Gribese

Terfelus · Příspěvekod **Terfelus** » 02 led 2008 14:30

Počítač semy pravidelně seká každou vteřinu a jsou trochu zpožděné reakce miši a klávesnice, co stím dělat.

Logfile of HijackThis v1.99.1
Scan saved at 14:18:18, on 2.1.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\ASUSKBService.exe
D:\program files\torrent\Azureus\Azureus.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SPYWAR~1\sp_rsser.exe
C:\Program Files\eMule\emule.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Doma\Plocha\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll (file missing)
O3 - Toolbar: Easy Gif Animator Toolbar - {35065594-9169-4A34-B167-FC4865038E53} - C:\Program Files\Easy Gif Animator Extension\v3.2.0.0\EasyGifAnimator_Toolbar.dll (file missing)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll (file missing)
O3 - Toolbar: (no name) - {70CC76D5-A4EE-4F25-9931-B109A63E298E} - (no file)
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\FlashGet.exe /min
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [907b58cb] rundll32.exe "C:\WINDOWS\system32\ctovijvj.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [CS Update] copy /Y "C:\Program Files\ActivationManager\ActivationManager.dll.upd" "C:\Program Files\ActivationManager\ActivationManager.dll"
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [ChristmasTree] C:\Program Files\ChristmasTree\ChristmasTree.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Stáhnout Star Downloaderem - C:\Program Files\Star Downloader\sdie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ASUS Keyboard Service (ASUSKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ASUSKBService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\PROGRA~1\SPYWAR~1\sp_rsser.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

Reklama

Příspěvekod **fredik** » 02 led 2008 15:34

Vítej na fóru

Stáhni si SDFix
- Spusť ho a rozbalí se ti na disk kde je nainstalovaný Windows (typicky to je C:\SDfix)
- Pak restartuj PC do nouzového režimu (zvol možnost: Stav nouze, ne Stav nouze s práci v síti)
- Otevři adresář kde je vybalený SDFix a spusť soubor RunThis.bat tím spustíš program.
* Pak stiskni klávesu Y a pak Enter pro zahájení čistícího procesu.
* Pro dokončení kontroly budeš vyzván ke stisknoutí libovolné klávesy a počítač se restartuje.
* Při nabíhání operačního systému se program spustí znovu a dokončí čistící proces. Až se objeví Finish, budeš muset po vyzvání stisknout libovolnou klávesu, tim se ukončí program a zobrazí se ti ikony na ploše
- Když se skončí načítání ikon na ploše, otevře se ti na obrazovce log z SDFix a zároveň ho uloží do adresáře kde je rozbalený SDFix jako soubor Report.txt
Pak sem zkopíruj jeho obsah.

Stáhni si ComboFix (by sUBs) a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem klávesy 1
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Terfelus · Příspěvekod **Terfelus** » 02 led 2008 16:09

Logfile of HijackThis v1.99.1
Scan saved at 15:03:51, on 2.1.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\ASUSKBService.exe
D:\program files\torrent\Azureus\Azureus.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SPYWAR~1\sp_rsser.exe
C:\Program Files\eMule\emule.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Doma\Plocha\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll (file missing)
O3 - Toolbar: Easy Gif Animator Toolbar - {35065594-9169-4A34-B167-FC4865038E53} - C:\Program Files\Easy Gif Animator Extension\v3.2.0.0\EasyGifAnimator_Toolbar.dll (file missing)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll (file missing)
O3 - Toolbar: (no name) - {70CC76D5-A4EE-4F25-9931-B109A63E298E} - (no file)
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\FlashGet.exe /min
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [907b58cb] rundll32.exe "C:\WINDOWS\system32\ctovijvj.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [CS Update] copy /Y "C:\Program Files\ActivationManager\ActivationManager.dll.upd" "C:\Program Files\ActivationManager\ActivationManager.dll"
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [ChristmasTree] C:\Program Files\ChristmasTree\ChristmasTree.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Stáhnout Star Downloaderem - C:\Program Files\Star Downloader\sdie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ASUS Keyboard Service (ASUSKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ASUSKBService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\PROGRA~1\SPYWAR~1\sp_rsser.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

X · Příspěvekod X » 02 led 2008 16:28

Jakou PC sestavu máš? Jestli ty neustále běží Emule, tak P2P dokážou docela slušně vytížit PC, zvláště starší sestavy.

