 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2010-02-28 11:46:26 ----D---- C:\Program Files\Electronic Arts
2010-02-28 11:45:23 ----D---- C:\WINDOWS\WinSxS
2010-02-28 07:35:19 ----D---- C:\Documents and Settings\MM\Data aplikací\Facebook
2010-02-26 19:32:00 ----D---- C:\WINDOWS\system32\drivers
2010-02-26 19:27:25 ----A---- C:\WINDOWS\system.ini
2010-02-26 19:26:20 ----D---- C:\WINDOWS\system32\config
2010-02-26 19:25:00 ----D---- C:\WINDOWS\AppPatch
2010-02-26 19:24:51 ----D---- C:\Program Files\Common Files
2010-02-26 19:22:08 ----RASH---- C:\boot.ini
2010-02-26 18:20:29 ----SHD---- C:\System Volume Information
2010-02-25 17:22:25 ----D---- C:\Documents and Settings\MM\Data aplikací\Skype
2010-02-25 16:54:21 ----D---- C:\Documents and Settings\MM\Data aplikací\skypePM
2010-02-25 06:22:18 ----HDC---- C:\WINDOWS\$NtUninstallKB911564$
2010-02-25 05:39:24 ----D---- C:\WINDOWS\ShellNew
2010-02-24 19:45:24 ----D---- C:\Program Files\Activision
2010-02-24 19:00:05 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-24 18:59:03 ----D---- C:\WINDOWS\system32\CatRoot
2010-02-24 18:53:03 ----D---- C:\WINDOWS\system32\wbem
2010-02-24 18:53:03 ----D---- C:\WINDOWS\Registration
2010-02-24 18:52:10 ----D---- C:\WINDOWS\Help
2010-02-24 18:52:01 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-02-24 08:32:27 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-24 07:30:51 ----D---- C:\WINDOWS\Microsoft.NET
2010-02-23 21:42:44 ----D---- C:\Program Files\AGEIA Technologies
2010-02-23 21:42:08 ----D---- C:\WINDOWS\nview
2010-02-23 21:11:55 ----D---- C:\WINDOWS\system32\XPSViewer
2010-02-23 21:11:55 ----D---- C:\WINDOWS\system32\cs-CZ
2010-02-23 21:11:45 ----D---- C:\WINDOWS\system32\mui
2010-02-20 10:49:15 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2010-02-20 10:49:12 ----D---- C:\Program Files\Common Files\Adobe
2010-02-20 10:11:54 ----D---- C:\WINDOWS\system32\Restore
2010-02-20 09:50:49 ----D---- C:\Documents and Settings\MM\Data aplikací\Adobe
2010-02-12 12:24:36 ----D---- C:\Program Files\Java
2010-02-12 12:24:11 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-02-11 17:02:00 ----D---- C:\Documents and Settings\MM\Data aplikací\uTorrent
2010-02-10 05:27:26 ----D---- C:\WINDOWS\Debug
2010-02-06 08:27:49 ----D---- C:\WINDOWS\system32\Setup
2010-02-06 08:27:48 ----RSD---- C:\WINDOWS\Fonts
2010-02-06 08:27:00 ----D---- C:\WINDOWS\security
2010-02-06 08:18:11 ----D---- C:\Program Files\Outlook Express
2010-02-06 07:46:58 ----D---- C:\Program Files\Messenger
2010-02-06 07:42:49 ----D---- C:\WINDOWS\ehome
2010-02-06 07:42:47 ----D---- C:\WINDOWS\system32\inetsrv
2010-02-06 07:42:46 ----D---- C:\WINDOWS\ime
2010-02-06 07:42:36 ----D---- C:\WINDOWS\system32\usmt
2010-02-06 07:42:35 ----D---- C:\Program Files\Internet Explorer
2010-02-06 07:42:34 ----D---- C:\WINDOWS\PeerNet
2010-02-06 07:42:34 ----D---- C:\Program Files\Movie Maker
2010-02-06 07:39:22 ----D---- C:\WINDOWS\ServicePackFiles
2010-02-06 07:39:06 ----D---- C:\WINDOWS\system32\npp
2010-02-06 07:39:05 ----D---- C:\WINDOWS\msagent
2010-02-06 07:39:04 ----D---- C:\WINDOWS\srchasst
2010-02-06 07:39:03 ----D---- C:\Program Files\NetMeeting
2010-02-06 07:39:02 ----D---- C:\WINDOWS\system32\Com
2010-02-06 07:38:59 ----D---- C:\Program Files\Windows Media Player
2010-02-06 07:38:58 ----D---- C:\Program Files\Windows NT
2010-02-06 07:38:55 ----D---- C:\Program Files\Common Files\System
2010-02-06 07:38:38 ----D---- C:\WINDOWS\system32\oobe
2010-02-06 07:38:36 ----D---- C:\WINDOWS\system
2010-02-06 07:35:28 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-02-05 11:51:33 ----D---- C:\Documents and Settings\MM\Data aplikací\Ubisoft
2010-02-05 05:28:20 ----D---- C:\WINDOWS\Minidump
2010-02-02 09:40:34 ----D---- C:\Program Files\WinRAR

