SDFix: Version 1.131
Run by Romźa on 2008-01-24 at 18:43
Microsoft Windows XP [Verze 5.1.2600]
Running From: C:\DOCUME~1\ROMA~1\Plocha\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting...
Normal Mode:
Checking Files:
No Trojan Files Found
Removing Temp Files...
ADS Check:
C:\WINDOWS
No streams found.
C:\WINDOWS\explorer.exe
No streams found.
C:\WINDOWS\system32
No streams found.
C:\WINDOWS\system32\svchost.exe
No streams found.
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.
Final Check:
catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 18:47:53
Windows 5.1.2600 Service Pack 2 NTFS
detected NTDLL code modification:
ZwClose
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:98,3b,28,6c,0c,22,8e,f2,11,35,ac,37,5e,f3,f9,3b,d0,7c,7c,1c,6a,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,a1,3b,cd,f0,ce,95,79,c5,01,f0,c6,d1,bf,90,9f,df,27,..
"khjeh"=hex:99,8e,78,66,27,37,75,73,ea,84,1f,5f,1b,0f,52,0e,fc,78,8c,e6,5d,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:db,fa,7c,c7,41,5b,2c,6b,e4,d4,f9,2e,f2,c9,ac,e5,f2,66,7f,f9,1b,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:98,3b,28,6c,0c,22,8e,f2,11,35,ac,37,5e,f3,f9,3b,d0,7c,7c,1c,6a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,a1,3b,cd,f0,ce,95,79,c5,01,f0,c6,d1,bf,90,9f,df,27,..
"khjeh"=hex:99,8e,78,66,27,37,75,73,ea,84,1f,5f,1b,0f,52,0e,fc,78,8c,e6,5d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:db,fa,7c,c7,41,5b,2c,6b,e4,d4,f9,2e,f2,c9,ac,e5,f2,66,7f,f9,1b,..
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cursors\Schemes]
"\f\1e?r?n?\xe9? ?u?k?a?z?a?t?e?l?e? ?"="C:\WINDOWS\cursors\arrow_r.cur,C:\WINDOWS\cursors\help_r.cur,C:\WINDOWS\cursors\wait_r.cur,C:\WINDOWS\cursors\busy_r.cur,C:\WINDOWS\cursors\cross_r.cur,C:\WINDOWS\cursors\beam_r.cur,C:\WINDOWS\cursors\pen_r.cur,C:\WINDOWS\cursors\no_r.cur,C:\WINDOWS\cursors\size4_r.cur,C:\WINDOWS\cursors\size3_r.cur,C:\WINDOWS\cursors\size2_r.cur,C:\WINDOWS\cursors\size1_r.cur,C:\WINDOWS\cursors\move_r.cur,C:\WINDOWS\cursors\up_r.cur"
"\f\1e?r?n?\xe9? ?u?k?a?z?a?t?e?l?e? ?(?v?e?l?k?\xe9?)?"="C:\WINDOWS\cursors\arrow_rm.cur,C:\WINDOWS\cursors\help_rm.cur,C:\WINDOWS\cursors\wait_rm.cur,C:\WINDOWS\cursors\busy_rm.cur,C:\WINDOWS\cursors\cross_rm.cur,C:\WINDOWS\cursors\beam_rm.cur,C:\WINDOWS\cursors\pen_rm.cur,C:\WINDOWS\cursors\no_rm.cur,C:\WINDOWS\cursors\size4_rm.cur,C:\WINDOWS\cursors\size3_rm.cur,C:\WINDOWS\cursors\size2_rm.cur,C:\WINDOWS\cursors\size1_rm.cur,C:\WINDOWS\cursors\move_rm.cur,C:\WINDOWS\cursors\up_rm.cur"
"\f\1e?r?n?\xe9? ?u?k?a?z?a?t?e?l?e? ?(?n?e?j?v?\e\1t?a\1\xed?)?"="C:\WINDOWS\cursors\arrow_rl.cur,C:\WINDOWS\cursors\help_rl.cur,C:\WINDOWS\cursors\wait_rl.cur,C:\WINDOWS\cursors\busy_rl.cur,C:\WINDOWS\cursors\cross_rl.cur,C:\WINDOWS\cursors\beam_rl.cur,C:\WINDOWS\cursors\pen_rl.cur,C:\WINDOWS\cursors\no_rl.cur,C:\WINDOWS\cursors\size4_rl.cur,C:\WINDOWS\cursors\size3_rl.cur,C:\WINDOWS\cursors\size2_rl.cur,C:\WINDOWS\cursors\size1_rl.cur,C:\WINDOWS\cursors\move_rl.cur,C:\WINDOWS\cursors\up_rl.cur"
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services:
------------------
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
Remaining Files:
---------------
Files with Hidden Attributes:
Wed 17 Jan 2007 48 ..SH. --- "C:\WINDOWS\S6E3F2478.tmp"
