Sím o kontrolu logu Vyřešeno

Místo pro vaše HiJackThis logy a logy z dalších programů…

Moderátoři: Mods_senior, Security team

Zamčeno
Nero
nováček
Příspěvky: 40
Registrován: červen 08
Pohlaví: Nespecifikováno
Stav:
Offline

Sím o kontrolu logu

Příspěvekod Nero » 06 úno 2010 22:40

Dobrý večer,prosím o kontrolu logu.
Kontrolováno programy Nod 32 a CCleaner.


Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 22:34:51, on 6.2.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {ce0c2586-da36-452b-acdb-320d9bcb19bf} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - S-1-5-18 Startup: Windows Defender.lnk = C:\Program Files\Windows Defender\MSASCui.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Windows Defender.lnk = C:\Program Files\Windows Defender\MSASCui.exe (User 'Default user')
O4 - Startup: Windows Defender.lnk = C:\Program Files\Windows Defender\MSASCui.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game05.zylom.com/activex/zylomgamesplayer.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Ubersoldier 2 Drivers Auto Removal (pr2anmue) (pr2anmue) - City Interactive Sp z o.o. - C:\WINDOWS\system32\pr2anmue.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 7507 bytes
Nahoru
Reklama
Top
Nero
nováček
Příspěvky: 40
Registrován: červen 08
Pohlaví: Nespecifikováno
Stav:
Offline

Re: Sím o kontrolu logu

Příspěvekod Nero » 20 úno 2010 23:21

Hm,tak nevím proč někdo,kdo má poslanou žádost o kontrolu logu včera,má na svůj příspěvek 4odpovědi?
Já jsem dával žádost o kontrolu logu před 14 dny a odpověď žádná!
Podle čeho se odpovídá na žádosti o kontrolu logu?
Nahoru
Uživatelský avatar
autoprd
Level 4.5
Level 4.5
Příspěvky: 1715
Registrován: únor 09
Bydliště: ▼▲☺U Pc ☺▼▲
Pohlaví: Muž
Stav:
Offline
Kontakt:
Kontaktovat uživatele autoprd

Re: Sím o kontrolu logu

Příspěvekod autoprd » 20 úno 2010 23:32

Podle toho kdo má čas a když vyřešíme 5 dotazů přibide dalších 50 a ten tvůj se ztratí chápeš ?
Nahoru
Uživatelský avatar
autoprd
Level 4.5
Level 4.5
Příspěvky: 1715
Registrován: únor 09
Bydliště: ▼▲☺U Pc ☺▼▲
Pohlaví: Muž
Stav:
Offline
Kontakt:
Kontaktovat uživatele autoprd

Re: Sím o kontrolu logu

Příspěvekod autoprd » 20 úno 2010 23:36

Odinstaluj : Google Toolbar

Tak spusť HiJackThis pro tentokrát vyber Do a system scan only!
Zatrhni položky, které jsou níže uvedené a stiskni Fix checked.

Kód: Vybrat vše

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R3 - URLSearchHook: (no name) - {ce0c2586-da36-452b-acdb-320d9bcb19bf} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game05.zylom.com/activex/zylomgamesplayer.cab

A počkej až dokončí svůj proces, poté program vypni.
Nahoru
Uživatelský avatar
autoprd
Level 4.5
Level 4.5
Příspěvky: 1715
Registrován: únor 09
Bydliště: ▼▲☺U Pc ☺▼▲
Pohlaví: Muž
Stav:
Offline
Kontakt:
Kontaktovat uživatele autoprd

Re: Sím o kontrolu logu

Příspěvekod autoprd » 20 úno 2010 23:36

Stáhni si ATF Cleaner
Spust a stiskni na select all found
Jestli jedeš přes Mozilu Firefox klikni na Firefox nahoře a vyber: Select All, potom klikni na Empty Selected.
Jestli jedeš přes Operu klikni nahoře na Operu a vyber: Select All, potom klikni na Empty Selected.
Až se to vyčistí klikni na exit pro ukončení.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.
Nahoru
Nero
nováček
Příspěvky: 40
Registrován: červen 08
Pohlaví: Nespecifikováno
Stav:
Offline

Re: Sím o kontrolu logu

Příspěvekod Nero » 21 úno 2010 00:25

Ahoj,ten Malwerbytes nic nenašel:


Malwarebytes' Anti-Malware 1.44
Verze databáze: 3768
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

21.2.2010 0:15:07
mbam-log-2010-02-21 (00-15-07).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 136046
Uplynulý čas: 4 minute(s), 23 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)



Nový výpis z HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:21:54, on 21.2.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - S-1-5-18 Startup: Windows Defender.lnk = C:\Program Files\Windows Defender\MSASCui.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Windows Defender.lnk = C:\Program Files\Windows Defender\MSASCui.exe (User 'Default user')
O4 - Startup: Windows Defender.lnk = C:\Program Files\Windows Defender\MSASCui.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Ubersoldier 2 Drivers Auto Removal (pr2anmue) (pr2anmue) - City Interactive Sp z o.o. - C:\WINDOWS\system32\pr2anmue.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 6631 bytes
Nahoru
Uživatelský avatar
autoprd
Level 4.5
Level 4.5
Příspěvky: 1715
Registrován: únor 09
Bydliště: ▼▲☺U Pc ☺▼▲
Pohlaví: Muž
Stav:
Offline
Kontakt:
Kontaktovat uživatele autoprd

Re: Sím o kontrolu logu

Příspěvekod autoprd » 21 úno 2010 15:07

Vypni rez. ochrany antiviru+deaktivuj firewall.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Nahoru
Nero
nováček
Příspěvky: 40
Registrován: červen 08
Pohlaví: Nespecifikováno
Stav:
Offline

Re: Sím o kontrolu logu

Příspěvekod Nero » 21 úno 2010 23:52

ComboFix 10-02-21.02 - David a Gábina 21.02.2010 23:31:10.6.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.686 [GMT 1:00]
Spuštěný z: c:\documents and settings\David a Gábina\Plocha\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\data
c:\data\WINDOWSDEFENDER.EXE
c:\program files\iWin Games\iWinGamesHookIE.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-21 do 2010-02-21 )))))))))))))))))))))))))))))))
.

2010-02-17 17:26 . 2010-02-17 17:26 -------- d-----w- c:\program files\Big City Adventure - Vancouver
2010-02-17 17:20 . 2010-02-17 17:20 -------- d-----w- c:\program files\bfgclient
2010-02-17 09:16 . 2010-02-17 09:20 -------- d-----w- C:\ConverterOutput
2010-02-17 08:45 . 2009-12-24 18:57 73728 ----a-w- c:\windows\system\vdremote.dll
2010-02-17 08:45 . 2009-12-24 18:56 65536 ----a-w- c:\windows\system\vdsvrlnk.dll
2010-02-17 08:10 . 2010-02-17 08:10 -------- d-----w- c:\windows\system32\codec
2010-02-17 08:10 . 2010-02-17 08:10 -------- d-----w- c:\program files\avi2divx
2010-02-15 08:49 . 2010-02-15 08:49 -------- d-----w- C:\Temp
2010-02-15 08:37 . 2010-02-15 08:37 -------- d-----w- c:\program files\AviSynth 2.5
2010-02-15 08:36 . 2010-02-15 08:36 -------- d-----w- c:\program files\Winnydows
2010-02-11 07:17 . 2010-02-11 07:17 -------- d-----w- c:\program files\VideoLAN
2010-02-09 14:24 . 2010-02-12 22:49 -------- d-----w- c:\program files\Restaurace U Amálky
2010-02-06 21:31 . 2010-02-06 21:31 -------- d-----w- c:\program files\TrendMicro

