Tu je log z ComboFixu:ComboFix 12-07-21.01 - GTA SA . 07. 2012 11:17:41.3.1 - x86
Systém Microsoft Windows XP Home Edition 5.1.2600.3.1250.421.1033.18.1791.1259 [GMT 2:00]
Running from: f:\documents and settings\GTA SA\Desktop\ComboFix.exe
Command switches used :: f:\documents and settings\GTA SA\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 3.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
FILE ::
"f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\GoogleUpdate.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\GoogleCrashHandler.exe
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\GoogleCrashHandler64.exe
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\GoogleUpdate.exe
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\GoogleUpdateBroker.exe
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\GoogleUpdateHelper.msi
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\GoogleUpdateOnDemand.exe
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\GoogleUpdateSetup.exe
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdate.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_am.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_ar.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_bg.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_bn.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_ca.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_cs.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_da.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_de.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_el.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_en-GB.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_en.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_es-419.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_es.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_et.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_fa.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_fi.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_fil.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_fr.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_gu.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_hi.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_hr.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_hu.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_id.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_is.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_it.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_iw.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_ja.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_kn.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_ko.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_lt.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_lv.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_ml.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_mr.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_ms.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_nl.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_no.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_pl.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_pt-BR.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_pt-PT.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_ro.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_ru.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_sk.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_sl.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_sr.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_sv.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_sw.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_ta.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_te.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_th.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_tr.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_uk.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_ur.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_vi.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_zh-CN.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\goopdateres_zh-TW.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\psmachine.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\1.3.21.115\psuser.dll
