Dobrý den, poslední dobou se mi stává, že mi z ničeho nic přestane fungovat myš a klávesnice a pc třeba sama otevře program nebo když hraju se mi postavička stále točí dokola.
Nedávno mi na FB přišla zpráva od kámoše at se kouknu na tuto fotku. Koukl jsem se a od té doby se mi to stává. Ptal jsem se kámoše co mi to poslal, ale on nic neposílal. Poté my antivir našel nějaké dva viry od nějaké IP adresy. Jednalo se poté o nějaký *.exe soubor -> e.exe.
děkuji za pomoc
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:37:03, on 4.7.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\ADVANC~1\wh_exec.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\WINDOWS\wupdate.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Documents and Settings\Owner\Data aplikací\winvsrnc.exe
C:\Documents and Settings\Owner\Data aplikací\winsvrcn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\PROGRA~1\FREEDO~1\fdm.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com?o=14597&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - mscoree.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [WheelMouse] C:\ADVANC~1\wh_exec.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [StartWinUpdate] C:\WINDOWS\wupdate.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Infium] "C:\qip\QIP 2010 JadrisPack\qip.exe" /isolated/acc já /pass profil /savepass /trylogin /autorun
O4 - HKCU\..\Run: [Windows System Updates] C:\Documents and Settings\Owner\Data aplikací\winvsrnc.exe
O4 - HKCU\..\Run: [WindowsSysControl] C:\Documents and Settings\Owner\Data aplikací\winsvrcn.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Doit.lnk = C:\Program Files\Doit.im\Doit.im.exe
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést cíl vazby do existujícího PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Přidat do stávajícího PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Připojit cíl vazby k existujícímu PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Připojit k existujícímu PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout video Free Download Managerem - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://C:\Program Files\Free Download Manager\dlall.htm
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 3966127195
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe
O23 - Service: AVG E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Dragon Age: Prameny - aktualizace obsahu (DAUpdaterSvc) - BioWare - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe
--
End of file - 12389 bytes
Prosím o kontrolu logu - pc si dělá co chce Vyřešeno
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43295
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu - pc si dělá co chce
Odinstaluj:
McAfee Security Scan
Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.
Pokud budou problémy , spusť v nouz. režimu.
McAfee Security Scan
Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod
Kód: Vybrat vše
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com?o=14597&l=dis
O2 - BHO: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - mscoree.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O3 - Toolbar: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [StartWinUpdate] C:\WINDOWS\wupdate.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 3966127195
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.
Pokud budou problémy , spusť v nouz. režimu.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Prosím o kontrolu logu - pc si dělá co chce
S tím McAfee Security Scan to bude těžké. Už v budoucnu sem ho odinstalovával pomocí CCleaner. A ted už tam není.
EDIT: Našel jsem pozůstatek v Document and setting/All Users/Nabídka Start/Programy/Po spuštění/ pomocí CCleaner sem ho v záložce Nástorje - Start vymazal
EDIT: Našel jsem pozůstatek v Document and setting/All Users/Nabídka Start/Programy/Po spuštění/ pomocí CCleaner sem ho v záložce Nástorje - Start vymazal
Re: Prosím o kontrolu logu - pc si dělá co chce
Tady je log z Malwarebytes' Anti-Malware
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Verze databáze: 4274
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
4.7.2010 17:24:41
mbam-log-2010-07-04 (17-24-41).txt
Typ skenu: Rychlý sken
Skenované objekty: 121201
Uplynulý čas: 4 minuta(y), 40 sekunda(y)
Infikované procesy v paměti: 2
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 2
Infikované datové položky registru: 1
Infikované složky: 0
Infikované soubory: 38
Infikované procesy v paměti:
C:\Documents and Settings\Owner\Data aplikací\winvsrnc.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Data aplikací\winsvrcn.exe (Backdoor.Bot) -> No action taken.
Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows system updates (Backdoor.Bot) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windowssyscontrol (Backdoor.Bot) -> No action taken.
Infikované datové položky registru:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> No action taken.
Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)
Infikované soubory:
C:\Documents and Settings\Owner\Data aplikací\winvsrnc.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Data aplikací\winsvrcn.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\bLk68N1L0f.log (Mismatched.Extension) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\cM7j1bgMFg.log (Mismatched.Extension) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\70769.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\73161.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\76021.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\76509.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\78343.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\81265.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\89210.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\93519.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\94871.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\98071.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\99147.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\99565.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\fDc8F0K6iK.log (Mismatched.Extension) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\Nj6Hm70jD0.log (Mismatched.Extension) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\67001.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\bjn.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\00425.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\00582.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\09192.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\13105.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\14424.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\15091.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\20010.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\28296.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\29713.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\42350.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\45940.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\49985.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\52264.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\61551.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\65042.exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4DRK4KTB\ih[1].Exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\INZ4VOCJ\ok[1].Exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\mastorscorps.cfg (Trojan.Banker) -> No action taken.