Příspěvekod **fredik** » 02 led 2008 17:03

Momentálně je mi nový log z HJT k ničemu. Použij alespoň ComboFix a dej sem z něho log.

Terfelus · Příspěvekod **Terfelus** » 02 led 2008 17:38

SDFix: Version 1.122

Run by Doma on 2008-01-02 at 16:29

Microsoft Windows XP [Verze 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

Trojan Files Found:

C:\DOCUME~1\Doma\LOCALS~1\Temp\removalfile.bat - Deleted

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-02 16:45:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:07f9c700
"s2"=dword:05cda233
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:86,0b,ef,7e,10,b9,13,60,89,2b,e5,66,3b,97,2e,1e,47,a7,fb,54,e4,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000001
"khjeh"=hex:75,41,fb,f2,02,1e,48,f0,e3,d7,84,77,ae,65,c0,93,29,b0,64,02,d4,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,72,55,f7,df,cb,1d,02,89,c6,c8,d4,72,72,51,d9,42,c4,..
"khjeh"=hex:43,72,ab,e3,84,4f,b2,3e,cc,9b,d5,81,aa,b5,9e,7e,4b,d5,b5,57,01,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:b8,ce,78,f6,6d,80,2e,f2,6b,86,7c,26,7c,1a,5a,55,e2,81,8f,88,af,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:86,0b,ef,7e,10,b9,13,60,89,2b,e5,66,3b,97,2e,1e,47,a7,fb,54,e4,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000001
"khjeh"=hex:75,41,fb,f2,02,1e,48,f0,e3,d7,84,77,ae,65,c0,93,29,b0,64,02,d4,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,72,55,f7,df,cb,1d,02,89,c6,c8,d4,72,72,51,d9,42,c4,..
"khjeh"=hex:43,72,ab,e3,84,4f,b2,3e,cc,9b,d5,81,aa,b5,9e,7e,4b,d5,b5,57,01,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:b8,ce,78,f6,6d,80,2e,f2,6b,86,7c,26,7c,1a,5a,55,e2,81,8f,88,af,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\\f\1e]
"SlowInfoCache"=hex:28,02,00,00,01,00,00,00,00,30,74,00,00,00,00,00,3d,d3,81,4c,b7,..
"Changed"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cursors\Schemes]
"\f\1e?r?n?\xe9? ?u?k?a?z?a?t?e?l?e? ?"="C:\WINDOWS\cursors\arrow_r.cur,C:\WINDOWS\cursors\help_r.cur,C:\WINDOWS\cursors\wait_r.cur,C:\WINDOWS\cursors\busy_r.cur,C:\WINDOWS\cursors\cross_r.cur,C:\WINDOWS\cursors\beam_r.cur,C:\WINDOWS\cursors\pen_r.cur,C:\WINDOWS\cursors\no_r.cur,C:\WINDOWS\cursors\size4_r.cur,C:\WINDOWS\cursors\size3_r.cur,C:\WINDOWS\cursors\size2_r.cur,C:\WINDOWS\cursors\size1_r.cur,C:\WINDOWS\cursors\move_r.cur,C:\WINDOWS\cursors\up_r.cur"
"\f\1e?r?n?\xe9? ?u?k?a?z?a?t?e?l?e? ?(?v?e?l?k?\xe9?)?"="C:\WINDOWS\cursors\arrow_rm.cur,C:\WINDOWS\cursors\help_rm.cur,C:\WINDOWS\cursors\wait_rm.cur,C:\WINDOWS\cursors\busy_rm.cur,C:\WINDOWS\cursors\cross_rm.cur,C:\WINDOWS\cursors\beam_rm.cur,C:\WINDOWS\cursors\pen_rm.cur,C:\WINDOWS\cursors\no_rm.cur,C:\WINDOWS\cursors\size4_rm.cur,C:\WINDOWS\cursors\size3_rm.cur,C:\WINDOWS\cursors\size2_rm.cur,C:\WINDOWS\cursors\size1_rm.cur,C:\WINDOWS\cursors\move_rm.cur,C:\WINDOWS\cursors\up_rm.cur"
"\f\1e?r?n?\xe9? ?u?k?a?z?a?t?e?l?e? ?(?n?e?j?v?\e\1t?a\1\xed?)?"="C:\WINDOWS\cursors\arrow_rl.cur,C:\WINDOWS\cursors\help_rl.cur,C:\WINDOWS\cursors\wait_rl.cur,C:\WINDOWS\cursors\busy_rl.cur,C:\WINDOWS\cursors\cross_rl.cur,C:\WINDOWS\cursors\beam_rl.cur,C:\WINDOWS\cursors\pen_rl.cur,C:\WINDOWS\cursors\no_rl.cur,C:\WINDOWS\cursors\size4_rl.cur,C:\WINDOWS\cursors\size3_rl.cur,C:\WINDOWS\cursors\size2_rl.cur,C:\WINDOWS\cursors\size1_rl.cur,C:\WINDOWS\cursors\move_rl.cur,C:\WINDOWS\cursors\up_rl.cur"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.\x160P\OpenWithProgids]
"`\1P?_?a?u?t?o?_?f?i?l?e?"=hex(0):
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Microsoft SQL Server 2005\M\x2018n\x13a]wQ]
"Order"=hex:08,00,00,00,02,00,00,00,d6,01,00,00,01,00,00,00,03,00,00,00,aa,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:FlashGet"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"D:\\program files\\torrent\\Azureus\\Azureus.exe"="D:\\program files\\torrent\\Azureus\\Azureus.exe:*:Enabled:Azureus"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sun 18 Mar 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 22 Nov 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 24 Oct 2007 921,600 A..H. --- "C:\Documents and Settings\Doma\Local Settings\Temporary Internet Files\ijjistarter2FxB.exe"
Fri 28 Dec 2007 888 ...HR --- "C:\Documents and Settings\Doma\Data aplikacˇ\SecuROM\UserData\securom_v7_01.bak"
Sat 17 Mar 2007 211 A.SHR --- "C:\Documents and Settings\Doma\Data aplikacˇ\Everest Labs\SpyDefense\Backups\BF52.tmp"