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.21.115\GoogleUpdateSetup.exe
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\20.0.1132.57\20.0.1132.57_20.0.1132.47_chrome_updater.exe
f:\documents and settings\GTA SA\Local Settings\Application Data\Google\Update\Download\{D0AB2EBC-931B-4013-9FEB-C9C4C2225C8C}\3.2.4.8431\googletalkpluginaccel.msi
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_VBoxNetFlt
.
.
((((((((((((((((((((((((( Files Created from 2012-06-24 to 2012-07-24 )))))))))))))))))))))))))))))))
.
.
2012-07-23 13:37 . 2012-07-23 13:37 12920 ----a-w- f:\windows\system32\apl001.sys
2012-07-23 13:37 . 2012-07-23 13:37 10872 ----a-w- f:\windows\system32\apf001.sys
2012-07-23 13:26 . 2012-07-23 13:26 -------- d-----w- f:\documents and settings\GTA SA\Local Settings\Application Data\Aeria Games
2012-07-23 13:24 . 2012-07-23 13:24 -------- d-----w- F:\ProgramData
2012-07-23 12:06 . 2012-07-23 12:06 -------- d-sh--w- f:\windows\system32\AI_RecycleBin
2012-07-23 12:06 . 2012-07-23 12:06 -------- d-----w- f:\program files\Aeria Games
2012-07-23 11:53 . 2012-07-23 11:54 -------- d-----w- f:\documents and settings\GTA SA\Local Settings\Application Data\Akamai
2012-07-23 11:53 . 2012-07-23 12:06 -------- d-----w- F:\AeriaGames
2012-07-22 09:55 . 2012-07-22 09:55 -------- d-----w- f:\documents and settings\GTA SA\Application Data\Malwarebytes
2012-07-22 09:53 . 2012-07-22 09:53 -------- d-----w- f:\documents and settings\All Users\Application Data\Malwarebytes
2012-07-22 09:53 . 2012-07-03 11:46 22344 ----a-w- f:\windows\system32\drivers\mbam.sys
2012-07-22 09:53 . 2012-07-22 09:55 -------- d-----w- f:\program files\Malwarebytes' Anti-Malware
2012-07-21 22:20 . 2012-07-23 19:22 -------- d-----w- f:\documents and settings\GTA SA\Application Data\4Sync
2012-07-21 22:19 . 2012-07-21 22:19 -------- d-----w- f:\documents and settings\All Users\Application Data\4Sync
2012-07-21 22:19 . 2012-07-21 22:19 -------- d-----w- f:\program files\4Sync
2012-07-21 21:16 . 2012-07-21 21:16 -------- d-----w- f:\program files\Lavalys
2012-07-21 21:13 . 2012-07-21 21:13 -------- d-----w- f:\documents and settings\GTA SA\Local Settings\Application Data\AOL
2012-07-21 21:12 . 2012-07-22 08:52 -------- d-----w- f:\program files\ICQ7.2
2012-07-21 20:47 . 2012-07-21 20:47 -------- d-----w- f:\program files\iWEB Studio
2012-07-21 20:47 . 2012-07-21 20:47 796672 ----a-w- f:\windows\GPInstall.exe
2012-07-21 19:10 . 2012-07-22 11:47 -------- d-----w- f:\program files\Metin2
2012-07-21 13:34 . 2012-07-21 13:57 -------- d-----w- f:\program files\Counter-Strike 1.6
2012-07-21 13:23 . 2012-07-21 13:23 654944 ----a-w- f:\windows\system32\xsherlock.xem
2012-07-21 13:16 . 2012-03-27 17:13 230920 ----a-w- f:\windows\system32\EPWZCmnCtrl.dll
2012-07-21 13:15 . 2012-07-21 13:16 -------- d-----w- f:\documents and settings\All Users\Application Data\WEBZEN
2012-07-21 13:04 . 2012-07-21 22:17 -------- d-----w- f:\program files\Overwolf
2012-07-21 13:02 . 2012-07-21 13:10 -------- d-----w- f:\documents and settings\GTA SA\Local Settings\Application Data\Overwolf
2012-07-21 13:02 . 2012-07-21 13:02 -------- d-----w- f:\program files\NVIDIA Corporation
2012-07-21 12:24 . 2012-07-21 13:26 -------- d-----w- f:\program files\WEBZEN
2012-07-16 07:23 . 2012-07-24 09:06 -------- d-----w- f:\documents and settings\GTA SA\Application Data\.minecraft
2012-07-16 06:53 . 2012-07-16 06:53 -------- d-----w- f:\documents and settings\LocalService\Application Data\TuneUp Software
2012-07-12 12:32 . 2012-07-12 12:32 9822920 ----a-w- f:\windows\system32\FlashPlayerInstaller.exe
2012-07-12 11:09 . 2010-02-12 10:03 293376 ------w- f:\windows\system32\browserchoice.exe
2012-07-12 11:01 . 2012-01-11 19:06 3072 -c----w- f:\windows\system32\dllcache\iacenc.dll
2012-07-12 11:01 . 2012-01-11 19:06 3072 ------w- f:\windows\system32\iacenc.dll
2012-07-12 11:00 . 2011-02-17 12:32 5120 ----a-w- f:\windows\system32\xpsp4res.dll
2012-07-11 12:54 . 2012-07-11 12:55 -------- d-----w- F:\Converted
2012-07-11 12:51 . 2012-07-11 12:51 -------- d-----w- f:\program files\GuerillaSoft
2012-07-11 12:48 . 2012-07-11 12:48 -------- d-----w- f:\program files\AllMusicConverter Media Suite
2012-07-11 12:45 . 2012-05-31 13:38 252928 ----a-w- f:\windows\system32\GSService.exe
2012-07-11 12:45 . 2012-06-01 13:20 260608 ----a-w- f:\windows\system32\snmvtsvc.exe
2012-07-11 12:45 . 2012-06-05 08:36 14392 ----a-w- f:\windows\system32\MusCVideo.dll