Fri 7 Dec 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0a67b6c406b1d7e0f5c1e6f6d44a3f6e\BIT239.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\18b19374451d28a8fbaf1939cf31ff45\BIT23D.tmp"
Tue 20 Nov 2007 1,123,200 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\1f75a8ad2ee20cedf33dd46d709f2f0e\BIT1A3.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\26924cbc8132a10b438ce6e2b49d4652\BIT238.tmp"
Wed 23 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT1.tmp"
Wed 21 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\58fc2d0715783c724c28794ac4d66158\BIT6C.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\911362f9031af35c5b51e12ecc909800\BIT23A.tmp"
Wed 23 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\bc066f3f60df1b38218903dd0d40ce98\BIT2.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ddd366874e802b7f73320d55edd2e34f\BIT23C.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e691f694d870764b4c31a5eb30b26139\BIT23B.tmp"
Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f3a3b2a2e8ef3845fb7855c997a48858\BIT23E.tmp"
Wed 26 Dec 2007 165,232 A..H. --- "C:\Documents and Settings\Romźa\Data aplikacˇ\Microsoft\Virtual PC\VPCKeyboard.dll"
Finished!
ComboFix 08-01-23.2 - Romźa 2008-01-24 18:19:24.3 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1044 [GMT 1:00]
Running from: D:\Stahov nˇ z internetu\Software\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Romźa\Data aplikacˇ\inst.exe
C:\WINDOWS\regedit.com
C:\WINDOWS\system32\taskmgr.com
.
((((((((((((((((((((((((( Files Created from 2007-12-24 to 2008-01-24 )))))))))))))))))))))))))))))))
.
2008-01-24 18:11 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-19 13:16 . 2008-01-19 13:16 <DIR> d-------- C:\Program Files\Counter-Strike 1.6 Patch Version 26
2008-01-13 16:54 . 2008-01-14 14:48 <DIR> d-------- C:\Program Files\Dealio
2008-01-13 16:52 . 2008-01-13 16:53 <DIR> d-------- C:\Program Files\themexp
2008-01-13 16:52 . 2008-01-13 16:52 <DIR> d-------- C:\Program Files\OneStepSearch
2008-01-07 17:52 . 2008-01-07 17:52 <DIR> d-a------ C:\WINDOWS\zts2.exe
2008-01-07 17:52 . 2008-01-07 17:52 <DIR> d-a------ C:\WINDOWS\system32\vcmgcd32.dll
2008-01-07 17:52 . 2008-01-07 17:52 <DIR> d-a------ C:\WINDOWS\system32\iifgfgf.dll
2008-01-07 17:52 . 2008-01-07 17:52 <DIR> d-a------ C:\WINDOWS\rundll16.exe
2008-01-07 17:52 . 2008-01-07 17:52 <DIR> d-a------ C:\WINDOWS\rundl132.dll
2008-01-07 17:52 . 2008-01-07 17:52 <DIR> d-a------ C:\WINDOWS\logo1_.exe
2008-01-07 17:39 . 2004-08-17 14:49 147,968 --a------ C:\WINDOWS\R.COM
2008-01-07 17:39 . 2004-08-17 14:49 137,216 --a------ C:\WINDOWS\system32\T.COM
2008-01-05 14:04 . 2008-01-17 13:26 <DIR> d-------- C:\Program Files\GameSpy Arcade
2008-01-05 13:55 . 2008-01-11 18:21 <DIR> d-------- C:\Program Files\Vietcong
2008-01-02 13:46 . 2008-01-02 13:51 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-01-02 13:46 . 2008-01-19 12:43 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-02 13:34 . 2008-01-19 12:43 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-01-02 13:20 . 2008-01-02 13:20 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-01-01 20:25 . 2008-01-01 20:25 <DIR> d-------- C:\Program Files\heslaý
2008-01-01 19:31 . 2008-01-01 19:31 <DIR> d-------- C:\Program Files\Passware
2008-01-01 19:26 . 2008-01-01 19:26 <DIR> d-------- C:\Program Files\PCNetSoftware
2007-12-30 21:26 . 2007-12-30 21:26 <DIR> d-------- C:\Program Files\Lavasoft