Finished!

Terfelus · Příspěvekod **Terfelus** » 02 led 2008 17:39

ComboFix 07-12-31.4 - Doma 2008-01-02 17:25:13.2 - NTFSx86
Running from: C:\Documents and Settings\Doma\Plocha\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Documents and Settings\Doma\Data aplikací\macromedia\Flash Player\#SharedObjects\NGWNPF9K\www.broadcaster.com
C:\Documents and Settings\Doma\Data aplikací\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Doma\Data aplikací\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\WINDOWS\system32\4_exception.nls
C:\WINDOWS\system32\afidncjd.exe
C:\WINDOWS\system32\afjqfpmx.dll
C:\WINDOWS\system32\amiudsyk.dll
C:\WINDOWS\system32\aqryylmk.dll
C:\WINDOWS\system32\aufjfpvq.ini
C:\WINDOWS\system32\ayhtdnrh.dll
C:\WINDOWS\system32\babgxijm.dll
C:\WINDOWS\system32\bbreephp.dll
C:\WINDOWS\system32\bccdd.ini
C:\WINDOWS\system32\bccdd.ini2
C:\WINDOWS\system32\brbkfnul.ini
C:\WINDOWS\system32\brcphmnv.exe
C:\WINDOWS\system32\cbnmpefg.exe
C:\WINDOWS\system32\cjyhbjeh.exe
C:\WINDOWS\system32\crrdwxwp.exe
C:\WINDOWS\system32\ctovijvj.dll
C:\WINDOWS\system32\cyobwtin.ini
C:\WINDOWS\system32\ddccb.dll
C:\WINDOWS\system32\defnjjbl.ini
C:\WINDOWS\system32\drivers\runtime2.sys
C:\WINDOWS\system32\dxlylsae.dll
C:\WINDOWS\system32\dxyxqlcr.exe
C:\WINDOWS\system32\eapmlvxt.ini
C:\WINDOWS\system32\eiqcedni.exe
C:\WINDOWS\system32\evucqosa.exe
C:\WINDOWS\system32\exhiyekg.dll
C:\WINDOWS\system32\fjuejxdt.exe
C:\WINDOWS\system32\fnleiain.dll
C:\WINDOWS\system32\fvjfmtgb.ini
C:\WINDOWS\system32\goqtfabg.ini
C:\WINDOWS\system32\gpidoxtt.dll
C:\WINDOWS\system32\gqdebycu.dll
C:\WINDOWS\system32\grltgeuc.dll
C:\WINDOWS\system32\gttrpadx.dll
C:\WINDOWS\system32\gxdldiwe.dll
C:\WINDOWS\system32\hyovacjp.dll
C:\WINDOWS\system32\jbtmnhvw.dll
C:\WINDOWS\system32\jiurcrjv.dll
C:\WINDOWS\system32\jjkiwqsm.dll
C:\WINDOWS\system32\jveywnsr.dll
C:\WINDOWS\system32\jvjivotc.ini
C:\WINDOWS\system32\kysduima.ini
C:\WINDOWS\system32\lcpblogu.exe
C:\WINDOWS\system32\lhdrvbxq.dll
C:\WINDOWS\system32\lriiejsm.dll
C:\WINDOWS\system32\lxgrmvim.exe
C:\WINDOWS\system32\mcfupwoh.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mksoxxqr.exe