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-21 22:37 . 2009-12-20 10:13 -------- d-----w- c:\program files\iWin Games
2010-02-21 19:53 . 2009-11-26 20:08 -------- d-----w- c:\program files\WinClamAVShield
2010-02-21 12:20 . 2009-02-10 21:41 -------- d-----w- c:\program files\Google
2010-02-20 22:59 . 2009-03-07 01:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-17 07:46 . 2009-02-14 23:20 1682 ----a-w- c:\windows\system32\KGyGaAvL.sys
2010-02-15 23:23 . 2009-03-25 14:24 -------- d-----w- c:\program files\Canopus
2010-02-07 00:27 . 2009-03-09 16:08 -------- d-----w- c:\program files\Games
2010-02-06 15:05 . 2009-08-07 14:45 -------- d-----w- c:\program files\Alawar
2010-01-12 10:38 . 2009-01-21 21:08 -------- d-----w- c:\program files\Electronic Arts
2010-01-11 21:22 . 2009-11-26 20:06 -------- d-----w- c:\program files\Spyware Terminator
2010-01-11 11:41 . 2010-01-11 11:41 7212 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-01-08 11:56 . 2009-12-27 09:56 -------- d-----w- c:\program files\Common Files\Nero
2010-01-07 15:07 . 2009-03-07 01:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-03-07 01:22 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-07 10:23 . 2010-01-07 10:23 -------- d-----w- c:\program files\Dobrý farmář
2010-01-07 10:11 . 2009-01-09 14:46 -------- d-----w- c:\program files\TC UP
2010-01-02 08:24 . 2009-12-03 22:51 -------- d-----w- c:\program files\CDBurnerXP
2009-12-27 09:40 . 2009-02-05 14:41 -------- d-----w- c:\program files\Common Files\Ahead
2009-12-27 09:40 . 2009-02-05 14:41 -------- d-----w- c:\program files\Ahead
2009-12-13 16:52 . 2009-12-01 15:39 40212 ----a-w- c:\windows\macromix.dll
2009-12-13 16:52 . 2009-12-01 15:39 30544 ----a-w- c:\windows\dirdib.drv
2009-12-10 08:54 . 2009-01-20 07:12 29480 ------w- c:\windows\system32\msxml3a.dll
2009-11-26 20:06 . 2009-11-26 20:06 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
.