2007-12-30 13:53 . 2007-12-30 14:04 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-12-29 09:35 . 2007-02-03 05:56 4,239,360 --a------ C:\WINDOWS\system32\qtp-mt334.dll
2007-12-29 09:35 . 2007-02-03 05:56 30,808 --a------ C:\WINDOWS\system32\drivers\hotcore2.sys
2007-12-29 09:35 . 2007-02-03 05:56 8,192 --a------ C:\WINDOWS\system32\wnaspi32.dll
2007-12-29 09:34 . 2007-12-29 09:34 <DIR> d-------- C:\Program Files\Paragon Software
2007-12-28 20:45 . 2007-12-28 20:45 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-27 20:39 . 2007-12-27 20:39 0 --a------ C:\23990098.$$$
2007-12-27 20:22 . 2008-01-07 17:40 50 --a------ C:\WINDOWS\Lic.xxx
2007-12-26 20:52 . 2007-12-26 20:52 <DIR> d-------- C:\Program Files\Microsoft Virtual PC
2007-12-26 19:29 . 2007-12-26 19:30 <DIR> d-------- C:\Program Files\QIP
2007-12-26 18:58 . 2007-10-11 00:50 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-12-26 18:58 . 2007-07-01 04:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-12-26 18:58 . 2007-07-01 04:36 1,024,000 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2007-12-26 18:58 . 2007-10-11 00:50 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-12-26 18:58 . 2007-10-11 00:50 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-12-26 18:58 . 2007-10-11 00:50 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2007-12-26 18:58 . 2007-10-11 00:50 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2007-12-26 18:58 . 2007-10-11 00:50 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-12-26 18:58 . 2007-10-10 11:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-26 17:19 . 2007-12-26 17:19 <DIR> d-------- C:\Program Files\Ligos
2007-12-26 17:19 . 2000-06-23 14:05 136,704 --------- C:\WINDOWS\system32\iacenc.dll
2007-12-26 17:19 . 2000-06-22 13:09 56,320 --------- C:\WINDOWS\system32\iyvu9_32.dll
2007-12-26 17:18 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-12-26 17:03 . 2001-05-11 13:18 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
2007-12-26 17:03 . 2001-05-16 17:54 309,616 --a------ C:\WINDOWS\system32\wmv8dmod.dll
2007-12-26 17:03 . 2001-03-26 04:41 245,760 --a------ C:\WINDOWS\system32\mp4sds32.ax
2007-12-26 16:32 . 2005-02-26 06:34 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 14:18 --------- d-----w C:\Program Files\AIMP2
2008-01-19 11:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-07 18:41 --------- d-----w C:\Program Files\eMule
2008-01-06 14:19 --------- d-----w C:\Program Files\ACE Mega CoDecS Pack
2008-01-01 19:25 --------- d-----w C:\Program Files\heslař
2007-12-30 12:52 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-28 20:48 --------- d-----w C:\Program Files\Free Download Manager
2007-12-26 18:33 --------- d-----w C:\Program Files\ICQ6
2007-12-25 08:36 --------- d-----w C:\Program Files\CyberLink DVD Solution
2007-12-23 15:55 --------- d-----w C:\Program Files\TechSmith
2007-12-23 15:12 --------- d-----w C:\Program Files\Microsoft.NET
2007-12-23 15:12 --------- d-----w C:\Program Files\Microsoft SQL Server
2007-12-23 11:28 --------- d-----w C:\Program Files\DVDFab Platinum 4
2007-12-22 09:19 --------- d-----w C:\Program Files\Activision
2007-12-13 17:32 --------- d-----w C:\Program Files\IrfanView
2007-12-13 16:33 --------- d-----w C:\Program Files\CCleaner
2007-12-08 21:49 79,096 ----a-w C:\WINDOWS\system32\drivers\cmdGuard.sys
