PC-HELP.CZ

České diskuzní fórum o počítačích
https://pc-help.cnews.cz/

core.cache.dsk

https://pc-help.cnews.cz/viewtopic.php?f=47&t=23490

Stránka 1 z 2

core.cache.dsk

Napsal: 29 led 2008 17:17
od andy85
Cau mam mensi problem.
Spy bot search and destroy mi nasel core.cache.dsk ve windows/system32/drivers coz nejspis zpusobuje neustale vyskakovani IE okna..(prazdneho) i kdyz mam defaultni firefox. Nejspis mi to i blokuje wifi sit. Nejde smazat, jedine v nouzovem rezimu, ale pri rebootu se znova objevi.. Prosim o pomoc co s tim. Moc se mi nechce formatovat.
Diky moc za radu

klidne i na icq

Napsal: 29 led 2008 17:19
od Baron Prášil
čau a vítej na PC-HELP :bigups:

pošli log z hijackthis(návod v podpisu)
//a pro páně fredika log z combofixu :roll:

Napsal: 29 led 2008 17:19
od fredik
Vítej na fóru

Stáhni si ComboFix (by sUBs) a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem klávesy 1
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Napsal: 29 led 2008 17:23
od andy85
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:22:31, on 29.1.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\1XConfig.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Altap Salamander 2.5\SALAMAND.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\QIP Infium\infium.exe
C:\Documents and Settings\Dell\Plocha\hijack\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [ZCfgSvc.exe] C:\WINDOWS\system32\ZCfgSvc.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Altap Salamander 2.5.lnk = C:\Program Files\Altap Salamander 2.5\SALAMAND.exe
O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O13 - WWW Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 4512 bytes

Napsal: 29 led 2008 17:31
od andy85
ten combofix taky?

Napsal: 29 led 2008 17:42
od Baron Prášil
samozřejmě.

Napsal: 29 led 2008 17:51
od andy85
ComboFix 08-01-29.3 - Dell 2008-01-29 17:45:41.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1029.18.251 [GMT 1:00]
Running from: C:\Documents and Settings\Dell\Plocha\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\temp\tn3
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-29 )))))))))))))))))))))))))))))))
.