------- Sigcheck -------

[-] 2008-04-27 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-05-22_23.14.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-19 14:02 . 2010-01-19 14:02 16384 c:\windows\temp\Perflib_Perfdata_3f0.dat
+ 2010-02-21 22:29 . 2010-02-21 22:29 16384 c:\windows\temp\Perflib_Perfdata_264.dat
+ 2004-01-25 16:18 . 2004-01-25 16:18 70656 c:\windows\system32\yv12vfw.dll
+ 2008-04-14 06:53 . 2008-04-14 04:53 23552 c:\windows\system32\wdmaud.drv
- 2008-04-14 06:53 . 2008-04-14 05:53 23552 c:\windows\system32\wdmaud.drv
+ 2009-01-06 19:42 . 2009-04-28 20:20 96752 c:\windows\system32\vxblock.dll
+ 2009-01-06 19:42 . 2009-04-28 20:20 66032 c:\windows\system32\pxinsa64.exe
+ 2009-01-06 19:42 . 2009-04-28 20:20 72176 c:\windows\system32\pxhpinst.exe
+ 2009-01-06 19:42 . 2009-04-28 20:20 66544 c:\windows\system32\pxcpya64.exe
+ 2001-10-25 16:00 . 2009-11-03 20:38 71444 c:\windows\system32\perfc009.dat
- 2001-10-25 16:00 . 2009-04-05 21:05 71444 c:\windows\system32\perfc009.dat
+ 2001-10-25 16:00 . 2009-11-03 20:38 82836 c:\windows\system32\perfc005.dat
- 2001-10-25 16:00 . 2009-04-05 21:05 82836 c:\windows\system32\perfc005.dat
+ 2005-12-31 14:13 . 2005-12-31 14:13 24576 c:\windows\system32\ogg.dll
- 2009-01-04 21:15 . 2009-01-06 21:13 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2009-11-07 05:58 . 2010-01-29 15:11 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2009-01-04 18:44 . 2009-08-05 10:07 10111 c:\windows\system32\Lang\TradChin.bin
+ 2009-01-04 18:44 . 2009-08-05 10:07 12247 c:\windows\system32\Lang\Thai.bin
+ 2009-01-04 18:44 . 2009-08-05 10:07 13560 c:\windows\system32\Lang\SWEDISH.bin
+ 2009-01-04 18:44 . 2009-08-05 10:07 15409 c:\windows\system32\Lang\Spanish.bin
+ 2009-01-04 18:44 . 2009-08-05 10:07 15050 c:\windows\system32\Lang\Russian.bin
+ 2009-08-05 10:07 . 2009-08-05 10:07 14634 c:\windows\system32\Lang\Portuguese_Default.bin
+ 2009-08-05 10:07 . 2009-08-05 10:07 13746 c:\windows\system32\Lang\Portuguese_Brazilian.bin
+ 2009-08-05 10:07 . 2009-08-05 10:07 13431 c:\windows\system32\Lang\Polish.bin
+ 2009-01-04 18:44 . 2009-08-05 10:07 11498 c:\windows\system32\Lang\Korean.bin
+ 2009-01-04 18:44 . 2009-08-05 10:07 13345 c:\windows\system32\Lang\Japanese.bin
+ 2009-01-04 18:44 . 2009-08-05 10:07 15718 c:\windows\system32\Lang\Italian.bin
+ 2009-08-05 10:07 . 2009-08-05 10:07 13966 c:\windows\system32\Lang\Greek.bin
+ 2009-01-04 18:44 . 2009-08-05 10:07 14873 c:\windows\system32\Lang\German.bin
+ 2009-01-04 18:44 . 2009-08-05 10:07 15325 c:\windows\system32\Lang\French.bin
+ 2009-01-04 18:44 . 2009-08-05 10:07 12032 c:\windows\system32\Lang\English.bin
+ 2009-01-04 18:44 . 2009-08-05 10:07 14470 c:\windows\system32\Lang\Dutch.bin
+ 2009-01-04 18:44 . 2009-08-05 10:07 13831 c:\windows\system32\Lang\Danish.bin
+ 2009-01-04 18:44 . 2009-08-05 10:07 11842 c:\windows\system32\Lang\Arabic.bin
+ 2004-01-25 16:18 . 2004-01-25 16:18 70656 c:\windows\system32\i420vfw.dll
+ 2009-01-04 13:30 . 2006-08-01 13:02 49152 c:\windows\system32\ChCfg.exe
+ 2009-09-04 16:31 . 2008-04-14 04:51 21504 c:\windows\system32\hidserv.dll
+ 2009-09-04 16:30 . 2008-04-13 20:15 32128 c:\windows\system32\drivers\usbccgp.sys
+ 2008-04-13 22:15 . 2008-04-13 20:15 49408 c:\windows\system32\drivers\stream.sys
- 2008-04-13 22:15 . 2008-04-13 21:15 49408 c:\windows\system32\drivers\stream.sys
+ 2009-01-06 19:42 . 2009-04-28 20:20 44944 c:\windows\system32\drivers\PxHelp20.sys
+ 2009-09-04 16:31 . 2001-10-24 07:54 12160 c:\windows\system32\drivers\mouhid.sys
+ 2009-09-04 16:31 . 2008-04-14 03:59 14592 c:\windows\system32\drivers\kbdhid.sys
+ 2009-09-04 16:30 . 2008-04-13 20:15 10368 c:\windows\system32\drivers\hidusb.sys
+ 2009-02-06 12:24 . 2009-10-07 08:18 55256 c:\windows\system32\drivers\epfwtdi.sys
+ 2009-02-06 12:24 . 2009-10-07 08:18 32072 c:\windows\system32\drivers\epfwndis.sys
+ 2009-02-06 12:24 . 2009-10-07 08:18 73760 c:\windows\system32\drivers\epfw.sys
+ 2008-10-24 18:46 . 2009-10-07 08:12 54184 c:\windows\system32\drivers\easdrv.sys
+ 2009-02-06 12:19 . 2009-10-07 08:11 40824 c:\windows\system32\drivers\eamon.sys
+ 2009-01-04 12:54 . 2008-04-13 20:15 60160 c:\windows\system32\drivers\drmk.sys
- 2009-01-04 12:54 . 2008-04-13 21:15 60160 c:\windows\system32\drivers\drmk.sys
- 2008-04-14 06:53 . 2008-04-14 05:53 23552 c:\windows\system32\dllcache\wdmaud.drv
+ 2008-04-14 06:53 . 2008-04-14 04:53 23552 c:\windows\system32\dllcache\wdmaud.drv
+ 2009-09-04 16:30 . 2008-04-13 20:15 32128 c:\windows\system32\dllcache\usbccgp.sys
- 2008-04-13 22:15 . 2008-04-13 21:15 49408 c:\windows\system32\dllcache\stream.sys
+ 2008-04-13 22:15 . 2008-04-13 20:15 49408 c:\windows\system32\dllcache\stream.sys
+ 2009-09-04 16:31 . 2001-10-24 07:54 12160 c:\windows\system32\dllcache\mouhid.sys
+ 2009-09-04 16:31 . 2008-04-14 03:59 14592 c:\windows\system32\dllcache\kbdhid.sys
+ 2009-09-04 16:30 . 2008-04-13 20:15 10368 c:\windows\system32\dllcache\hidusb.sys
+ 2009-09-04 16:31 . 2008-04-14 04:51 21504 c:\windows\system32\dllcache\hidserv.dll
+ 2009-01-04 12:54 . 2008-04-13 20:15 60160 c:\windows\system32\dllcache\drmk.sys
- 2009-01-04 12:54 . 2008-04-13 21:15 60160 c:\windows\system32\dllcache\drmk.sys
+ 2010-02-14 07:58 . 2010-02-14 07:58 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012010021420100215\index.dat
- 2009-01-03 23:38 . 2009-05-17 06:21 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-01-03 23:38 . 2010-02-18 16:58 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-01-03 23:38 . 2009-05-17 06:21 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-01-03 23:38 . 2010-02-18 16:58 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-02-17 08:10 . 2007-07-25 16:34 37048 c:\windows\system32\codec\unins000.dat
+ 2010-02-17 08:10 . 2007-04-20 21:14 26624 c:\windows\system32\codec\ff_wmv9.dll
+ 2010-02-17 08:10 . 2007-04-20 21:14 38400 c:\windows\system32\codec\ff_unrar.dll
+ 2010-02-17 08:10 . 2007-04-20 21:14 79872 c:\windows\system32\codec\ff_tremor.dll
+ 2010-02-17 08:10 . 2007-04-20 21:14 97280 c:\windows\system32\codec\ff_realaac.dll
+ 2010-02-17 08:10 . 2007-04-20 21:14 40960 c:\windows\system32\codec\ff_liba52.dll
+ 2007-11-07 16:28 . 2007-11-07 16:28 22016 c:\windows\Installer\558d49.msp
+ 2007-11-07 16:32 . 2007-11-07 16:32 74240 c:\windows\Installer\558d45.msp
+ 2007-11-07 16:21 . 2007-11-07 16:21 24576 c:\windows\Installer\558d42.msp
+ 2009-01-06 21:51 . 2009-01-06 21:51 86528 c:\windows\Installer\541447.msi
- 2009-02-03 15:51 . 2009-02-03 15:51 11502 c:\windows\Installer\{D80A6A73-E58A-4673-AFF5-F12D7110661F}\ARPPRODUCTICON.exe
+ 2009-10-18 22:11 . 2009-10-18 22:11 11502 c:\windows\Installer\{D80A6A73-E58A-4673-AFF5-F12D7110661F}\ARPPRODUCTICON.exe
+ 2010-01-22 07:25 . 2010-01-22 07:25 10134 c:\windows\Installer\{C7ECD3E2-AA4C-42AD-B342-687D1FA1B100}\callmsi.exe
+ 2009-08-21 15:33 . 2009-08-21 15:33 34494 c:\windows\Installer\{6844EAB5-BDFB-45C2-BC0C-B6603ED7DDCE}\controlPanelIcon.exe
+ 2009-07-10 22:31 . 2009-07-10 22:31 10134 c:\windows\Installer\{2EEBAC31-3EEF-4118-91CB-1A286A507DB2}\callmsi.exe
+ 2009-12-10 09:01 . 2009-12-10 09:01 77211 c:\windows\Installer\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\ARPPRODUCTICON.exe
- 2009-01-20 07:13 . 2009-01-20 07:13 77211 c:\windows\Installer\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\ARPPRODUCTICON.exe
+ 2010-01-12 10:36 . 2010-01-12 10:36 12800 c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 12800 c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 53248 c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 53248 c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2007-12-16 22:28 . 2007-12-16 22:28 9845 c:\windows\system32\mswen0obe.dll