2007-12-08 21:49 23,672 ----a-w C:\WINDOWS\system32\drivers\cmdhlp.sys
2007-12-08 21:49 --------- d-----w C:\Program Files\COMODO
2007-12-08 18:53 --------- d-----w C:\Program Files\Common Files\Adobe
2007-12-07 20:17 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-12-07 13:40 --------- d-----w C:\Program Files\CloneDVD2
2007-12-06 14:10 --------- d-----w C:\Program Files\youtube
2007-11-29 18:47 --------- d-----w C:\Program Files\MSXML 6.0
2007-11-29 15:19 --------- d-----w C:\Program Files\FastStone Capture
2007-11-29 15:11 --------- d-----w C:\Program Files\MSBuild
2007-11-29 15:06 --------- d-----w C:\Program Files\Reference Assemblies
2007-11-28 16:15 --------- d-----w C:\Program Files\DVD Shrink
2007-11-28 15:18 --------- d-----w C:\Program Files\DVDFab HD Decrypter 3
2007-11-28 13:46 --------- d-----w C:\Program Files\DAEMON Tools
2007-11-28 13:43 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 14:49 15360]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2007-10-28 21:49 2445359]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-30 11:54 16116224 C:\WINDOWS\RTHDCPL.exe]
"SensorsView"="C:\Program Files\SensorsView\sview.exe" [2005-11-28 20:24 940032]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2007-12-08 22:49 1481984]
"snpstd3"="C:\WINDOWS\vsnpstd3.exe" [2005-09-05 15:55 339968]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-17 14:49 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]
--a------ 2007-11-14 15:05 1410304 C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Upload Manager]
--a------ 2007-07-29 19:13 253952 C:\Program Files\Free Download Manager\fum\fum.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
-r------- 2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
--a------ 2006-11-10 12:35 90112 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tweak UI]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NOD32krn"=2 (0x2)
R0 hotcore2;hotcore2;C:\WINDOWS\system32\drivers\hotcore2.sys [2007-02-03 05:56]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2007-12-08 22:49]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2007-12-08 22:49]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-11-14 15:06]
R2 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 05:29]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 22:04]
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2007-01-20 13:48]
*Newly Created Service* - PROCEXP90
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 18:26:36
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll
PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\guard32.dll
.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:50, on 2008-01-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\SensorsView\sview.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\eMule\emule.exe
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SensorsView] C:\Program Files\SensorsView\sview.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -s
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout video Free Download Managerem - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://C:\Program Files\Free Download Manager\dlall.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 5573220375
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
--
End of file - 6128 bytes
Moc díky ještě jednou
ale počkej ještě radši pro jistotu na 