2008-01-29 17:47 . 2008-01-29 17:47 <DIR> d-------- C:\TEMP\tn3
2008-01-29 16:59 . 2008-01-29 17:48 932 --a------ C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-28 21:26 . 2008-01-28 21:26 <DIR> d-------- C:\iEntertainment Network
2008-01-28 20:57 . 2008-01-28 20:58 <DIR> d-------- C:\TEMP\Flyboys Demo Installer
2008-01-28 20:57 . 2008-01-29 17:47 <DIR> d-------- C:\TEMP
2008-01-28 20:07 . 1999-11-14 15:41 86,016 --a------ C:\WINDOWS\unvise32.exe
2008-01-28 17:06 . 2008-01-28 17:06 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-28 17:06 . 2008-01-28 17:06 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-27 20:47 . 2008-01-27 20:48 <DIR> d-------- C:\Program Files\Hamachi
2008-01-27 20:47 . 2008-01-27 20:47 17,480 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-01-27 20:46 . 2008-01-27 20:46 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2008-01-27 20:46 . 2008-01-27 20:46 <DIR> d-------- C:\Program Files\ACD Systems
2008-01-27 17:50 . 2008-01-27 18:00 <DIR> d-------- C:\Program Files\ATnotes
2008-01-27 13:36 . 2008-01-27 13:37 <DIR> d-------- C:\WINDOWS\system32\cs-cz
2008-01-27 09:18 . 2008-01-27 09:33 136 --a------ C:\WINDOWS\system32\srvblck.tmp
2008-01-27 09:12 . 2008-01-27 09:13 <DIR> d-------- C:\Program Files\Real Alternative
2008-01-27 09:12 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-27 09:12 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-27 09:11 . 2008-01-27 09:12 <DIR> d-------- C:\Program Files\QuickTime Alternative
2008-01-27 09:08 . 2008-01-27 09:08 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-01-27 09:06 . 2008-01-27 09:07 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-01-27 09:06 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-01-25 14:17 . 2008-01-25 14:17 <DIR> d-------- C:\WINDOWS\system32\dtw5d
2008-01-25 14:17 . 2008-01-25 14:17 <DIR> d-------- C:\Program Files\Skype
2008-01-25 14:17 . 2008-01-25 14:17 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-01-25 13:45 . 2008-01-25 13:45 <DIR> d-------- C:\Program Files\Mplayer
2008-01-25 13:43 . 1999-10-09 17:30 305,152 --a------ C:\WINDOWS\IsUninst.exe
2008-01-25 13:43 . 2008-01-25 13:45 761 --a------ C:\WINDOWS\QIII.INI
2008-01-25 13:41 . 2008-01-25 13:47 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-01-25 13:39 . 2008-01-25 13:39 715,248 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-01-25 13:38 . 2008-01-25 13:38 <DIR> d-------- C:\Documents and Settings\Dell\WINDOWS
2008-01-25 11:52 . 2008-01-27 16:42 357 --a------ C:\WINDOWS\wininit.ini
2008-01-25 11:15 . 2008-01-25 11:15 <DIR> d-------- C:\Program Files\Foxit Software
2008-01-25 09:37 . 2008-01-25 09:37 986,112 --a------ C:\WINDOWS\system32\nwklr.ini
2008-01-25 09:37 . 2004-08-18 13:00 982,016 --a------ C:\WINDOWS\system32\korlg.ini
2008-01-25 09:37 . 2008-01-25 09:37 669,696 --a------ C:\WINDOWS\system32\nwwlnt.ini
2008-01-25 09:37 . 2004-08-18 13:00 657,408 --a------ C:\WINDOWS\system32\worlg.ini
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\WINDOWS\system32\ldshyr.old
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\957123845.exe
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\957123844.exe
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\87076.exe
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\3548.exe
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\25769.exe
2008-01-25 00:10 . 2008-01-28 21:15 <DIR> d-------- C:\Games
2008-01-25 00:03 . 2008-01-25 00:03 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-25 00:03 . 2008-01-25 00:03 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-24 23:42 . 2008-01-26 08:03 <DIR> d-------- C:\Music
2008-01-24 23:38 . 2008-01-27 08:53 <DIR> d-------- C:\Movies
2008-01-24 23:32 . 2008-01-24 23:32 86,144 --a------ C:\WINDOWS\system32\drivers\diskk.sys
2008-01-24 23:23 . 2008-01-24 23:32 <DIR> d-------- C:\Program Files\Webteh
2008-01-24 23:15 . 2008-01-24 23:15 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2008-01-24 23:10 . 2008-01-28 09:13 <DIR> d-------- C:\Downloads
2008-01-24 23:09 . 2008-01-24 23:09 <DIR> d-------- C:\Program Files\BitSpirit
2008-01-24 23:03 . 2008-01-24 23:05 <DIR> d-------- C:\Program Files\Winamp
2008-01-24 22:52 . 2008-01-24 22:52 <DIR> d-------- C:\Program Files\Google
2008-01-24 22:20 . 2008-01-24 22:26 <DIR> d-------- C:\Program Files\Styles
2008-01-24 22:10 . 2008-01-24 22:11 <DIR> d-------- C:\Program Files\OpenOffice.org 2.3
2008-01-24 22:05 . 2008-01-24 22:05 1,158 --a------ C:\WINDOWS\mozver.dat
2008-01-24 22:03 . 2008-01-24 22:03 601 --a------ C:\Z stupce - Plocha.lnk
2008-01-24 22:00 . 2008-01-24 22:01 <DIR> d-------- C:\Program Files\Altap Salamander 2.5
2008-01-24 21:56 . 2008-01-24 21:57 <DIR> d-------- C:\Program Files\QIP Infium
2008-01-24 21:52 . 2008-01-24 21:52 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-24 17:02 . 2008-01-24 17:10 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-01-24 16:56 . 2001-10-24 11:54 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-01-24 16:56 . 2001-10-24 11:54 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-01-24 16:56 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-01-24 16:56 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-28 19:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-21 13:31 --------- d-----w C:\Program Files\CyberLink
2007-12-21 13:28 --------- d-----w C:\Program Files\Common Files\Adobe
2007-12-21 13:18 --------- d-----w C:\Program Files\SigmaTel
2007-12-21 13:17 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-21 13:16 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2007-12-21 13:15 --------- d-----w C:\Program Files\Intel
2007-12-21 13:02 --------- d-----w C:\Program Files\Dell
2007-12-21 12:51 --------- d-----w C:\Program Files\Broadcom
2007-12-21 12:47 --------- d-----w C:\Program Files\CONEXANT
2007-12-21 11:15 --------- d-----w C:\Program Files\ATI Technologies
2007-12-21 11:10 --------- d--h--w C:\Program Files\Uninstall Information
2007-12-21 10:21 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-21 07:21 71,176 ----a-w C:\WINDOWS\system32\drivers\epfw.sys
2007-12-21 07:21 53,768 ----a-w C:\WINDOWS\system32\drivers\epfwtdi.sys
2007-12-21 07:21 30,728 ----a-w C:\WINDOWS\system32\drivers\epfwndis.sys
2007-12-21 07:20 30,216 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys
2007-12-21 07:19 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-18 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2006-11-01 12:48 1392640]
"ZCfgSvc.exe"="C:\WINDOWS\system32\ZCfgSvc.exe" [2005-07-05 01:32 639040]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2005-06-27 08:31 135168]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 22:22 3739648]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 08:21 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-18 13:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
C:\WINDOWS\system32\LgNotify.dll 2005-07-05 01:33 188482 C:\WINDOWS\system32\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage Setup]
--a------ 2007-11-09 11:41 120832 c:\program files\daemon tools lite\advantagesetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2005-11-10 21:05 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-29 13:05 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
--------- 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-12-07 15:08 21686568 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2007-08-31 16:46 1460560 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