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 kl1;Kl1; \??\C:\WINDOWS\system32\drivers\kl1.sys []
R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2010-02-26 315408]
R1 prodrv06;StarForce Protection Environment Driver v6; C:\WINDOWS\System32\drivers\prodrv06.sys [2003-10-10 52128]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2009-10-09 281760]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2009-10-09 25888]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver; C:\WINDOWS\system32\DRIVERS\e1y5132.sys [2008-06-20 244368]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2009-09-14 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-02-09 6307328]
R3 STHDA;IDT High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2009-07-15 1644019]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 a1im3f41;a1im3f41; C:\WINDOWS\system32\drivers\a1im3f41.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 NAL;Nal Service ; \??\C:\WINDOWS\system32\Drivers\iqvw32.sys []
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AVP;Kaspersky Anti-Virus; C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe [2009-10-20 340456]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-12-17 153376]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-02-09 163908]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-02-28 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2010-03-01 215128]
R2 STacSV;Audio Service; c:\program files\idt\wdm\STacSV.exe [2009-07-15 221266]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

#8 Příspěvek od **motji** » 01 bře 2010 21:26

Takže na www.eset.com se nedostanete?

Stáhněte SecurityCheck http://screen317.spywareinfoforum.org/SecurityCheck.exe
-program spusťte a postupujte podle instrukcí. Log vložte zde

Warden75 · #9 Příspěvek od **Warden75** » 01 bře 2010 21:34

Nedostanu se na eset,ab radio,virus bulletin,freedrweb.com co jsem zatím tak zjistil.Zbytek zatím jede.....tak nevím no....

Results of screen317's Security Check version 0.99.1
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:
Kaspersky Anti-Virus 2010
Kaspersky Anti-Virus 2010
Antivirus up to date!
``````````````````````````````
Anti-malware/Other Utilities Check:
Spybot - Search & Destroy
HijackThis 2.0.2
CCleaner
Java(TM) 6 Update 18
Java Auto Updater
Out of date Java installed!
Adobe Flash Player 10
Adobe Reader 9.1
``````````````````````````````
Process Check:
objlist.exe by Laurent
Kaspersky Lab Kaspersky Anti-Virus 2010 avp.exe
Kaspersky Lab Kaspersky Anti-Virus 2010 avp.exe
Kaspersky Lab Kaspersky Anti-Virus 2010 klwtblfs.exe
``````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

`````````End of Log```````````

#10 Příspěvek od **motji** » 01 bře 2010 21:38

odinstalujte všechny virtuální jednotky (Daemon nebo alcohol)