C:\WINDOWS\system32\mogkkkuc.exe
C:\WINDOWS\system32\msjeiirl.ini
C:\WINDOWS\system32\mvxcfcbn.exe
C:\WINDOWS\system32\nedbncgy.exe
C:\WINDOWS\system32\neichrao.exe
C:\WINDOWS\system32\ngnnfvno.exe
C:\WINDOWS\system32\nhcvxbsd.dll
C:\WINDOWS\system32\nikfmmku.ini
C:\WINDOWS\system32\nmqxuutq.dll
C:\WINDOWS\system32\ntrbaylv.dll
C:\WINDOWS\system32\obhvamvc.dll
C:\WINDOWS\system32\oncmands.ini
C:\WINDOWS\system32\osywuaqh.dll
C:\WINDOWS\system32\oygephcy.dll
C:\WINDOWS\system32\pjabipvr.ini
C:\WINDOWS\system32\pjxpgsly.dll
C:\WINDOWS\system32\pkljbxdx.dll
C:\WINDOWS\system32\qehbwuba.dll
C:\WINDOWS\system32\qisjvgul.exe
C:\WINDOWS\system32\qtuuxqmn.ini
C:\WINDOWS\system32\qvpfjfua.dll
C:\WINDOWS\system32\qxbvrdhl.ini
C:\WINDOWS\system32\rcovwxxr.exe
C:\WINDOWS\system32\rgianylr.exe
C:\WINDOWS\system32\rpolnqdk.ini
C:\WINDOWS\system32\sjmqdyjl.exe
C:\WINDOWS\system32\smpogxvw.dll
C:\WINDOWS\system32\txvlmpae.dll
C:\WINDOWS\system32\ubmrvkcv.exe
C:\WINDOWS\system32\ucybedqg.ini
C:\WINDOWS\system32\uhdcesfv.dll
C:\WINDOWS\system32\ukmmfkin.dll
C:\WINDOWS\system32\utsdacqi.exe
C:\WINDOWS\system32\vadwtsix.dll
C:\WINDOWS\system32\vapptcuv.exe
C:\WINDOWS\system32\vbyfbsiv.ini
C:\WINDOWS\system32\vdovfbqd.dll
C:\WINDOWS\system32\vfsecdhu.ini
C:\WINDOWS\system32\vioikppt.dll
C:\WINDOWS\system32\visbfybv.dll
C:\WINDOWS\system32\vjrcruij.ini
C:\WINDOWS\system32\vyewlbig.exe
C:\WINDOWS\system32\wifbjlxg.exe
C:\WINDOWS\system32\wnqgoaae.dll
C:\WINDOWS\system32\wtcqqcax.dll
C:\WINDOWS\system32\wvxgopms.ini
C:\WINDOWS\system32\wvycdxon.dll
C:\WINDOWS\system32\xacqqctw.ini
C:\WINDOWS\system32\xdaprttg.ini
C:\WINDOWS\system32\xfeqlwxx.dll
C:\WINDOWS\system32\xgocejtc.ini
C:\WINDOWS\system32\xnaxvtca.exe
C:\WINDOWS\system32\xngdtcse.dll
C:\WINDOWS\system32\xpdx.sys
C:\WINDOWS\system32\xrcgmptk.exe
C:\WINDOWS\system32\xwsmlswc.dll
C:\WINDOWS\system32\xybeg.ini
C:\WINDOWS\system32\xybeg.ini2
C:\WINDOWS\system32\ygjduege.dll
C:\WINDOWS\system32\ylsgpxjp.ini
C:\WINDOWS\system32\yreholhb.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_RUNTIME2
-------\runtime

((((((((((((((((((((((((( Files Created from 2007-12-02 to 2008-01-02 )))))))))))))))))))))))))))))))
.