- 2007-03-14 20:12 . 2007-03-14 20:12 9845 c:\windows\system32\mswen0obe.dll
+ 2009-01-04 18:44 . 2009-08-05 10:07 9484 c:\windows\system32\Lang\SimChin.bin
+ 2009-01-04 12:47 . 2008-04-14 04:51 4096 c:\windows\system32\ksuser.dll
- 2009-01-04 12:47 . 2008-04-14 05:51 4096 c:\windows\system32\ksuser.dll
+ 2009-01-04 12:47 . 2008-04-14 04:51 4096 c:\windows\system32\dllcache\ksuser.dll
- 2009-01-04 12:47 . 2008-04-14 05:51 4096 c:\windows\system32\dllcache\ksuser.dll
+ 2009-06-07 01:54 . 2009-06-07 01:54 4096 c:\windows\d3dx.dat
+ 2009-01-07 20:45 . 2008-09-05 00:22 447752 c:\windows\system32\vp6vfw.dll
+ 2009-01-04 12:54 . 2006-10-18 00:53 147456 c:\windows\system32\RtlCPAPI.dll
+ 2009-01-06 19:42 . 2009-04-28 20:20 436720 c:\windows\system32\pxwave.dll
+ 2009-01-06 19:42 . 2009-04-28 20:20 219632 c:\windows\system32\pxmas.dll
+ 2009-01-06 19:42 . 2009-04-28 20:20 551408 c:\windows\system32\pxdrv.dll
+ 2009-01-06 19:42 . 2009-04-28 20:20 129520 c:\windows\system32\pxafs.dll
+ 2009-01-06 19:42 . 2009-04-28 20:20 670192 c:\windows\system32\px.dll
- 2009-01-06 23:48 . 2009-02-13 20:30 111928 c:\windows\system32\PnkBstrB.exe
+ 2009-01-06 23:48 . 2009-10-18 22:20 111928 c:\windows\system32\PnkBstrB.exe
+ 2001-10-25 16:00 . 2009-11-03 20:38 441760 c:\windows\system32\perfh009.dat
- 2001-10-25 16:00 . 2009-04-05 21:05 441760 c:\windows\system32\perfh009.dat
- 2001-10-25 16:00 . 2009-04-05 21:05 438288 c:\windows\system32\perfh005.dat
+ 2001-10-25 16:00 . 2009-11-03 20:38 438288 c:\windows\system32\perfh005.dat
+ 2009-01-06 23:48 . 2009-10-18 22:12 682280 c:\windows\system32\pbsvc.exe
- 2009-01-06 23:48 . 2009-02-03 15:51 682280 c:\windows\system32\pbsvc.exe
+ 2006-02-03 07:00 . 2006-02-03 07:00 348160 c:\windows\system32\msvcr71.dll
- 2003-02-21 03:42 . 2003-02-21 19:42 348160 c:\windows\system32\msvcr71.dll
- 2003-03-18 19:14 . 2003-03-19 11:14 499712 c:\windows\system32\msvcp71.dll
+ 2006-10-09 06:07 . 2006-10-09 06:07 499712 c:\windows\system32\msvcp71.dll
+ 2009-06-28 19:01 . 2009-06-28 19:01 147456 c:\windows\system32\msmunaer4.dll
+ 2009-07-22 09:05 . 2009-07-22 09:05 147456 c:\windows\system32\msmec0obd.dll
+ 2009-10-28 03:40 . 2009-10-28 03:40 257440 c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2009-02-03 02:07 . 2009-02-03 02:07 240544 c:\windows\system32\Macromed\Flash\FlashUtil10b.exe
+ 2005-11-30 11:49 . 2005-11-30 11:49 161792 c:\windows\system32\lame_enc.dll
+ 2009-11-03 20:38 . 2009-10-11 03:17 149280 c:\windows\system32\javaws.exe
+ 2009-11-03 20:38 . 2009-10-11 03:17 145184 c:\windows\system32\javaw.exe
+ 2009-11-03 20:38 . 2009-10-11 03:17 145184 c:\windows\system32\java.exe
+ 2009-01-18 02:25 . 2003-07-06 12:07 372736 c:\windows\system32\IJL_11.DLL
- 2009-01-18 02:25 . 2003-07-06 13:07 372736 c:\windows\system32\IJL_11.DLL
+ 2009-01-04 00:25 . 2010-01-08 07:00 226408 c:\windows\system32\FNTCACHE.DAT
- 2009-01-04 00:25 . 2009-05-16 22:48 226408 c:\windows\system32\FNTCACHE.DAT
+ 2009-01-04 12:54 . 2008-04-13 20:49 146048 c:\windows\system32\drivers\portcls.sys
- 2009-01-04 12:54 . 2008-04-13 21:49 146048 c:\windows\system32\drivers\portcls.sys
+ 2009-01-06 23:48 . 2009-10-18 22:20 138464 c:\windows\system32\drivers\PnkBstrK.sys
- 2009-01-06 23:48 . 2009-02-13 20:30 138464 c:\windows\system32\drivers\PnkBstrK.sys
- 2008-04-13 22:46 . 2008-04-13 21:46 141056 c:\windows\system32\drivers\ks.sys
+ 2008-04-13 22:46 . 2008-04-13 20:46 141056 c:\windows\system32\drivers\ks.sys
+ 2009-02-06 12:23 . 2009-02-06 12:23 106208 c:\windows\system32\drivers\ehdrv.sys
- 2009-01-04 12:54 . 2008-04-13 21:49 146048 c:\windows\system32\dllcache\portcls.sys
+ 2009-01-04 12:54 . 2008-04-13 20:49 146048 c:\windows\system32\dllcache\portcls.sys
+ 2008-04-13 22:46 . 2008-04-13 20:46 141056 c:\windows\system32\dllcache\ks.sys
- 2008-04-13 22:46 . 2008-04-13 21:46 141056 c:\windows\system32\dllcache\ks.sys
+ 2004-05-26 12:37 . 2004-05-26 12:37 719872 c:\windows\system32\devil.dll
+ 2009-03-11 08:04 . 2009-10-11 03:17 411368 c:\windows\system32\deploytk.dll
+ 2010-02-17 08:10 . 2007-07-25 16:33 673782 c:\windows\system32\codec\unins000.exe
+ 2010-02-17 08:10 . 2007-04-14 09:16 200704 c:\windows\system32\codec\TomsMoComp_ff.dll
+ 2010-02-17 08:10 . 2004-01-11 23:00 348160 c:\windows\system32\codec\msvcr71.dll
+ 2010-02-17 08:10 . 2007-04-14 21:15 404480 c:\windows\system32\codec\libmplayer.dll
+ 2010-02-17 08:10 . 2007-04-20 21:14 114688 c:\windows\system32\codec\libmpeg2_ff.dll
+ 2010-02-17 08:10 . 2007-04-20 21:14 462848 c:\windows\system32\codec\ff_x264.dll
+ 2010-02-17 08:10 . 2007-04-20 21:14 143360 c:\windows\system32\codec\ff_theora.dll
+ 2010-02-17 08:10 . 2007-04-20 21:14 122880 c:\windows\system32\codec\ff_samplerate.dll
+ 2010-02-17 08:10 . 2007-04-20 21:14 118784 c:\windows\system32\codec\ff_libmad.dll
+ 2010-02-17 08:10 . 2007-04-20 21:14 245760 c:\windows\system32\codec\ff_libfaad2.dll
+ 2010-02-17 08:10 . 2007-04-20 21:14 155648 c:\windows\system32\codec\ff_libdts.dll
+ 2010-02-17 08:10 . 2007-04-14 09:16 225280 c:\windows\system32\codec\ff_kernelDeint.dll
+ 2010-02-17 08:10 . 2007-04-06 18:46 741376 c:\windows\system32\codec\audxlib.dll
+ 2007-03-01 20:27 . 2007-03-01 20:27 306688 c:\windows\system32\avisynth.dll
+ 2009-06-27 18:47 . 2009-06-27 18:47 574464 c:\windows\Supermarket Management\uninstall.exe
+ 2009-01-04 12:54 . 2007-04-16 13:28 577536 c:\windows\soundman.exe
+ 2009-10-17 12:05 . 2009-10-17 12:05 576000 c:\windows\Paradise Beach\uninstall.exe
+ 2009-01-06 21:52 . 2009-01-06 21:52 634368 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\vs_setup.msi
+ 2009-08-08 22:26 . 2009-08-08 22:26 578560 c:\windows\Many Years Ago\uninstall.exe
+ 2009-06-27 18:50 . 2009-06-27 18:50 574464 c:\windows\Lovely Kitchen\uninstall.exe
+ 2009-03-16 23:07 . 2009-03-16 23:07 836096 c:\windows\Installer\e46177.msi
+ 2009-01-22 21:00 . 2009-01-22 21:00 100352 c:\windows\Installer\bafd28.msi
+ 2009-01-22 20:51 . 2009-01-22 20:51 557056 c:\windows\Installer\bafd21.msi
+ 2009-01-22 20:50 . 2009-01-22 20:50 269312 c:\windows\Installer\bafd1a.msi
+ 2009-03-30 20:01 . 2009-03-30 20:01 188416 c:\windows\Installer\87a405.msi
+ 2009-05-16 22:35 . 2009-05-16 22:35 884224 c:\windows\Installer\7e23bc.msi
+ 2009-07-08 20:28 . 2009-07-08 20:28 275968 c:\windows\Installer\6b2e60.msi
+ 2009-08-21 15:33 . 2009-08-21 15:33 283136 c:\windows\Installer\573d33.msi
+ 2009-01-06 21:52 . 2009-01-06 21:52 630272 c:\windows\Installer\56139b.msi
+ 2007-11-07 16:34 . 2007-11-07 16:34 273920 c:\windows\Installer\558d46.msp
+ 2009-01-06 21:52 . 2009-01-06 21:52 348160 c:\windows\Installer\558d3f.msi
+ 2007-11-07 14:07 . 2007-11-07 14:07 999936 c:\windows\Installer\541450.msp
+ 2007-11-07 13:56 . 2007-11-07 13:56 553472 c:\windows\Installer\54144d.msp
+ 2007-11-07 13:58 . 2007-11-07 13:58 908800 c:\windows\Installer\541449.msp
+ 2007-11-07 13:54 . 2007-11-07 13:54 507392 c:\windows\Installer\541448.msp
+ 2009-03-07 09:39 . 2009-03-07 09:39 941056 c:\windows\Installer\473383.msi
+ 2009-01-03 23:42 . 2009-01-03 23:42 265216 c:\windows\Installer\44deb.msi
+ 2009-01-07 16:05 . 2009-01-07 16:05 229376 c:\windows\Installer\32470.msi
+ 2009-01-07 16:05 . 2009-01-07 16:05 252416 c:\windows\Installer\32469.msi
+ 2009-01-07 16:05 . 2009-01-07 16:05 247296 c:\windows\Installer\32462.msi
+ 2009-01-07 16:05 . 2009-01-07 16:05 294400 c:\windows\Installer\3245b.msi
+ 2009-01-07 16:05 . 2009-01-07 16:05 215552 c:\windows\Installer\32454.msi
+ 2009-01-07 16:05 . 2009-01-07 16:05 296960 c:\windows\Installer\3244d.msi
+ 2009-01-07 16:05 . 2009-01-07 16:05 322048 c:\windows\Installer\32446.msi