R1 diskk;diskk;C:\WINDOWS\system32\drivers\diskk.sys [2008-01-24 23:32]
R3 OZSCR;O2Micro SmartCardBus Smartcard Reader;C:\WINDOWS\system32\DRIVERS\ozscr.sys [2005-04-21 21:58]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-18 13:00]
S3 NAL;Nal Service ;C:\WINDOWS\system32\Drivers\iqvw32.sys [2002-11-22 20:01]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-29 17:49:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\1XConfig.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Altap Salamander 2.5\SALAMAND.exe
.
**************************************************************************
.
Completion time: 2008-01-29 17:51:05 - machine was rebooted [Dell]
ComboFix-quarantined-files.txt 2008-01-29 16:50:55
.
2008-01-27 13:41:01 --- E O F ---

Napsal: 29 led 2008 18:22
od Baron Prášil
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok)
Zkopíruj do něj následující text označený zeleně:

Kód: Vybrat vše

File::
C:\WINDOWS\system32\drivers\core.cache.dsk

Folder::
C:\Temp\tn3

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť
Obrázek
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

Napsal: 29 led 2008 18:37
od andy85
ComboFix 08-01-29.3 - Dell 2008-01-29 18:24:35.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1029.18.236 [GMT 1:00]
Running from: C:\Documents and Settings\Dell\Plocha\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dell\Plocha\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\drivers\core.cache.dsk
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\temp\tn3
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-29 )))))))))))))))))))))))))))))))
.