2012-07-11 12:45 . 2012-06-05 08:36 5688 ----a-w- f:\windows\system32\MusCVideo.sys
2012-07-11 12:45 . 2012-06-05 08:36 23608 ----a-w- f:\windows\system32\MusCAudio.sys
2012-07-11 12:45 . 2012-06-05 08:36 23608 ----a-w- f:\windows\system32\drivers\MusCAudio.sys
2012-07-11 12:45 . 2012-07-11 12:49 -------- d-----w- f:\program files\AllMusicConverter
2012-07-10 10:17 . 2012-07-10 10:17 -------- d-sh--w- f:\documents and settings\All Users\Application Data\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2012-07-10 10:17 . 2012-07-10 10:17 -------- d--h--w- f:\documents and settings\All Users\Application Data\Common Files
2012-07-04 09:29 . 2012-07-04 09:29 -------- d-----w- f:\documents and settings\GTA SA\Application Data\SynthMaker
2012-07-04 06:23 . 2008-10-27 08:04 235856 ----a-w- f:\windows\system32\xactengine3_3.dll
2012-07-04 06:23 . 2008-10-27 08:04 23376 ----a-w- f:\windows\system32\X3DAudio1_5.dll
2012-07-04 06:23 . 2008-07-31 08:41 68616 ----a-w- f:\windows\system32\XAPOFX1_1.dll
2012-07-04 06:23 . 2008-07-31 08:40 509448 ----a-w- f:\windows\system32\XAudio2_2.dll
2012-07-04 06:23 . 2008-07-31 08:41 238088 ----a-w- f:\windows\system32\xactengine3_2.dll
2012-07-04 06:23 . 2008-07-10 09:01 467984 ----a-w- f:\windows\system32\d3dx10_39.dll
2012-07-04 06:23 . 2008-07-10 09:00 1493528 ----a-w- f:\windows\system32\D3DCompiler_39.dll
2012-07-04 06:23 . 2008-07-10 09:00 3851784 ----a-w- f:\windows\system32\D3DX9_39.dll
2012-07-04 06:12 . 2012-07-04 07:08 -------- d-----w- F:\MogreSDK
2012-07-03 11:21 . 2012-07-03 11:21 -------- d-----w- f:\documents and settings\GTA SA\Application Data\Image-Line
2012-07-03 10:26 . 2012-07-03 10:26 -------- d-----w- f:\program files\ASIO4ALL v2
2012-07-02 10:56 . 2012-07-04 10:45 -------- d-----w- f:\program files\Electronic Arts
2012-07-02 08:09 . 2012-07-02 08:09 -------- d-----w- f:\program files\uTorrent
2012-06-28 10:09 . 2012-07-21 22:20 -------- d-----w- f:\documents and settings\GTA SA\Application Data\Dropbox
2012-06-28 06:56 . 2006-04-12 10:11 147456 ----a-w- f:\windows\system32\rsnpstd3.dll
2012-06-28 06:56 . 2006-06-19 09:43 262144 ----a-w- f:\windows\tsnpstd3.exe
2012-06-28 06:56 . 2004-11-08 11:41 94208 ----a-w- f:\windows\amcap.exe
2012-06-28 06:56 . 2012-06-28 06:56 -------- d-----w- f:\program files\Common Files\StarCam
2012-06-28 06:45 . 2012-07-12 12:32 426184 ----a-w- f:\windows\system32\FlashPlayerApp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-12 12:32 . 2011-05-25 05:30 70344 ----a-w- f:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-04 06:34 . 2010-02-05 13:46 112640 -c--a-w- f:\documents and settings\All Users\Application Data\Microsoft\VCExpress\9.0\1033\ResourceCache.dll
2012-07-04 06:34 . 2009-09-27 19:52 416 -c--a-w- f:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2012-06-13 13:19 . 2004-08-04 12:00 1866112 ----a-w- f:\windows\system32\win32k.sys
2012-06-05 15:50 . 2008-09-03 11:18 1372672 ----a-w- f:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-04 12:00 1172480 ----a-w- f:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2004-08-04 12:00 152576 ----a-w- f:\windows\system32\schannel.dll
2012-06-02 13:19 . 2007-07-30 17:18 22040 ----a-w- f:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2008-08-09 01:32 329240 ----a-w- f:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2008-08-09 01:32 219160 ----a-w- f:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2008-08-09 01:32 210968 ----a-w- f:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2007-07-30 17:19 15384 ----a-w- f:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2008-08-09 01:32 53784 ----a-w- f:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2008-08-09 01:32 35864 ----a-w- f:\windows\system32\wups.dll
2012-06-02 13:19 . 2007-07-30 17:19 45080 ----a-w- f:\windows\system32\wups2.dll
2012-06-02 13:19 . 2007-07-30 17:19 15384 ----a-w- f:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2004-08-04 12:00 97304 ----a-w- f:\windows\system32\cdm.dll
2012-06-02 13:19 . 2007-07-30 17:18 17944 ----a-w- f:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2008-08-09 01:32 577048 ----a-w- f:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2008-08-09 01:32 1933848 ----a-w- f:\windows\system32\wuaueng.dll
2012-05-31 13:22 . 2004-08-04 12:00 599040 ----a-w- f:\windows\system32\crypt32.dll
2012-05-15 15:39 . 2004-08-04 12:00 832512 ----a-w- f:\windows\system32\wininet.dll