+ 2009-01-07 16:05 . 2009-01-07 16:05 217600 c:\windows\Installer\3243f.msi
+ 2009-01-07 16:05 . 2009-01-07 16:05 302080 c:\windows\Installer\32438.msi
+ 2009-01-07 16:05 . 2009-01-07 16:05 321536 c:\windows\Installer\32431.msi
+ 2009-01-07 16:05 . 2009-01-07 16:05 293888 c:\windows\Installer\3242a.msi
+ 2009-01-24 22:31 . 2009-01-24 22:31 421888 c:\windows\Installer\3081c85.msi
+ 2009-03-22 21:05 . 2009-03-22 21:05 390656 c:\windows\Installer\26cac5.msi
+ 2009-01-21 21:13 . 2009-01-21 21:13 213504 c:\windows\Installer\239a84c.msi
+ 2009-01-07 16:59 . 2009-01-07 16:59 827904 c:\windows\Installer\2048d8.msi
+ 2009-01-07 16:59 . 2009-01-07 16:59 850944 c:\windows\Installer\2048cc.msi
+ 2009-01-07 16:52 . 2009-01-07 16:52 331264 c:\windows\Installer\2048c2.msi
+ 2009-01-08 16:14 . 2009-01-08 16:14 618496 c:\windows\Installer\1f19868.msi
+ 2009-01-26 22:11 . 2009-01-26 22:11 771584 c:\windows\Installer\16139cb.msi
+ 2009-03-22 21:31 . 2009-03-22 21:31 428544 c:\windows\Installer\14f1be.msi
+ 2009-02-01 12:44 . 2009-02-01 12:44 363008 c:\windows\Installer\1360a04.msi
+ 2010-01-22 07:25 . 2010-01-22 07:25 872960 c:\windows\Installer\135f6a.msi
+ 2010-01-22 07:25 . 2010-01-22 07:25 142680 c:\windows\Installer\{C7ECD3E2-AA4C-42AD-B342-687D1FA1B100}\egui.exe
+ 2010-01-12 10:41 . 2010-01-12 10:41 339548 c:\windows\Installer\{75569133-FD58-4F54-B622-9193EC7B6000}\lps.exe
+ 2009-07-10 22:31 . 2009-07-10 22:31 101480 c:\windows\Installer\{2EEBAC31-3EEF-4118-91CB-1A286A507DB2}\egui.exe
+ 2009-10-13 19:43 . 2009-10-13 19:49 579584 c:\windows\Gemini Lost\uninstall.exe
+ 2009-06-06 13:56 . 2009-06-06 13:56 574464 c:\windows\Bob the Builder Can Do Zoo\uninstall.exe
+ 2009-06-15 13:49 . 2009-06-15 13:49 884736 c:\windows\assembly\GAC_MSIL\Microsoft.Web.Services3\3.0.0.0__31bf3856ad364e35\Microsoft.Web.Services3.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 223232 c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 223232 c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 178176 c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 178176 c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 364544 c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 364544 c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 159232 c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 159232 c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 145920 c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 145920 c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 577024 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 577024 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 576000 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 576000 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 567296 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 567296 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 563712 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 563712 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 473600 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
- 2009-04-29 20:07 . 2009-04-29 20:07 473600 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2009-01-04 13:29 . 2006-07-31 09:19 315392 c:\windows\alcupd.exe
+ 2009-01-04 13:29 . 2006-07-31 09:27 217088 c:\windows\Alcrmv.exe
+ 2007-01-01 20:04 . 2007-01-01 20:04 1356800 c:\windows\system32\webfldrs.msi
+ 2005-12-31 14:19 . 2005-12-31 14:19 1097728 c:\windows\system32\vorbis.dll
+ 2010-01-08 11:55 . 2008-06-24 12:45 1414440 c:\windows\system32\ShellManager310E2D762.dll
+ 2009-01-06 19:42 . 2009-04-28 20:20 1858032 c:\windows\system32\pxsfs.dll
+ 2009-10-28 03:40 . 2009-10-28 03:40 3885984 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2006-08-16 14:13 . 2006-08-16 14:13 1382280 c:\windows\system32\fftw3.dll
+ 2009-08-05 10:00 . 2007-04-25 14:20 4030144 c:\windows\system32\drivers\alcxwdm.sys
+ 2010-02-17 08:10 . 2007-04-20 21:14 3062272 c:\windows\system32\codec\libavcodec.dll
+ 2009-05-27 12:04 . 2009-05-27 12:04 1828352 c:\windows\Installer\e47f5.msi
+ 2009-03-08 22:24 . 2009-03-08 22:24 9779712 c:\windows\Installer\d91a23.msi
+ 2009-03-20 21:19 . 2009-03-20 21:19 1171968 c:\windows\Installer\be1d7.msi
+ 2010-01-12 10:41 . 2010-01-12 10:41 8017408 c:\windows\Installer\ba5bd6.msi
+ 2009-05-16 22:42 . 2009-05-16 22:42 2154496 c:\windows\Installer\7e23c9.msi
+ 2009-05-16 22:31 . 2009-05-16 22:31 8404992 c:\windows\Installer\7e23b2.msi
+ 2009-11-27 22:55 . 2009-11-27 22:55 3948032 c:\windows\Installer\794040.msi
+ 2010-02-06 21:32 . 2010-02-06 21:32 1093632 c:\windows\Installer\6ddef7.msi
+ 2009-07-10 22:31 . 2009-07-10 22:31 1129984 c:\windows\Installer\689f9.msi
+ 2009-01-20 07:20 . 2009-01-20 07:20 6318592 c:\windows\Installer\58739a.msi
+ 2007-11-07 16:30 . 2007-11-07 16:30 3962368 c:\windows\Installer\558d48.msp
+ 2007-11-07 16:13 . 2007-11-07 16:13 6766592 c:\windows\Installer\558d47.msp
+ 2007-11-07 16:26 . 2007-11-07 16:26 4340224 c:\windows\Installer\558d44.msp
+ 2007-11-07 16:24 . 2007-11-07 16:24 5353472 c:\windows\Installer\558d43.msp
+ 2007-11-07 16:18 . 2007-11-07 16:18 2059264 c:\windows\Installer\558d41.msp
+ 2007-11-07 16:16 . 2007-11-07 16:16 1313280 c:\windows\Installer\558d40.msp
+ 2007-11-07 13:50 . 2007-11-07 13:50 6055936 c:\windows\Installer\54144f.msp
+ 2007-11-07 14:00 . 2007-11-07 14:00 3407360 c:\windows\Installer\54144e.msp
+ 2007-11-07 13:46 . 2007-11-07 13:46 3010560 c:\windows\Installer\54144c.msp
+ 2007-11-07 14:02 . 2007-11-07 14:02 6473216 c:\windows\Installer\54144b.msp
+ 2007-11-07 14:12 . 2007-11-07 14:12 2533376 c:\windows\Installer\54144a.msp
+ 2009-01-03 23:41 . 2009-01-03 23:41 1123840 c:\windows\Installer\44de4.msi
+ 2009-01-04 12:33 . 2009-01-04 12:33 3443712 c:\windows\Installer\3c857.msi
+ 2009-01-07 16:05 . 2009-01-07 16:05 1085952 c:\windows\Installer\32477.msi
+ 2009-06-15 13:49 . 2009-06-15 13:49 1013248 c:\windows\Installer\2442f2.msi
+ 2009-12-10 09:01 . 2009-12-10 09:01 8176128 c:\windows\Installer\200250.msi
+ 2009-03-03 19:46 . 2009-03-03 19:46 8992256 c:\windows\Installer\1f3f38d.msi
+ 2009-03-03 19:45 . 2009-03-03 19:45 1549312 c:\windows\Installer\1f3f389.msi
+ 2009-01-08 16:15 . 2009-01-08 16:15 4669952 c:\windows\Installer\1f19870.msi
+ 2009-01-08 16:14 . 2009-01-08 16:14 3862016 c:\windows\Installer\1f19861.msi
+ 2009-09-28 22:27 . 2009-09-28 22:27 1757696 c:\windows\Installer\1a423a.msi
+ 2009-01-04 13:30 . 2009-01-04 13:30 2501632 c:\windows\Installer\15d90.msi
+ 2009-01-04 13:29 . 2009-01-04 13:29 5369856 c:\windows\Installer\15d87.msi
+ 2009-05-16 23:10 . 2009-05-16 23:10 6738944 c:\windows\Installer\1468cd.msi
+ 2010-01-12 10:41 . 2010-01-12 10:41 4369408 c:\windows\Installer\{75569133-FD58-4F54-B622-9193EC7B6000}\EAregister.exe
- 2009-04-29 20:07 . 2009-04-29 20:07 2846720 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 2846720 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-04-29 20:06 . 2009-04-29 20:06 2676224 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-01-12 10:36 . 2010-01-12 10:36 2676224 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-01-04 12:54 . 2006-12-08 13:20 10528768 c:\windows\system32\RTLCPL.exe
+ 2009-05-20 16:45 . 2009-05-20 16:45 31830528 c:\windows\Installer\e5fb.msi
+ 2009-10-18 22:11 . 2009-10-18 22:11 34960896 c:\windows\Installer\a4c499.msi
+ 2009-04-11 01:19 . 2009-04-11 01:19 35323904 c:\windows\Installer\3f2dd.msi
+ 2009-01-08 16:13 . 2009-01-08 16:13 18197504 c:\windows\Installer\1f1985a.msi
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-11-26 2166784]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-10-07 1461080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