2008-01-29 18:25 . 2008-01-29 18:25 <DIR> d-------- C:\TEMP\tn3
2008-01-29 16:59 . 2008-01-29 18:26 932 --a------ C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-28 21:26 . 2008-01-28 21:26 <DIR> d-------- C:\iEntertainment Network
2008-01-28 20:57 . 2008-01-28 20:58 <DIR> d-------- C:\TEMP\Flyboys Demo Installer
2008-01-28 20:57 . 2008-01-29 18:25 <DIR> d-------- C:\TEMP
2008-01-28 20:07 . 1999-11-14 15:41 86,016 --a------ C:\WINDOWS\unvise32.exe
2008-01-28 17:06 . 2008-01-28 17:06 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-28 17:06 . 2008-01-28 17:06 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-27 20:47 . 2008-01-27 20:48 <DIR> d-------- C:\Program Files\Hamachi
2008-01-27 20:47 . 2008-01-27 20:47 17,480 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-01-27 20:46 . 2008-01-27 20:46 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2008-01-27 20:46 . 2008-01-27 20:46 <DIR> d-------- C:\Program Files\ACD Systems
2008-01-27 17:50 . 2008-01-27 18:00 <DIR> d-------- C:\Program Files\ATnotes
2008-01-27 13:36 . 2008-01-27 13:37 <DIR> d-------- C:\WINDOWS\system32\cs-cz
2008-01-27 09:18 . 2008-01-27 09:33 136 --a------ C:\WINDOWS\system32\srvblck.tmp
2008-01-27 09:12 . 2008-01-27 09:13 <DIR> d-------- C:\Program Files\Real Alternative
2008-01-27 09:12 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-27 09:12 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-27 09:11 . 2008-01-27 09:12 <DIR> d-------- C:\Program Files\QuickTime Alternative
2008-01-27 09:08 . 2008-01-27 09:08 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-01-27 09:06 . 2008-01-27 09:07 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-01-27 09:06 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-01-25 14:17 . 2008-01-25 14:17 <DIR> d-------- C:\WINDOWS\system32\dtw5d
2008-01-25 14:17 . 2008-01-25 14:17 <DIR> d-------- C:\Program Files\Skype
2008-01-25 14:17 . 2008-01-25 14:17 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-01-25 13:45 . 2008-01-25 13:45 <DIR> d-------- C:\Program Files\Mplayer
2008-01-25 13:43 . 1999-10-09 17:30 305,152 --a------ C:\WINDOWS\IsUninst.exe
2008-01-25 13:43 . 2008-01-25 13:45 761 --a------ C:\WINDOWS\QIII.INI
2008-01-25 13:41 . 2008-01-25 13:47 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-01-25 13:39 . 2008-01-25 13:39 715,248 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-01-25 13:38 . 2008-01-25 13:38 <DIR> d-------- C:\Documents and Settings\Dell\WINDOWS
2008-01-25 11:52 . 2008-01-27 16:42 357 --a------ C:\WINDOWS\wininit.ini
2008-01-25 11:15 . 2008-01-25 11:15 <DIR> d-------- C:\Program Files\Foxit Software
2008-01-25 09:37 . 2008-01-25 09:37 986,112 --a------ C:\WINDOWS\system32\nwklr.ini
2008-01-25 09:37 . 2004-08-18 13:00 982,016 --a------ C:\WINDOWS\system32\korlg.ini
2008-01-25 09:37 . 2008-01-25 09:37 669,696 --a------ C:\WINDOWS\system32\nwwlnt.ini
2008-01-25 09:37 . 2004-08-18 13:00 657,408 --a------ C:\WINDOWS\system32\worlg.ini
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\WINDOWS\system32\ldshyr.old
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\957123845.exe
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\957123844.exe
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\87076.exe
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\3548.exe
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\25769.exe
2008-01-25 00:10 . 2008-01-28 21:15 <DIR> d-------- C:\Games
2008-01-25 00:03 . 2008-01-25 00:03 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-25 00:03 . 2008-01-25 00:03 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-24 23:42 . 2008-01-26 08:03 <DIR> d-------- C:\Music
2008-01-24 23:38 . 2008-01-27 08:53 <DIR> d-------- C:\Movies
2008-01-24 23:32 . 2008-01-24 23:32 86,144 --a------ C:\WINDOWS\system32\drivers\diskk.sys
2008-01-24 23:23 . 2008-01-24 23:32 <DIR> d-------- C:\Program Files\Webteh
2008-01-24 23:15 . 2008-01-24 23:15 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2008-01-24 23:10 . 2008-01-28 09:13 <DIR> d-------- C:\Downloads
2008-01-24 23:09 . 2008-01-24 23:09 <DIR> d-------- C:\Program Files\BitSpirit
2008-01-24 23:03 . 2008-01-24 23:05 <DIR> d-------- C:\Program Files\Winamp
2008-01-24 22:52 . 2008-01-24 22:52 <DIR> d-------- C:\Program Files\Google
2008-01-24 22:20 . 2008-01-24 22:26 <DIR> d-------- C:\Program Files\Styles
2008-01-24 22:10 . 2008-01-24 22:11 <DIR> d-------- C:\Program Files\OpenOffice.org 2.3
2008-01-24 22:05 . 2008-01-24 22:05 1,158 --a------ C:\WINDOWS\mozver.dat
2008-01-24 22:03 . 2008-01-24 22:03 601 --a------ C:\Z stupce - Plocha.lnk
2008-01-24 22:00 . 2008-01-24 22:01 <DIR> d-------- C:\Program Files\Altap Salamander 2.5
2008-01-24 21:56 . 2008-01-24 21:57 <DIR> d-------- C:\Program Files\QIP Infium
2008-01-24 21:52 . 2008-01-24 21:52 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-24 17:02 . 2008-01-24 17:10 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-01-24 16:56 . 2001-10-24 11:54 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-01-24 16:56 . 2001-10-24 11:54 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-01-24 16:56 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-01-24 16:56 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-28 19:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-21 13:31 --------- d-----w C:\Program Files\CyberLink
2007-12-21 13:28 --------- d-----w C:\Program Files\Common Files\Adobe
2007-12-21 13:18 --------- d-----w C:\Program Files\SigmaTel
2007-12-21 13:17 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-21 13:16 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2007-12-21 13:15 --------- d-----w C:\Program Files\Intel
2007-12-21 13:02 --------- d-----w C:\Program Files\Dell
2007-12-21 12:51 --------- d-----w C:\Program Files\Broadcom
2007-12-21 12:47 --------- d-----w C:\Program Files\CONEXANT
2007-12-21 11:15 --------- d-----w C:\Program Files\ATI Technologies
2007-12-21 11:10 --------- d--h--w C:\Program Files\Uninstall Information
2007-12-21 10:21 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-21 07:21 71,176 ----a-w C:\WINDOWS\system32\drivers\epfw.sys
2007-12-21 07:21 53,768 ----a-w C:\WINDOWS\system32\drivers\epfwtdi.sys
2007-12-21 07:21 30,728 ----a-w C:\WINDOWS\system32\drivers\epfwndis.sys
2007-12-21 07:20 30,216 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys
2007-12-21 07:19 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-18 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2006-11-01 12:48 1392640]
"ZCfgSvc.exe"="C:\WINDOWS\system32\ZCfgSvc.exe" [2005-07-05 01:32 639040]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2005-06-27 08:31 135168]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 22:22 3739648]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 08:21 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-18 13:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
C:\WINDOWS\system32\LgNotify.dll 2005-07-05 01:33 188482 C:\WINDOWS\system32\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage Setup]
--a------ 2007-11-09 11:41 120832 c:\program files\daemon tools lite\advantagesetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2005-11-10 21:05 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-29 13:05 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
--------- 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-12-07 15:08 21686568 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2007-08-31 16:46 1460560 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