Stáhněte SPTD http://www.duplexsecure.com/en/downloads
-vyberte verzi podle svého operačního systému. SPTD for Windows (32 bit) nebo (64b)
-uložte na plochu a spusťte
- zvolte možnost Uninstall
- restart PC
- spusťte gmer

Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, kliknete na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu proveďte druhý sken a log sem také vložte.

stáhněte MBR
http://www2.gmer.net/mbr/mbr.exe
-uložte ho na plochu

start-spustit
do okénka zkopírujte

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

ok

vytvoří se log s názvem mbr.log, vložte ho zde [/quote]

Warden75 · #11 Příspěvek od **Warden75** » 02 bře 2010 07:04

Kurnik jsem myslel,že ten druhý scan z Gmeru nedám...Nejdřív trval asi 3 hodiny a pak mi klekl comp.....Pak mi to několikrát během scanu zmrzlo a musel jsem restartovat pc....Ale nakonec ho mám

Log 1

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-03-02 06:37:39
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\MM\LOCALS~1\Temp\pxtdypob.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateKey [0xB6F06ECA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xB6F06F74]

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

---- EOF - GMER 1.0.15 ----

Warden75 · #12 Příspěvek od **Warden75** » 02 bře 2010 07:05

Log 2

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-02 07:01:02
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\MM\LOCALS~1\Temp\pxtdypob.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwAdjustPrivilegesToken [0xB6F0758C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwClose [0xB6F07E0C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwConnectPort [0xB6F08922]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateEvent [0xB6F08E94]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateFile [0xB6F080EE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateKey [0xB6F06436]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateMutant [0xB6F08D6C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateNamedPipeFile [0xB6F07192]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreatePort [0xB6F08C28]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSection [0xB6F0734E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSemaphore [0xB6F08FC6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xB6F0AC08]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateThread [0xB6F07AAA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateWaitablePort [0xB6F08CCA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDebugActiveProcess [0xB6F0A5FA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeleteKey [0xB6F069FA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeleteValueKey [0xB6F06D88]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeviceIoControlFile [0xB6F08576]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDuplicateObject [0xB6F0B5CA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateKey [0xB6F06ECA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xB6F06F74]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwFsControlFile [0xB6F08382]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadDriver [0xB6F0A68C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey [0xB6F06412]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey2 [0xB6F06424]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwMapViewOfSection [0xB6F0ACBC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwNotifyChangeKey [0xB6F070C0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenEvent [0xB6F08F36]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenFile [0xB6F07E8E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenKey [0xB6F065DC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenMutant [0xB6F08E04]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenProcess [0xB6F07792]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenSection [0xB6F0AC32]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenSemaphore [0xB6F09068]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenThread [0xB6F076B6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryKey [0xB6F0701E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryMultipleValueKey [0xB6F06C46]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQuerySection [0xB6F0AFD4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryValueKey [0xB6F06896]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueueApcThread [0xB6F0A922]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRenameKey [0xB6F06B0E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplaceKey [0xB6F062B0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyPort [0xB6F093F2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyWaitReceivePort [0xB6F092B8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRequestWaitReplyPort [0xB6F0A39A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRestoreKey [0xB6F0DE2C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwResumeThread [0xB6F0B4AC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSaveKey [0xB6F06248]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSecureConnectPort [0xB6F0865C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetContextThread [0xB6F07CC8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetInformationToken [0xB6F09C4A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetSecurityObject [0xB6F0A786]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetSystemInformation [0xB6F0B114]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetValueKey [0xB6F0671E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendProcess [0xB6F0B1F8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendThread [0xB6F0B320]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSystemDebugControl [0xB6F0A526]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateProcess [0xB6F0790A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateThread [0xB6F07860]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwUnmapViewOfSection [0xB6F0AE8A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwWriteVirtualMemory [0xB6F079EA]