c:\documents and settings\David a G bina\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Windows Defender.lnk - c:\program files\Windows Defender\MSASCui.exe [2006-11-3 866584]

c:\documents and settings\David a G bina\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Windows Defender.lnk - c:\program files\Windows Defender\MSASCui.exe [2006-11-3 866584]

c:\documents and settings\David a G bina\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Windows Defender.lnk - c:\program files\Windows Defender\MSASCui.exe [2006-11-3 866584]

c:\documents and settings\David a G bina\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Windows Defender.lnk - c:\program files\Windows Defender\MSASCui.exe [2006-11-3 866584]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders schannel.dll, digest.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^VIA RAID TOOL.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\VIA RAID TOOL.lnk
backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^David a Gábina^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
path=c:\documents and settings\David a Gábina\Nabídka Start\Programy\Po spuštění\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^David a Gábina^Nabídka Start^Programy^Po spuštění^FreeRapid 0.83u1.lnk]
path=c:\documents and settings\David a Gábina\Nabídka Start\Programy\Po spuštění\FreeRapid 0.83u1.lnk
backup=c:\windows\pss\FreeRapid 0.83u1.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 11:08 935288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 03:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
2009-08-28 17:36 75048 ----a-w- c:\program files\CyberLink\Shared Files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2009-03-01 10:59 172792 ----a-w- c:\program files\ICQ6.5\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD8LanguageShortcut]
2009-04-15 22:54 50472 ------w- c:\program files\CyberLink\PowerDVD8\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl8]
2009-07-16 19:08 91432 ------w- c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2007-04-16 13:28 577536 ----a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-03-16 22:57 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"e:\\emule\\emule.exe"=
"e:\\uTorrent\\uTorrent\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Program Files\\CorresBurn\\CorresBurn.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\iWin Games\\iWinGames.exe"=
"c:\\Program Files\\iWin Games\\WebUpdater.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Skupiny sítě Peer-to-Peer
"3540:UDP"= 3540:UDP:Protokol PNRP (Peer Name Resolution Protocol)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 pe3anmue;Ubersoldier 2 Environment Driver (pe3anmue);c:\windows\system32\drivers\pe3anmue.sys [21.2.2008 9:38 65152]
R0 ps7anmue;Ubersoldier 2 Synchronization Driver (ps7anmue);c:\windows\system32\drivers\ps7anmue.sys [21.2.2008 9:37 68744]
R1 atitray;atitray;c:\program files\ATI Tray Tools\atitray.sys [22.5.2007 10:04 18088]
R1 cdrblock;cdrblock;c:\windows\system32\drivers\cdrblock.sys [22.3.2009 22:04 20864]
R1 cdrport;cdrport;c:\windows\system32\drivers\cdrport.sys [22.3.2009 22:04 4608]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [26.11.2009 21:06 142592]
R1 VD_FileDisk;VD_FileDisk;c:\windows\system32\drivers\vd_filedisk.sys [13.1.2006 14:00 15872]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};Power Control [2009/12/10 10:01];c:\program files\CyberLink\PowerDVD8\000.fcl [28.8.2009 18:36 87536]
R2 ekrn;Eset Service;c:\program files\Eset\ESET NOD32 Antivirus\ekrn.exe [7.10.2009 9:16 472280]
R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;c:\windows\system32\drivers\wf88vcap.sys [4.1.2009 13:47 193792]
R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;c:\windows\system32\drivers\WF88XBAR.sys [4.1.2009 13:52 9600]
R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;c:\windows\system32\drivers\wf88tune.sys [4.1.2009 13:48 37120]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6.1.2009 21:10 717296]
S2 pr2anmue;Ubersoldier 2 Drivers Auto Removal (pr2anmue);c:\windows\system32\pr2anmue.exe svc --> c:\windows\system32\pr2anmue.exe svc [?]
S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [9.1.2009 23:12 9446]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
.
------- Doplňkový sken -------
.
IE: Crawler Search - tbr:iemenu
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
FF - ProfilePath - c:\documents and settings\David a Gábina\Data aplikací\Mozilla\Firefox\Profiles\luhd3r32.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/sli ... ie7&query=
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - plugin: c:\program files\Browser\program\plugins\npdsplay.dll
FF - plugin: c:\program files\Browser\program\plugins\NPSWF32.dll
FF - plugin: c:\program files\Browser\program\plugins\npwmsdrm.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