R1 diskk;diskk;C:\WINDOWS\system32\drivers\diskk.sys [2008-01-24 23:32]
R3 OZSCR;O2Micro SmartCardBus Smartcard Reader;C:\WINDOWS\system32\DRIVERS\ozscr.sys [2005-04-21 21:58]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-18 13:00]
S3 NAL;Nal Service ;C:\WINDOWS\system32\Drivers\iqvw32.sys [2002-11-22 20:01]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-29 18:27:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\1XConfig.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Altap Salamander 2.5\SALAMAND.exe
.
**************************************************************************
.
Completion time: 2008-01-29 18:28:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-29 17:28:49
ComboFix2.txt 2008-01-29 16:51:05
.
2008-01-27 13:41:01 --- E O F ---

Napsal: 29 led 2008 18:48
od Baron Prášil
použij stejný postup
a zkopíruj toto

Kód: Vybrat vše

File::
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\diskk.sys

Folder::
C:\temp\tn3



a pošli novej log z comba

Napsal: 29 led 2008 19:04
od andy85
ComboFix 08-01-29.3 - Dell 2008-01-29 18:57:32.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1029.18.232 [GMT 1:00]
Running from: C:\Documents and Settings\Dell\Plocha\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dell\Plocha\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\diskk.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\diskk.sys
C:\temp\tn3
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\diskk.sys

.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-29 )))))))))))))))))))))))))))))))
.