2012-05-04 13:12 . 2004-08-04 12:00 2192640 ----a-w- f:\windows\system32\ntoskrnl.exe
2012-05-04 12:32 . 2004-08-03 22:59 2069120 ----a-w- f:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2008-08-09 01:30 139656 ----a-w- f:\windows\system32\drivers\rdpwd.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2012-07-23_10.44.36 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-07-24 09:32 . 2012-07-24 09:32 16384 f:\windows\temp\Perflib_Perfdata_598.dat
+ 2012-07-23 12:06 . 2012-07-23 12:06 34494 f:\windows\Installer\{A696A783-CE10-4920-A03F-82FC6EE9C759}\application.exe
+ 2011-01-07 13:39 . 2011-01-07 13:39 768848 f:\windows\system32\msvcr100.dll
+ 2011-01-07 13:39 . 2011-01-07 13:39 421200 f:\windows\system32\msvcp100.dll
+ 2012-07-23 12:06 . 2012-07-23 12:06 1394688 f:\windows\Installer\4fd7ba.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4SyncOverlay1]
@="{2012DE06-50C0-48BD-ACDE-88F95D4CAD1F}"
[HKEY_CLASSES_ROOT\CLSID\{2012DE06-50C0-48BD-ACDE-88F95D4CAD1F}]
2012-05-25 13:32 1338880 ----a-w- f:\program files\4Sync\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4SyncOverlay2]
@="{C72C6188-BEF2-46E5-A89A-52F0ED75219E}"
[HKEY_CLASSES_ROOT\CLSID\{C72C6188-BEF2-46E5-A89A-52F0ED75219E}]
2012-05-25 13:32 1338880 ----a-w- f:\program files\4Sync\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4SyncOverlay3]
@="{C92F6BC2-AF61-4C0E-80E0-939B8282DDB7}"
[HKEY_CLASSES_ROOT\CLSID\{C92F6BC2-AF61-4C0E-80E0-939B8282DDB7}]
2012-05-25 13:32 1338880 ----a-w- f:\program files\4Sync\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4SyncOverlay4]
@="{CB1EFEF8-D5E0-49D1-B768-41B48B1D7803}"
[HKEY_CLASSES_ROOT\CLSID\{CB1EFEF8-D5E0-49D1-B768-41B48B1D7803}]
2012-05-25 13:32 1338880 ----a-w- f:\program files\4Sync\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="f:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-10-07 1461080]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="f:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="f:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities 2012\WinStyler\tu_logonui.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi6"=mapledxp.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Antanda"=f:\docume~1\GTASA~1\LOCALS~1\Temp\InstallValidator.exe
"CTFMON.EXE"=f:\windows\system32\ctfmon.exe
"Taskbar Shuffle"=f:\program files\Taskbar Shuffle\taskbarshuffle.exe
"4Sync"="f:\program files\4Sync\4Sync.exe" -startup
"Akamai NetSession Interface"="f:\documents and settings\GTA SA\Local Settings\Application Data\Akamai\netsession_win.exe"
"ICQ"="f:\program files\ICQ7.2\ICQ.exe" silent loginmode=4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Microsoft Default Manager"="f:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
"ATICCC"="f:\program files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
"Google Desktop Search"="f:\program files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"SunJavaUpdateSched"="f:\program files\Common Files\Java\Java Update\jusched.exe"
"tsnpstd3"=f:\windows\tsnpstd3.exe
"snpstd3"=f:\windows\vsnpstd3.exe
"Aeria Ignite"="f:\program files\Aeria Games\Ignite\aeriaignite.exe" silent
"Malwarebytes' Anti-Malware"="f:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"f:\\Program Files\\Opera\\opera.exe"=
"f:\\Program Files\\Nero\\Nero8\\Nero ShowTime\\ShowTime.exe"=
"f:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"f:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"f:\\Program Files\\Sun\\SDK\\jdk\\bin\\java.exe"=
"f:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"f:\\Program Files\\MSI\\MyGuard Live\\MyGuard Live.exe"=
"f:\\Program Files\\VertrigoServ\\Mysql\\bin\\v_mysqld.exe"=
"f:\\Program Files\\VertrigoServ\\Apache\\bin\\v_apache.exe"=
"f:\\Documents and Settings\\GTA SA\\temp\\TeamViewer\\Version4\\TeamViewer.exe"=
"f:\\Documents and Settings\\GTA SA\\temp\\TeamViewer\\Version5\\TeamViewer.exe"=
"f:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"f:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"f:\\Program Files\\LegendenMt2\\client.exe"=
"f:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=
"f:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
"f:\\Documents and Settings\\GTA SA\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"f:\\Program Files\\uTorrent\\uTorrent.exe"=
"f:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"f:\\Program Files\\Skype\\Phone\\Skype.exe"=