2008-01-02 16:27 . 2008-01-02 16:28 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-02 15:18 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-02 10:54 . 2008-01-02 10:54 <DIR> d-------- C:\Program Files\ZooTycoon
2008-01-02 10:54 . 2008-01-02 11:48 <DIR> d-------- C:\Program Files\3082
2008-01-02 10:54 . 2008-01-02 11:48 <DIR> d-------- C:\Program Files\1046
2008-01-02 10:54 . 2008-01-02 11:48 <DIR> d-------- C:\Program Files\1042
2008-01-02 10:54 . 2008-01-02 11:48 <DIR> d-------- C:\Program Files\1041
2008-01-02 10:54 . 2008-01-02 11:48 <DIR> d-------- C:\Program Files\1040
2008-01-02 10:54 . 2008-01-02 11:48 <DIR> d-------- C:\Program Files\1036
2008-01-02 10:54 . 2008-01-02 11:48 <DIR> d-------- C:\Program Files\1033
2008-01-02 10:54 . 2008-01-02 11:48 <DIR> d-------- C:\Program Files\1031
2008-01-02 10:54 . 2008-01-02 11:48 <DIR> d-------- C:\Program Files\1028
2008-01-01 20:18 . 2008-01-01 20:19 <DIR> d-------- C:\Program Files\Realtek AC97
2008-01-01 19:59 . 2008-01-01 20:35 <DIR> d-------- C:\Program Files\Mozilla Firefox 3 Beta 2
2008-01-01 11:02 . 2008-01-01 11:02 <DIR> d-------- C:\Program Files\Acclaim
2008-01-01 00:38 . 2008-01-01 00:43 <DIR> d-------- C:\Program Files\WinClamAVShield
2007-12-31 23:49 . 2008-01-01 22:00 <DIR> d-------- C:\Downloads
2007-12-31 23:47 . 2008-01-02 17:29 <DIR> d-------- C:\Program Files\FlashGet
2007-12-31 23:47 . 2006-04-20 12:51 359,808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.flg
2007-12-31 21:05 . 2008-01-01 18:47 <DIR> d-------- C:\Program Files\GameShadow
2007-12-31 21:03 . 2007-12-31 21:04 <DIR> d-------- C:\Program Files\WB3gm
2007-12-31 21:03 . 2007-12-31 21:04 <DIR> d-------- C:\Program Files\TGAit
2007-12-31 21:02 . 2007-12-31 21:02 303 --a------ C:\WINDOWS\ST6UNST.000
2007-12-31 17:52 . 2007-12-31 17:52 <DIR> d-------- C:\Program Files\GMX Media
2007-12-31 06:23 . 2008-01-01 06:22 1,031,259 --ahs---- C:\WINDOWS\system32\icwrblef.ini
2007-12-30 21:13 . 2007-12-30 21:13 0 --a------ C:\s59o
2007-12-30 16:12 . 2007-12-30 16:12 0 --a------ C:\s5r0
2007-12-29 21:10 . 2008-01-01 18:53 <DIR> d-------- C:\Program Files\IrfanView
2007-12-29 20:51 . 2007-12-29 20:52 <DIR> d-------- C:\Documents and Settings\Doma\Data aplikací\BitTorrent
2007-12-29 20:28 . 2007-12-29 23:53 <DIR> d-------- C:\Documents and Settings\Doma\Data aplikací\uTorrent
2007-12-29 06:21 . 2007-12-29 06:21 1,031,259 --ahs---- C:\WINDOWS\system32\gqmnxjsr.ini
2007-12-28 16:53 . 2008-01-01 18:53 <DIR> d-------- C:\Program Files\FreeHost Launcher
2007-12-28 06:22 . 2007-12-29 06:21 1,031,199 --ahs---- C:\WINDOWS\system32\ujnauoxb.ini
2007-12-27 19:20 . 2007-12-27 19:20 <DIR> d-------- C:\Program Files\Ubi Soft