2008-01-28 21:26 . 2008-01-28 21:26 <DIR> d-------- C:\iEntertainment Network
2008-01-28 20:57 . 2008-01-28 20:58 <DIR> d-------- C:\TEMP\Flyboys Demo Installer
2008-01-28 20:57 . 2008-01-29 18:58 <DIR> d-------- C:\TEMP
2008-01-28 20:07 . 1999-11-14 15:41 86,016 --a------ C:\WINDOWS\unvise32.exe
2008-01-28 17:06 . 2008-01-28 17:06 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-28 17:06 . 2008-01-28 17:06 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-27 20:47 . 2008-01-27 20:48 <DIR> d-------- C:\Program Files\Hamachi
2008-01-27 20:47 . 2008-01-27 20:47 17,480 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-01-27 20:46 . 2008-01-27 20:46 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2008-01-27 20:46 . 2008-01-27 20:46 <DIR> d-------- C:\Program Files\ACD Systems
2008-01-27 17:50 . 2008-01-27 18:00 <DIR> d-------- C:\Program Files\ATnotes
2008-01-27 13:36 . 2008-01-27 13:37 <DIR> d-------- C:\WINDOWS\system32\cs-cz
2008-01-27 09:18 . 2008-01-27 09:33 136 --a------ C:\WINDOWS\system32\srvblck.tmp
2008-01-27 09:12 . 2008-01-27 09:13 <DIR> d-------- C:\Program Files\Real Alternative
2008-01-27 09:12 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-27 09:12 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-27 09:11 . 2008-01-27 09:12 <DIR> d-------- C:\Program Files\QuickTime Alternative
2008-01-27 09:08 . 2008-01-27 09:08 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-01-27 09:06 . 2008-01-27 09:07 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-01-27 09:06 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-01-25 14:17 . 2008-01-25 14:17 <DIR> d-------- C:\WINDOWS\system32\dtw5d
2008-01-25 14:17 . 2008-01-25 14:17 <DIR> d-------- C:\Program Files\Skype
2008-01-25 14:17 . 2008-01-25 14:17 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-01-25 13:45 . 2008-01-25 13:45 <DIR> d-------- C:\Program Files\Mplayer
2008-01-25 13:43 . 1999-10-09 17:30 305,152 --a------ C:\WINDOWS\IsUninst.exe
2008-01-25 13:43 . 2008-01-25 13:45 761 --a------ C:\WINDOWS\QIII.INI
2008-01-25 13:41 . 2008-01-25 13:47 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-01-25 13:39 . 2008-01-25 13:39 715,248 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-01-25 13:38 . 2008-01-25 13:38 <DIR> d-------- C:\Documents and Settings\Dell\WINDOWS
2008-01-25 11:52 . 2008-01-27 16:42 357 --a------ C:\WINDOWS\wininit.ini
2008-01-25 11:15 . 2008-01-25 11:15 <DIR> d-------- C:\Program Files\Foxit Software
2008-01-25 09:37 . 2008-01-25 09:37 986,112 --a------ C:\WINDOWS\system32\nwklr.ini
2008-01-25 09:37 . 2004-08-18 13:00 982,016 --a------ C:\WINDOWS\system32\korlg.ini
2008-01-25 09:37 . 2008-01-25 09:37 669,696 --a------ C:\WINDOWS\system32\nwwlnt.ini
2008-01-25 09:37 . 2004-08-18 13:00 657,408 --a------ C:\WINDOWS\system32\worlg.ini
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\WINDOWS\system32\ldshyr.old
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\957123845.exe
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\957123844.exe
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\87076.exe
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\3548.exe
2008-01-25 09:37 . 2008-01-25 09:37 23,552 --a------ C:\Documents and Settings\Dell\25769.exe
2008-01-25 00:10 . 2008-01-28 21:15 <DIR> d-------- C:\Games
2008-01-25 00:03 . 2008-01-25 00:03 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-25 00:03 . 2008-01-25 00:03 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-24 23:42 . 2008-01-26 08:03 <DIR> d-------- C:\Music
2008-01-24 23:38 . 2008-01-27 08:53 <DIR> d-------- C:\Movies
2008-01-24 23:23 . 2008-01-24 23:32 <DIR> d-------- C:\Program Files\Webteh
2008-01-24 23:15 . 2008-01-24 23:15 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2008-01-24 23:10 . 2008-01-28 09:13 <DIR> d-------- C:\Downloads
2008-01-24 23:09 . 2008-01-24 23:09 <DIR> d-------- C:\Program Files\BitSpirit
2008-01-24 23:03 . 2008-01-24 23:05 <DIR> d-------- C:\Program Files\Winamp
2008-01-24 22:52 . 2008-01-24 22:52 <DIR> d-------- C:\Program Files\Google
2008-01-24 22:20 . 2008-01-24 22:26 <DIR> d-------- C:\Program Files\Styles