"f:\\Program Files\\Opera\\pluginwrapper\\opera_plugin_wrapper.exe"=
"f:\\Program Files\\Counter-Strike 1.6\\hl.exe"=
"f:\\Program Files\\ICQ7.2\\ICQ.exe"=
"f:\\Program Files\\ICQ7.2\\aolload.exe"=
"f:\\Program Files\\Metin2\\metin2.exe"=
"f:\\Program Files\\Metin2\\hshield\\hsupdate.exe"=
"f:\\Documents and Settings\\GTA SA\\Local Settings\\Application Data\\Akamai\\netsession_win.exe"=
"f:\\AeriaGames\\Wolfteam\\Wolfteam.bin"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56965:TCP"= 56965:TCP:Pando Media Booster
"56965:UDP"= 56965:UDP:Pando Media Booster
"56140:TCP"= 56140:TCP:Pando Media Booster
"56140:UDP"= 56140:UDP:Pando Media Booster
"1134:TCP"= 1134:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R0 sptd;sptd;f:\windows\system32\drivers\sptd.sys [21. 8. 2008 20:41 691696]
R1 epfwtdir;epfwtdir;f:\windows\system32\drivers\epfwtdir.sys [1. 7. 2008 10:04 35168]
R1 eusk2par;EUTRON SmartKey Parallel Driver;f:\windows\system32\drivers\eusk2par.sys [24. 1. 2009 18:09 24786]
R1 mapledxp;mapledxp;f:\windows\system32\drivers\mapledxp.sys [8. 5. 2010 10:48 24720]
R2 ekrn;Eset Service;f:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [7. 10. 2009 10:16 472280]
R2 OMSI download service;Sony Ericsson OMSI download service;f:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [30. 11. 2009 15:30 90112]
R3 MBAMProtector;MBAMProtector;f:\windows\system32\drivers\mbam.sys [22. 7. 2012 11:53 22344]
R3 MusCAudio;MusCAudio;f:\windows\system32\drivers\MusCAudio.sys [11. 7. 2012 14:45 23608]
R3 SDVPlus;Pinnacle Studio DVplus WDM Renderer;f:\windows\system32\drivers\SDVPlus.sys [9. 8. 2008 3:43 42102]
R3 seehcri;Sony Ericsson seehcri Device Driver;f:\windows\system32\drivers\seehcri.sys [30. 11. 2009 15:38 27632]
S2 MBAMService;MBAMService;f:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [22. 7. 2012 11:53 655944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;f:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [28. 6. 2012 8:45 250056]
S3 apf001;apf001;f:\aeriagames\Wolfteam\apf001.sys [15. 3. 2012 18:56 10872]
S3 eusk3usb;SmartKey 3 USB;f:\windows\system32\drivers\eusk3usb.sys [24. 1. 2009 18:09 45534]
S3 ggflt;SEMC USB Flash Driver Filter;f:\windows\system32\drivers\ggflt.sys [11. 10. 2008 9:32 13224]
S3 GSService;GSService;f:\windows\system32\GSService.exe [11. 7. 2012 14:45 252928]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);f:\windows\system32\drivers\s0016bus.sys [30. 11. 2009 15:32 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;f:\windows\system32\drivers\s0016mdfl.sys [30. 11. 2009 15:32 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;f:\windows\system32\drivers\s0016mdm.sys [30. 11. 2009 15:32 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);f:\windows\system32\drivers\s0016mgmt.sys [30. 11. 2009 15:32 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);f:\windows\system32\drivers\s0016nd5.sys [30. 11. 2009 15:32 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;f:\windows\system32\drivers\s0016obex.sys [30. 11. 2009 15:32 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);f:\windows\system32\drivers\s0016unic.sys [30. 11. 2009 15:32 115752]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);f:\windows\system32\drivers\s1018bus.sys [30. 11. 2009 15:32 86824]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;f:\windows\system32\drivers\s1018mdfl.sys [30. 11. 2009 15:32 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;f:\windows\system32\drivers\s1018mdm.sys [30. 11. 2009 15:32 114728]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);f:\windows\system32\drivers\s1018mgmt.sys [30. 11. 2009 15:32 106208]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);f:\windows\system32\drivers\s1018nd5.sys [30. 11. 2009 15:32 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;f:\windows\system32\drivers\s1018obex.sys [30. 11. 2009 15:32 104744]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);f:\windows\system32\drivers\s1018unic.sys [30. 11. 2009 15:33 109864]
S3 SMServer;SMServer;f:\windows\system32\snmvtsvc.exe [11. 7. 2012 14:45 260608]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;f:\windows\system32\drivers\VBoxNetAdp.sys [4. 11. 2011 14:42 104752]
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-24 f:\windows\Tasks\Adobe Flash Player Updater.job
- f:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-28 12:32]
.