2007-12-27 17:31 . 2007-12-27 17:31 0 --a------ C:\s5eg.2
2007-12-27 17:30 . 2007-12-27 17:30 0 --a------ C:\s5eg.1
2007-12-27 17:30 . 2007-12-27 17:30 0 --a------ C:\s5eg
2007-12-27 10:33 . 2007-12-27 10:33 192,512 --a------ C:\WINDOWS\system32\UAService7.exe
2007-12-27 10:30 . 2007-12-27 10:57 <DIR> d-------- C:\Program Files\Codemasters
2007-12-26 21:40 . 2007-12-26 22:32 <DIR> d-------- C:\Program Files\Oberon Media
2007-12-26 20:53 . 2007-12-30 14:51 <DIR> d-------- C:\iEntertainment Network
2007-12-26 10:32 . 2007-12-28 14:14 <DIR> d-------- C:\Download
2007-12-26 09:06 . 2007-12-26 09:06 <DIR> d-------- C:\OpenSSL
2007-12-26 09:06 . 2007-12-26 09:06 155,648 --a------ C:\WINDOWS\system32\libssl32.dll
2007-12-26 00:14 . 2007-12-26 00:15 <DIR> d-------- C:\Program Files\DivX
2007-12-25 16:33 . 2007-12-25 16:33 <DIR> d-------- C:\Program Files\Beneton Software
2007-12-25 11:47 . 2008-01-01 18:52 <DIR> d-------- C:\Program Files\Octatec
2007-12-25 11:47 . 2002-02-07 22:58 28,672 --a------ C:\WINDOWS\system32\ISkeyObject.dll
2007-12-24 22:44 . 2007-12-25 12:06 <DIR> d-------- C:\Program Files\Catalencoder
2007-12-24 21:57 . 2007-12-24 21:57 <DIR> d-------- C:\Program Files\Webteh
2007-12-24 18:22 . 2007-12-24 18:22 356,352 --a------ C:\WINDOWS\eSellerateEngine.dll
2007-12-24 15:30 . 2007-12-25 15:30 1,018,428 --ahs---- C:\WINDOWS\system32\geoayywe.ini
2007-12-23 15:13 . 2007-12-23 15:13 <DIR> d-------- C:\Program Files\Plane Arcade
2007-12-23 13:26 . 2007-12-23 13:26 <DIR> d-------- C:\Documents and Settings\Doma\Data aplikací\fltk.org
2007-12-23 13:26 . 2007-12-23 13:26 <DIR> d-------- C:\Documents and Settings\Doma\Data aplikací\flightgear.org
2007-12-23 13:06 . 2007-12-23 13:06 <DIR> d-------- C:\Documents and Settings\Doma\WINDOWS
2007-12-22 18:04 . 2008-01-02 17:14 <DIR> d-------- C:\Program Files\eMule
2007-12-19 15:30 . 2007-12-20 15:07 354 --ahs---- C:\WINDOWS\system32\ihssvrtb.ini
2007-12-17 17:34 . 2007-12-17 17:34 <DIR> d-------- C:\Program Files\Maxis
2007-12-16 16:58 . 2007-12-16 16:58 <DIR> d-------- C:\Program Files\FLVPlayer
2007-12-13 19:31 . 2008-01-01 00:35 <DIR> d-------- C:\Documents and Settings\Doma\Data aplikací\DMCache
2007-12-13 15:02 . 2008-01-01 21:41 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-13 15:02 . 2007-12-13 15:02 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-11 23:34 . 2007-12-11 23:34 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-12-11 23:34 . 2007-12-11 23:34 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-12-09 13:38 . 2007-12-11 20:30 <DIR> d-------- C:\Documents and Settings\Doma\Data aplikací\SecondLife
2007-12-07 20:28 . 2008-01-01 19:50 <DIR> d-------- C:\Program Files\MindArk