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!FsRtlCheckLockForReadAccess 804EAF84 5 Bytes JMP B6EFC4DC \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
.text ntkrnlpa.exe!IoIsOperationSynchronous 804EF912 5 Bytes JMP B6EFC8B6 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
.text ntkrnlpa.exe!ZwCallbackReturn + 2C98 80504534 16 Bytes [4E, 73, F0, B6, C6, 8F, F0, ...]
.text ntkrnlpa.exe!ZwCallbackReturn + 2D54 805045F0 12 Bytes [8C, A6, F0, B6, 12, 64, F0, ...]
.text ntkrnlpa.exe!ZwCallbackReturn + 2ED0 8050476C 16 Bytes [0E, 6B, F0, B6, B0, 62, F0, ...]
.text ntkrnlpa.exe!ZwCallbackReturn + 2FC4 80504860 12 Bytes [F8, B1, F0, B6, 20, B3, F0, ...]
.text ntkrnlpa.exe!ZwCallbackReturn + 3024 805048C0 4 Bytes JMP F4B6F079
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB945C360, 0x35483F, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\atksgt.sys section is writeable [0xB5CEB300, 0x3B6D8, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\lirsgt.sys section is writeable [0xBA3A8300, 0x1BEE, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\Explorer.EXE[352] SHELL32.dll!SHFileOperationW 7CA70924 5 Bytes JMP 10001102 C:\Program Files\Unlocker\UnlockerHook.dll

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject] [B69BA820] \??\C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\system32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject] [B69BA820] \??\C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

Device \Driver\prodrv06 \Device\ProDrv06 E1E35C30
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort2 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort3 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-12 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\prohlp02 \Device\ProHlp02 E16896B0

AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF4 0x33 0x2A 0x1D ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x89 0x97 0xE6 0x9F ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x92 0xD3 0x28 0xFC ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x95 0x29 0x23 0x59 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0xF2 0x7B 0x8B 0xE9 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12 0xA3 0x60 0x73 0xF3 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF4 0x33 0x2A 0x1D ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...

---- EOF - GMER 1.0.15 ----

Warden75 · #13 Příspěvek od **Warden75** » 02 bře 2010 07:10

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys prosync1.sys hal.dll sfsync02.sys atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

#14 Příspěvek od **motji** » 02 bře 2010 08:41

Já nikde nic nevidím

, máte ve stejné síti zapojený jiný počítač a tam ty stránky běží?
Nod jste měl legální? Odkdy Vám sránky nejdou, neinstaloval sjte nějaký nový program, nestahoval nějaký soubor...

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

Folder::
C:\Program Files\DAEMON Tools Toolbar

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{32099AAC-C132-4136-9E9A-4E364A424E17}"=-

File::
C:\WINDOWS\002927_.tmp

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:

Obrázek

-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

Warden75 · #15 Příspěvek od **Warden75** » 02 bře 2010 08:57

Nejde to asi týden,žádný jiný počítač tu zapojený není....No na nodu jsem měl nějaké heslo co jsem našel na netu....Jinak stahoval jsem akorát nějaké filmy z rapidu...A před tím nějaké ovladače na vypalovačku a grafárnu....

VIRY.CZ

Prosím o kontrolu-nedostanu se na stránky

Prosím o kontrolu-nedostanu se na stránky

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu

Re: Prosím o kontrolu-nedostanu se na stránky

Re: Prosím o kontrolu-nedostanu se na stránky

Re: Prosím o kontrolu-nedostanu se na stránky

Re: Prosím o kontrolu-nedostanu se na stránky

Re: Prosím o kontrolu-nedostanu se na stránky

Re: Prosím o kontrolu-nedostanu se na stránky

Re: Prosím o kontrolu-nedostanu se na stránky

Re: Prosím o kontrolu-nedostanu se na stránky

Re: Prosím o kontrolu-nedostanu se na stránky

Re: Prosím o kontrolu-nedostanu se na stránky

Re: Prosím o kontrolu-nedostanu se na stránky