2009-01-06 f:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8220263802.job
- f:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]
.
.
------- Supplementary Scan -------
.
uStart Page =
hxxp://google.cz/uDefault_Search_URL =
hxxp://www.google.com/ieuInternet Settings,ProxyOverride = *.local;<local>
uSearchAssistant =
hxxp://www.google.com/ieuSearchURL,(Default) =
hxxp://www.google.com/search?q=%s
IE: E&xportovať do programu Microsoft Excel - f:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Link to &MidpX - f:\program files\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm
IE: Sothink SWF Catcher - f:\program files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - f:\documents and settings\GTA SA\Application Data\Mozilla\Firefox\Profiles\gb5xhkwq.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage -
hxxp://www.msn.comFF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - f:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: SpeedBit Video Downloader: {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - f:\program files\SpeedBit Video Downloader\SPFireFox
FF - Ext: Java Quick Starter:
jqs@sun.com - f:\program files\Java\jre6\lib\deploy\jqs\ff
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2012-07-24 11:33
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-515967899-1957994488-682003330-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
[HKEY_USERS\S-1-5-21-515967899-1957994488-682003330-1007\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:33,30,fe,fb,62,b9,f6,79,6d,c2,45,85,79,e5,7e,cb,ff,53,7b,6e,d4,2b,4f,
2a,4e,21,2b,5a,6b,a9,46,ac,8f,75,a7,eb,5a,6d,37,13,69,ef,1a,9a,52,c6,7b,29,\
"??"=hex:a7,fe,27,8e,5f,cd,16,f0,f2,2c,f2,b2,ea,cb,b9,ac
.
[HKEY_USERS\S-1-5-21-515967899-1957994488-682003330-1007\Software\SecuROM\License information*]
"datasecu"=hex:fe,c4,57,4c,8c,c6,ab,77,5e,5e,d6,68,a9,4d,a5,51,ce,c9,94,62,13,
53,d9,6b,e0,d9,69,73,05,57,27,fc,a1,fe,ca,e5,b9,9d,96,a4,d2,54,cf,36,4a,15,\
"rkeysecu"=hex:2b,bd,85,26,0b,f2,a6,bd,94,ae,b2,1e,23,26,14,d4
.
[HKEY_LOCAL_MACHINE\software\Classes\FlashProp.FlashProp\CurVer]
@DACL=(02 0000)
@="FlashProp.FlashProp.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\FlashProp.FlashProp.1\CLSID]
@DACL=(02 0000)
@="{1171A62F-05D2-11D1-83FC-00A0C9089C5A}"
.
[HKEY_LOCAL_MACHINE\software\Classes\ShockwaveFlash.ShockwaveFlash\Shell]
@DACL=(02 0000)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1084)
f:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(2924)
f:\windows\system32\WININET.dll
f:\program files\4Sync\ShellExt.dll
f:\progra~1\WINDOW~2\wmpband.dll
f:\windows\system32\msi.dll
f:\windows\system32\ieframe.dll
f:\windows\system32\WPDShServiceObj.dll
f:\program files\Stardock\Object Desktop\IconPackager\iprepair.dll
f:\program files\4Sync\ShellCp.dll
f:\program files\Microsoft Virtual PC\VPCShExH.DLL
f:\windows\system32\PortableDeviceTypes.dll
f:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
f:\windows\system32\Ati2evxx.exe
f:\windows\system32\Ati2evxx.exe
f:\program files\Bonjour\mDNSResponder.exe
f:\program files\Java\jre6\bin\jqs.exe
f:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
f:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
f:\windows\system32\IoctlSvc.exe
f:\windows\system32\PnkBstrA.exe
f:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
f:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
f:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
f:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
f:\windows\system32\wbem\wmiapsrv.exe
f:\program files\Opera\opera.exe
f:\program files\Opera\pluginwrapper\opera_plugin_wrapper.exe
.