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 15:13 --------- d-----w C:\Documents and Settings\Doma\Data aplikací\Azureus
2008-01-02 12:08 --------- d-----w C:\Program Files\Microsoft Games
2008-01-02 09:17 --------- d-----w C:\Program Files\Google
2008-01-01 17:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-01 17:51 --------- d-----w C:\Program Files\Star Downloader
2007-12-31 23:44 --------- d-----w C:\Program Files\ASUS
2007-12-31 20:03 286,720 ------w C:\WINDOWS\Setup1.exe
2007-12-26 16:09 --------- d-----w C:\Program Files\Spyware Terminator
2007-12-25 22:48 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-25 17:09 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2007-12-23 13:56 600 ----a-w C:\Documents and Settings\Doma\Data aplikací\wklnhst.dat
2007-12-20 16:52 --------- d-----w C:\Program Files\FinalBurner
2007-12-13 13:34 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-12-09 12:36 --------- d-----w C:\Program Files\Mafia
2007-12-01 19:09 145,984 ----a-w C:\WINDOWS\system32\bmdafcdr.dll
2007-12-01 18:06 145,984 ----a-w C:\WINDOWS\system32\njmafril.dll
2007-11-30 18:03 145,984 ----a-w C:\WINDOWS\system32\nanlmmpy.dll
2007-11-30 15:13 --------- d-----w C:\Program Files\AviSynth 2.5
2007-11-28 20:53 --------- d-----w C:\Program Files\WinXMedia
2007-11-28 20:51 --------- d-----w C:\Documents and Settings\Doma\Data aplikací\dvdcss
2007-11-28 19:59 --------- d-----w C:\Program Files\Any Video Converter
2007-11-28 17:53 37,376 ----a-w C:\WINDOWS\system32\vtuuutt.dll
2007-11-26 20:22 218,929 ----a-w C:\WINDOWS\Prison Tycoon 2 Uninstaller.exe
2007-11-25 20:28 --------- d-----w C:\Program Files\metal oxide software
2007-11-21 13:45 --------- d-----w C:\Documents and Settings\Doma\Data aplikací\Kazaap
2007-11-21 13:11 --------- d-----w C:\Documents and Settings\Doma\Data aplikací\Everest Labs
2007-11-16 19:54 --------- d-----w C:\Documents and Settings\Doma\Data aplikací\Miranda
2007-11-13 17:53 73,216 ------w C:\WINDOWS\ST6UNST.EXE
2007-11-07 21:51 --------- d-----w C:\Documents and Settings\Doma\Data aplikací\ICQ
2007-11-05 15:13 --------- d-----w C:\Program Files\ICQ6
2007-10-03 22:36 25,600 ----a-w C:\WINDOWS\system32\WS2Fix.exe
2007-01-08 03:26 34,702 ----a-w C:\WINDOWS\Media\Windows Vista Ultimate RTM Sounds.reg
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8E3FBDE2-7DBD-4040-85D9-29BBC559C129}]
2007-11-28 18:53 37376 --a------ C:\WINDOWS\system32\vtuuutt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC0ED239-F573-478E-800D-C0BBE1F0EE79}]
C:\WINDOWS\system32\gebyx.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 15:49 15360]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\nbj.exe" [2006-09-15 13:27 2048000]
"ASUS SmartDoctor"="C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe" [ ]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 15:16 171464]
"AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [ ]
"CS Update"="copy /Y C:\Program Files\ActivationManager\ActivationManager.dll.upd C:\Program Files\ActivationManager\ActivationManager.dll" [ ]
"ares"="C:\Program Files\Ares\Ares.exe" [ ]
"ChristmasTree"="C:\Program Files\ChristmasTree\ChristmasTree.exe" [ ]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [ ]
"eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [2007-05-13 15:57 5308416]

Terfelus · Příspěvekod **Terfelus** » 02 led 2008 17:41

p2p síť používám už hodně dlouho

Příspěvekod **fredik** » 02 led 2008 18:21

Ten log z Combofix se sem nevešel celý, zkopíruj sem ještě ten zbytek od této položky do konce souboru
"eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [2007-05-13 15:57 5308416]

Otestuj tyto soubory na VirusTotall (třeba jen první a poslední a vlož sem výsledky zároveň s zbytkem logu z ComboFix)
C:\WINDOWS\system32\bmdafcdr.dll
C:\WINDOWS\system32\njmafril.dll
C:\WINDOWS\system32\nanlmmpy.dll

Gribese

Gribese

Kdo je online