MSConfigStartUp-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
MSConfigStartUp-NeroFilterCheck - c:\program files\Common Files\Nero\Lib\NeroCheck.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-21 23:37
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1292428093-2000478354-682003330-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A2A1BB06-65AE-B418-D78E-048631AB10FF}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"jadikhcijpbkeijkdgam"=hex:62,61,70,63,00,00
"jadikhcijpbkeijkdgel"=hex:62,61,66,67,00,00
"iadhomjkehiiegiagn"=hex:6b,61,61,67,70,70,66,6e,67,6e,63,65,66,6a,65,6a,6f,63,
6e,63,6b,64,00,00
"hapeojjpnnnneoec"=hex:6b,61,67,68,61,70,6a,62,61,69,62,65,68,6f,6a,62,68,6a,
62,65,68,69,00,00
"jaoedkhfbhnabaieapgb"=hex:6f,61,65,69,6d,65,69,70,62,66,6f,69,67,6f,6c,6e,6a,
6b,6d,6b,64,6e,6c,6c,6a,6b,64,64,62,6f,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A2A1BB06-65AE-B418-D78E-048631AB10FF}\InProcServer32*]
"kabhmpahldcheogimkkcoi"=hex:62,61,62,67,00,00

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|˙˙˙˙¤•€|ů•6~*]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(928)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-02-21 23:39:33
ComboFix-quarantined-files.txt 2010-02-21 22:39
ComboFix2.txt 2009-05-22 23:20

Před spuštěním: 4 716 380 160
Po spuštění: 5 190 799 360

Current=4 Default=4 Failed=3 LastKnownGood=1 Sets=1,2,3,4
- - End Of File - - D7681A80C8CBF34C24147D5751108633
Nahoru
Uživatelský avatar
Damned
Tvůrce článků
Master Level 9
Master Level 9
Příspěvky: 8353
Registrován: prosinec 06
Bydliště: Rokycany
Pohlaví: Muž
Stav:
Offline
Kontakt:
Kontaktovat uživatele Damned

Re: Sím o kontrolu logu

Příspěvekod Damned » 22 úno 2010 00:20

Pokud máš ESS, tak si trvale vypni štít ST.

Odinstaluj si Crawler Toolbar.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

KillAll::
File::
c:\windows\system32\KGyGaAvL.sys

Folder::
c:\program files\Crawler

Driver::
KGyGaAvL

RegNull::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A2A1BB06-65AE-B418-D78E-048631AB10FF}\InProcServer32*]

Rootkit::
c:\windows\system32\KGyGaAvL.sys



Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.
Obrázek

- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu
Nic není nemožné, proto tam, kde jsme s rozumem v koncích, neváháme použít kladivo.
Chceš-li vědět, co je nového, podívej se do starých knih.
Damnedovy češtiny - překlady programů pro údržbu PC
HiJackThis 2+návod FCleaner+čeština Wise Registry Cleaner
Nahoru
Nero
nováček
Příspěvky: 40
Registrován: červen 08
Pohlaví: Nespecifikováno
Stav:
Offline

Re: Sím o kontrolu logu

Příspěvekod Nero » 22 úno 2010 12:51

ComboFix 10-02-21.02 - David a Gábina 22.02.2010 12:31:45.7.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.611 [GMT 1:00]
Spuštěný z: c:\documents and settings\David a Gábina\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\David a Gábina\Plocha\CFScript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý


FILE ::
"c:\windows\system32\KGyGaAvL.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\KGyGaAvL.sys

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-22 do 2010-02-22 )))))))))))))))))))))))))))))))
.

2010-02-17 17:26 . 2010-02-17 17:26 -------- d-----w- c:\program files\Big City Adventure - Vancouver
2010-02-17 17:20 . 2010-02-17 17:20 -------- d-----w- c:\program files\bfgclient
2010-02-17 09:16 . 2010-02-17 09:20 -------- d-----w- C:\ConverterOutput
2010-02-17 08:45 . 2009-12-24 18:57 73728 ----a-w- c:\windows\system\vdremote.dll
2010-02-17 08:45 . 2009-12-24 18:56 65536 ----a-w- c:\windows\system\vdsvrlnk.dll
2010-02-17 08:10 . 2010-02-17 08:10 -------- d-----w- c:\windows\system32\codec
2010-02-17 08:10 . 2010-02-17 08:10 -------- d-----w- c:\program files\avi2divx
2010-02-15 08:49 . 2010-02-15 08:49 -------- d-----w- C:\Temp
2010-02-15 08:37 . 2010-02-15 08:37 -------- d-----w- c:\program files\AviSynth 2.5
2010-02-15 08:36 . 2010-02-15 08:36 -------- d-----w- c:\program files\Winnydows
2010-02-11 07:17 . 2010-02-11 07:17 -------- d-----w- c:\program files\VideoLAN
2010-02-09 14:24 . 2010-02-12 22:49 -------- d-----w- c:\program files\Restaurace U Amálky
2010-02-06 21:31 . 2010-02-06 21:31 -------- d-----w- c:\program files\TrendMicro

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-22 10:11 . 2009-11-26 20:08 -------- d-----w- c:\program files\WinClamAVShield
2010-02-21 22:37 . 2009-12-20 10:13 -------- d-----w- c:\program files\iWin Games
2010-02-21 12:20 . 2009-02-10 21:41 -------- d-----w- c:\program files\Google
2010-02-20 22:59 . 2009-03-07 01:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-15 23:23 . 2009-03-25 14:24 -------- d-----w- c:\program files\Canopus
2010-02-07 00:27 . 2009-03-09 16:08 -------- d-----w- c:\program files\Games
2010-02-06 15:05 . 2009-08-07 14:45 -------- d-----w- c:\program files\Alawar
2010-01-12 10:38 . 2009-01-21 21:08 -------- d-----w- c:\program files\Electronic Arts
2010-01-11 21:22 . 2009-11-26 20:06 -------- d-----w- c:\program files\Spyware Terminator
2010-01-11 11:41 . 2010-01-11 11:41 7212 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-01-08 11:56 . 2009-12-27 09:56 -------- d-----w- c:\program files\Common Files\Nero
2010-01-07 15:07 . 2009-03-07 01:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-03-07 01:22 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-07 10:23 . 2010-01-07 10:23 -------- d-----w- c:\program files\Dobrý farmář
2010-01-07 10:11 . 2009-01-09 14:46 -------- d-----w- c:\program files\TC UP
2010-01-02 08:24 . 2009-12-03 22:51 -------- d-----w- c:\program files\CDBurnerXP
2009-12-27 09:40 . 2009-02-05 14:41 -------- d-----w- c:\program files\Common Files\Ahead
2009-12-27 09:40 . 2009-02-05 14:41 -------- d-----w- c:\program files\Ahead
2009-12-13 16:52 . 2009-12-01 15:39 40212 ----a-w- c:\windows\macromix.dll
2009-12-13 16:52 . 2009-12-01 15:39 30544 ----a-w- c:\windows\dirdib.drv
2009-12-10 08:54 . 2009-01-20 07:12 29480 ------w- c:\windows\system32\msxml3a.dll
2009-11-26 20:06 . 2009-11-26 20:06 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
.