**************************************************************************
.
Completion time: 2012-07-24 11:40:07 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-24 09:40
ComboFix2.txt 2012-07-23 21:08
ComboFix3.txt 2012-07-23 10:54
.
Pre-Run: 6 159 175 680 bytes free
Post-Run: 6 123 687 936 voľných bajtov
.
- - End Of File - - 42EC122FCFF90649946B1883DAE7B33E
Tu je log z HiJackThis:Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:43:03, on 24. 7. 2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17110)
Boot mode: Normal
Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Bonjour\mDNSResponder.exe
F:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
F:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
F:\WINDOWS\system32\IoctlSvc.exe
F:\WINDOWS\system32\PnkBstrA.exe
F:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
F:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
F:\WINDOWS\system32\wbem\wmiapsrv.exe
F:\WINDOWS\explorer.exe
F:\Program Files\Opera\opera.exe
F:\Program Files\Opera\pluginwrapper\opera_plugin_wrapper.exe
F:\WINDOWS\system32\notepad.exe
F:\Documents and Settings\GTA SA\Local Settings\Application Data\Opera\Opera\temporary_downloads\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://google.cz/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - F:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PDF-XChange Viewer IE-Plugin - {C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F} - F:\Program Files\Tracker Software\PDF-XChange Viewer\pdf-viewer\PDFXCviewIEPlugin.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - F:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Kwyshell MidpX BHO - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - F:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O2 - BHO: GrabberObj Class - {FF7C3CF0-4B15-11D1-ABED-709549C10000} - F:\PROGRA~1\SPEEDB~1\Toolbar\grabber.dll (file missing)
O3 - Toolbar: Kwyshell MidpX - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - F:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O4 - HKLM\..\Run: [egui] "F:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel -
res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Link to &MidpX - F:\Program Files\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm
O8 - Extra context menu item: Sothink SWF Catcher - F:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Rip YouTube File - {38E51477-DDB4-4aed-9D61-D0C193E10749} - F:\Program Files\AllMusicConverter\YouTubeRipper.dll
O9 - Extra 'Tools' menuitem: Rip YouTube file embedded in this page - {38E51477-DDB4-4aed-9D61-D0C193E10749} - F:\Program Files\AllMusicConverter\YouTubeRipper.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - F:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - F:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - F:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - F:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\Program Files\Overwolf\SKYPE4~2.DLL (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - F:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - F:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - F:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - F:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - F:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - F:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - F:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GSService - Unknown owner - F:\WINDOWS\system32\GSService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - F:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - F:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - F:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - F:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - F:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - F:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SMServer - SMServer - F:\WINDOWS\system32\snmvtsvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O24 - Desktop Component 0: (no name) - file:///F:/DOCUME~1/GTASA~1/LOCALS~1/Temp/msohtml1/01/clip_image001.gif
--
End of file - 8487 bytes
Tu je log z aswMBR:aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-07-24 11:54:32
-----------------------------
11:54:32.062 OS Version: Windows 5.1.2600 Service Pack 3