2008-01-24 22:10 . 2008-01-24 22:11 <DIR> d-------- C:\Program Files\OpenOffice.org 2.3
2008-01-24 22:05 . 2008-01-24 22:05 1,158 --a------ C:\WINDOWS\mozver.dat
2008-01-24 22:03 . 2008-01-24 22:03 601 --a------ C:\Z stupce - Plocha.lnk
2008-01-24 22:00 . 2008-01-24 22:01 <DIR> d-------- C:\Program Files\Altap Salamander 2.5
2008-01-24 21:56 . 2008-01-24 21:57 <DIR> d-------- C:\Program Files\QIP Infium
2008-01-24 21:52 . 2008-01-24 21:52 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-24 17:02 . 2008-01-24 17:10 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-01-24 16:56 . 2001-10-24 11:54 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-01-24 16:56 . 2001-10-24 11:54 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-01-24 16:56 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-01-24 16:56 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-28 19:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-21 13:31 --------- d-----w C:\Program Files\CyberLink
2007-12-21 13:28 --------- d-----w C:\Program Files\Common Files\Adobe
2007-12-21 13:18 --------- d-----w C:\Program Files\SigmaTel
2007-12-21 13:17 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-21 13:16 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2007-12-21 13:15 --------- d-----w C:\Program Files\Intel
2007-12-21 13:02 --------- d-----w C:\Program Files\Dell
2007-12-21 12:51 --------- d-----w C:\Program Files\Broadcom
2007-12-21 12:47 --------- d-----w C:\Program Files\CONEXANT
2007-12-21 11:15 --------- d-----w C:\Program Files\ATI Technologies
2007-12-21 11:10 --------- d--h--w C:\Program Files\Uninstall Information
2007-12-21 10:21 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-21 07:21 71,176 ----a-w C:\WINDOWS\system32\drivers\epfw.sys
2007-12-21 07:21 53,768 ----a-w C:\WINDOWS\system32\drivers\epfwtdi.sys
2007-12-21 07:21 30,728 ----a-w C:\WINDOWS\system32\drivers\epfwndis.sys
2007-12-21 07:20 30,216 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys
2007-12-21 07:19 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-18 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2006-11-01 12:48 1392640]
"ZCfgSvc.exe"="C:\WINDOWS\system32\ZCfgSvc.exe" [2005-07-05 01:32 639040]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2005-06-27 08:31 135168]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 22:22 3739648]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 08:21 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-18 13:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
C:\WINDOWS\system32\LgNotify.dll 2005-07-05 01:33 188482 C:\WINDOWS\system32\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage Setup]
--a------ 2007-11-09 11:41 120832 c:\program files\daemon tools lite\advantagesetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2005-11-10 21:05 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-29 13:05 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
--------- 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-12-07 15:08 21686568 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2007-08-31 16:46 1460560 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

R3 OZSCR;O2Micro SmartCardBus Smartcard Reader;C:\WINDOWS\system32\DRIVERS\ozscr.sys [2005-04-21 21:58]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-18 13:00]
S1 diskk;diskk;C:\WINDOWS\system32\drivers\diskk.sys []
S3 NAL;Nal Service ;C:\WINDOWS\system32\Drivers\iqvw32.sys [2002-11-22 20:01]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-29 19:00:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\1XConfig.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\Program Files\Altap Salamander 2.5\SALAMAND.exe
.
**************************************************************************
.
Completion time: 2008-01-29 19:02:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-29 18:01:53
ComboFix2.txt 2008-01-29 17:28:59
ComboFix3.txt 2008-01-29 16:51:05
.
2008-01-27 13:41:01 --- E O F ---

Napsal: 29 led 2008 19:18
od Baron Prášil
fajn.co problém?
Časové pásmo: UTC+02:00
Stránka 1 z 2
Powered by phpBB® Forum Software © phpBB Limited
https://www.phpbb.com/