------- Sigcheck -------

[-] 2008-04-27 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot_2010-02-21_22.37.37 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-22 11:39 . 2010-02-22 11:39 16384 c:\windows\temp\Perflib_Perfdata_24c.dat
+ 2010-02-22 11:39 . 2010-02-22 11:39 16384 c:\windows\temp\Perflib_Perfdata_118.dat
+ 2009-04-17 10:26 . 2009-04-17 10:26 9845 c:\windows\system32\mswen0obe.dll
- 2007-12-16 22:28 . 2007-12-16 22:28 9845 c:\windows\system32\mswen0obe.dll
+ 2009-06-11 11:42 . 2009-06-11 11:42 147456 c:\windows\system32\msmunaer4.dll
- 2009-06-28 19:01 . 2009-06-28 19:01 147456 c:\windows\system32\msmunaer4.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-01-04 3055616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-11-26 2166784]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-10-07 1461080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

c:\documents and settings\David a G bina\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Windows Defender.lnk - c:\program files\Windows Defender\MSASCui.exe [2006-11-3 866584]

c:\documents and settings\David a G bina\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Windows Defender.lnk - c:\program files\Windows Defender\MSASCui.exe [2006-11-3 866584]

c:\documents and settings\David a G bina\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Windows Defender.lnk - c:\program files\Windows Defender\MSASCui.exe [2006-11-3 866584]

c:\documents and settings\David a G bina\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Windows Defender.lnk - c:\program files\Windows Defender\MSASCui.exe [2006-11-3 866584]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders schannel.dll, digest.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^VIA RAID TOOL.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\VIA RAID TOOL.lnk
backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^David a Gábina^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
path=c:\documents and settings\David a Gábina\Nabídka Start\Programy\Po spuštění\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^David a Gábina^Nabídka Start^Programy^Po spuštění^FreeRapid 0.83u1.lnk]
path=c:\documents and settings\David a Gábina\Nabídka Start\Programy\Po spuštění\FreeRapid 0.83u1.lnk
backup=c:\windows\pss\FreeRapid 0.83u1.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 11:08 935288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 03:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
2009-08-28 17:36 75048 ----a-w- c:\program files\CyberLink\Shared Files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2009-03-01 10:59 172792 ----a-w- c:\program files\ICQ6.5\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD8LanguageShortcut]
2009-04-15 22:54 50472 ------w- c:\program files\CyberLink\PowerDVD8\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl8]
2009-07-16 19:08 91432 ------w- c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2007-04-16 13:28 577536 ----a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-03-16 22:57 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"e:\\emule\\emule.exe"=
"e:\\uTorrent\\uTorrent\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Program Files\\CorresBurn\\CorresBurn.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\iWin Games\\iWinGames.exe"=
"c:\\Program Files\\iWin Games\\WebUpdater.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Skupiny sítě Peer-to-Peer
"3540:UDP"= 3540:UDP:Protokol PNRP (Peer Name Resolution Protocol)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 pe3anmue;Ubersoldier 2 Environment Driver (pe3anmue);c:\windows\system32\drivers\pe3anmue.sys [21.2.2008 9:38 65152]
R0 ps7anmue;Ubersoldier 2 Synchronization Driver (ps7anmue);c:\windows\system32\drivers\ps7anmue.sys [21.2.2008 9:37 68744]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6.1.2009 21:10 717296]
R1 atitray;atitray;c:\program files\ATI Tray Tools\atitray.sys [22.5.2007 10:04 18088]
R1 cdrblock;cdrblock;c:\windows\system32\drivers\cdrblock.sys [22.3.2009 22:04 20864]
R1 cdrport;cdrport;c:\windows\system32\drivers\cdrport.sys [22.3.2009 22:04 4608]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [26.11.2009 21:06 142592]
R1 VD_FileDisk;VD_FileDisk;c:\windows\system32\drivers\vd_filedisk.sys [13.1.2006 14:00 15872]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};Power Control [2009/12/10 10:01];c:\program files\CyberLink\PowerDVD8\000.fcl [28.8.2009 18:36 87536]
R2 ekrn;Eset Service;c:\program files\Eset\ESET NOD32 Antivirus\ekrn.exe [7.10.2009 9:16 472280]
R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;c:\windows\system32\drivers\wf88vcap.sys [4.1.2009 13:47 193792]
R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;c:\windows\system32\drivers\WF88XBAR.sys [4.1.2009 13:52 9600]
R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;c:\windows\system32\drivers\wf88tune.sys [4.1.2009 13:48 37120]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
S2 pr2anmue;Ubersoldier 2 Drivers Auto Removal (pr2anmue);c:\windows\system32\pr2anmue.exe svc --> c:\windows\system32\pr2anmue.exe svc [?]
S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [9.1.2009 23:12 9446]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
.
------- Doplňkový sken -------
.
FF - ProfilePath - c:\documents and settings\David a Gábina\Data aplikací\Mozilla\Firefox\Profiles\luhd3r32.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/sli ... ie7&query=
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - plugin: c:\program files\Browser\program\plugins\npdsplay.dll
FF - plugin: c:\program files\Browser\program\plugins\NPSWF32.dll
FF - plugin: c:\program files\Browser\program\plugins\npwmsdrm.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-22 12:41
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x871D81F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7640f28
\Driver\ACPI -> ACPI.sys @ 0xf739bcb8
\Driver\atapi -> atapi.sys @ 0xf731ab40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80578fa2
ParseProcedure -> ntkrnlpa.exe @ 0x80577c04
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80578fa2
ParseProcedure -> ntkrnlpa.exe @ 0x80577c04
NDIS: Marvell Yukon 88E8053 PCI-E Gigabit Ethernet Controller -> SendCompleteHandler -> NDIS.sys @ 0xf7231bb0
PacketIndicateHandler -> NDIS.sys @ 0xf723ea21
SendHandler -> NDIS.sys @ 0xf721c87b
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1292428093-2000478354-682003330-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A2A1BB06-65AE-B418-D78E-048631AB10FF}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"jadikhcijpbkeijkdgam"=hex:62,61,70,63,00,00
"jadikhcijpbkeijkdgel"=hex:62,61,66,67,00,00
"iadhomjkehiiegiagn"=hex:6b,61,61,67,70,70,66,6e,67,6e,63,65,66,6a,65,6a,6f,63,
6e,63,6b,64,00,00
"hapeojjpnnnneoec"=hex:6b,61,67,68,61,70,6a,62,61,69,62,65,68,6f,6a,62,68,6a,
62,65,68,69,00,00
"jaoedkhfbhnabaieapgb"=hex:6f,61,65,69,6d,65,69,70,62,66,6f,69,67,6f,6c,6e,6a,
6b,6d,6b,64,6e,6c,6c,6a,6b,64,64,62,6f,00,00

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|˙˙˙˙¤•€|ů•6~*]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(932)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2736)
c:\windows\system32\msmunaer4.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\WinSCP3\DragExt.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\System32\snmp.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Celkový čas: 2010-02-22 12:47:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-02-22 11:47
ComboFix2.txt 2010-02-21 22:39
ComboFix3.txt 2009-05-22 23:20

Před spuštěním: 5 296 701 440
Po spuštění: 5 311 557 632

Current=4 Default=4 Failed=3 LastKnownGood=1 Sets=1,2,3,4
- - End Of File - - 14FA01615B8331A7136563B0D048E85A
Nahoru
Uživatelský avatar
autoprd
Level 4.5
Level 4.5
Příspěvky: 1715
Registrován: únor 09
Bydliště: ▼▲☺U Pc ☺▼▲
Pohlaví: Muž
Stav:
Offline
Kontakt:
Kontaktovat uživatele autoprd

Re: Sím o kontrolu logu

Příspěvekod autoprd » 24 úno 2010 15:35

Tak jestli nemáš nějaké problémy tak zatrhni příspěvek zelenou "Fajvkou"
Nahoru
Nero
nováček
Příspěvky: 40
Registrován: červen 08
Pohlaví: Nespecifikováno
Stav:
Offline

Re: Sím o kontrolu logu  Vyřešeno

Příspěvekod Nero » 24 úno 2010 22:50

OK,dík za pomoc. Ahoj
Nahoru
Zamčeno

Zpět na “HiJackThis”

Kdo je online

Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 94 hostů