11:54:32.062 Number of processors: 1 586 0x207
11:54:32.062 ComputerName: VLASTNIK-0C199D UserName: GTA SA
11:54:33.562 Initialize success
11:54:40.062 Disk 0 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e
11:54:40.062 Disk 0 Vendor: ST3320620A 3.AAF Size: 305245MB BusType: 3
11:54:40.062 Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-24
11:54:40.062 Disk 1 Vendor: ST380021A 3.19 Size: 76319MB BusType: 3
11:54:40.078 Disk 1 MBR read successfully
11:54:40.078 Disk 1 MBR scan
11:54:40.078 Disk 1 Windows XP default MBR code
11:54:40.078 Disk 1 Partition 1 80 (A) 07 HPFS/NTFS NTFS 40005 MB offset 63
11:54:40.093 Disk 1 Partition 2 00 07 HPFS/NTFS NTFS 36310 MB offset 81931500
11:54:40.093 Disk 1 scanning sectors +156296385
11:54:40.156 Disk 1 scanning F:\WINDOWS\system32\drivers
11:54:56.093 Service scanning
11:55:11.468 Service sptd F:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32
11:55:15.750 Modules scanning
11:55:27.343 Disk 1 trace - called modules:
11:55:27.359 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sphx.sys >>UNKNOWN [0x8a73a938]<<
11:55:27.375 1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0x8a64aab8]
11:55:27.375 3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\00000078[0x8a6f37b0]
11:55:27.375 5 ACPI.sys[f74a3620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-24[0x8a652030]
11:55:27.375 Scan finished successfully
11:55:43.484 Disk 1 MBR has been saved successfully to "F:\Documents and Settings\GTA SA\Desktop\MBR.dat"
11:55:43.500 The log file has been saved successfully to "F:\Documents and Settings\GTA SA\Desktop\aswMBR.txt"
Tu je log z RogueKiller:RogueKiller V7.6.4 [07/17/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback:
http://www.geekstogo.com/forum/files/fi ... guekiller/Blog:
http://tigzyrk.blogspot.comOperačný systém: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spustené v : Normálny režim
Užívateľ: GTA SA [Práva Správcu]
Režim: Kontrola -- Dátum: 07/24/2012 11:59:45
¤¤¤ Škodlivé procesy: 0 ¤¤¤
¤¤¤ Záznamy Registrov: 1 ¤¤¤
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Zvláštne súbory / Adresáre: ¤¤¤
[Faked.Drv][FAKED] ati1rvxx.sys : f:\windows\system32\drivers\ati1rvxx.sys --> CANNOT FIX
[Faked.Drv][FAKED] ati2mtaa.sys : f:\windows\system32\drivers\ati2mtaa.sys --> CANNOT FIX
[Faked.Drv][FAKED] atinxsxx.sys : f:\windows\system32\drivers\atinxsxx.sys --> CANNOT FIX
[Faked.Drv][FAKED] fltmgr.sys : f:\windows\system32\drivers\fltmgr.sys --> CANNOT FIX
[Faked.Drv][FAKED] mf.sys : f:\windows\system32\drivers\mf.sys --> CANNOT FIX
[Faked.Drv][FAKED] mtlstrm.sys : f:\windows\system32\drivers\mtlstrm.sys --> CANNOT FIX
[Faked.Drv][FAKED] nv4_mini.sys : f:\windows\system32\drivers\nv4_mini.sys --> CANNOT FIX
[Faked.Drv][FAKED] nwlnknb.sys : f:\windows\system32\drivers\nwlnknb.sys --> CANNOT FIX
[Faked.Drv][FAKED] rdpdr.sys : f:\windows\system32\drivers\rdpdr.sys --> CANNOT FIX
[Faked.Drv][FAKED] slnt7554.sys : f:\windows\system32\drivers\slnt7554.sys --> CANNOT FIX
¤¤¤ Ovládač: [NAHRATÉ] ¤¤¤
IRP[IRP_MJ_CREATE] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7849B40)
IRP[IRP_MJ_CLOSE] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7849B40)
IRP[IRP_MJ_DEVICE_CONTROL] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7849B40)
IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7849B40)
IRP[IRP_MJ_SYSTEM_CONTROL] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7849B40)
IRP[IRP_MJ_DEVICE_CHANGE] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7849B40)
¤¤¤ Nákaza : ¤¤¤
¤¤¤ Súbor HOSTS: ¤¤¤
127.0.0.1 localhost
¤¤¤ Kontrola MBR: ¤¤¤
+++++ PhysicalDrive0: ST3320620A +++++
--- User ---
[MBR] a653c9a45cb08e17cdc285d3035c1605
[BSP] e0f7bd82ab7ccd1909b708e086da3757 : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 199996 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409593240 | Size: 49999 Mo
2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 511991550 | Size: 55246 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: ST380021A +++++
--- User ---
[MBR] da9b7e4e73f7dbc590d8767da054c5ab
[BSP] e51a38174c1a67007432731bd4a0fcc6 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 40005 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 81931500 | Size: 36310 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Dokončené : << RKreport[1].txt >>
RKreport[1].txt
)