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43295
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu - pc si dělá co chce
Nedávej logy do quote ani do code.
Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit
Můžeš sem pak vložit nový log z MbAM.
Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.
Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit
Můžeš sem pak vložit nový log z MbAM.
Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Prosím o kontrolu logu - pc si dělá co chce
Log z Malwarebytes' Anti-Malware
----------------------------------------------------------------------
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Verze databáze: 4274
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
4.7.2010 20:00:49
mbam-log-2010-07-04 (20-00-49).txt
Typ skenu: Rychlý sken
Skenované objekty: 120954
Uplynulý čas: 3 minuta(y), 58 sekunda(y)
Infikované procesy v paměti: 2
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 2
Infikované datové položky registru: 1
Infikované složky: 0
Infikované soubory: 41
Infikované procesy v paměti:
C:\Documents and Settings\Owner\Data aplikací\winvsrnc.exe (Backdoor.Bot) -> Unloaded process successfully.
C:\Documents and Settings\Owner\Data aplikací\winsvrcn.exe (Backdoor.Bot) -> Unloaded process successfully.
Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows system updates (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windowssyscontrol (Backdoor.Bot) -> Quarantined and deleted successfully.
Infikované datové položky registru:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)
Infikované soubory:
C:\Documents and Settings\Owner\Data aplikací\winvsrnc.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Data aplikací\winsvrcn.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\bLk68N1L0f.log (Mismatched.Extension) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\cM7j1bgMFg.log (Mismatched.Extension) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\70769.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\73161.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\76021.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\76509.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\78343.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\80297.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\81265.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\86003.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\89210.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\93519.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\94871.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\98071.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\99147.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\99565.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\fDc8F0K6iK.log (Mismatched.Extension) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\Nj6Hm70jD0.log (Mismatched.Extension) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\67001.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\bjn.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\00425.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\00582.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\09192.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\13105.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\14424.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\15091.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\15374.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\20010.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\28296.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\29713.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\42350.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\45940.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\49985.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\52264.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\61551.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\65042.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4DRK4KTB\ih[1].Exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\INZ4VOCJ\ok[1].Exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\mastorscorps.cfg (Trojan.Banker) -> Quarantined and deleted successfully.
Log z ComboFix
----------------------------------------------------------------------
ComboFix 10-07-03.06 - Owner 04.07.2010 20:16:14.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1588 [GMT 2:00]
Spuštěný z: c:\documents and settings\Owner\Plocha\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-06-04 do 2010-07-04 )))))))))))))))))))))))))))))))
.
2010-07-04 15:19 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-04 15:19 . 2010-07-04 15:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-04 15:19 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-04 13:36 . 2010-07-04 13:36 -------- d-----w- c:\program files\Trend Micro
2010-06-25 18:57 . 2010-06-25 18:57 -------- d-----w- c:\program files\IObit
2010-06-25 12:56 . 2010-06-25 12:56 217180 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-06-25 12:56 . 2010-06-25 12:56 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-06-25 12:56 . 2010-06-25 12:56 217180 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-06-25 12:33 . 2010-07-01 21:18 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe
2010-06-23 18:42 . 2010-06-23 18:42 -------- d-----w- c:\program files\WB Games
2010-06-23 16:01 . 2010-06-23 16:01 -------- d-----w- c:\program files\SystemRequirementsLab
2010-06-23 16:01 . 2010-06-23 16:01 -------- d-----w- c:\documents and settings\Owner\SystemRequirementsLab
2010-06-22 14:03 . 2010-06-22 14:03 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-06-21 15:58 . 2010-06-24 20:07 -------- d-----w- c:\program files\TeamViewer
2010-06-21 13:49 . 2010-07-02 23:11 -------- d-----w- C:\Downloads
2010-06-21 12:46 . 2010-06-24 20:08 -------- d-----w- c:\program files\Software Informer
2010-06-21 12:46 . 2010-06-21 12:46 -------- d-----w- c:\program files\Free Download Manager
2010-06-21 12:26 . 2010-07-02 14:48 -------- d-----w- c:\program files\Electronic Arts
2010-06-21 12:24 . 2010-06-21 12:24 -------- d-----w- c:\windows\system32\AGEIA
2010-06-21 12:24 . 2010-06-30 13:51 -------- d-----w- c:\program files\AGEIA Technologies
2010-06-20 13:17 . 2010-06-20 13:17 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)
2010-06-20 10:55 . 2010-06-20 10:55 -------- d-----w- C:\wamp
2010-06-19 20:39 . 2010-07-01 12:28 -------- d-----w- c:\program files\Czech Soccer Manager 2002 FE
2010-06-19 19:14 . 2010-06-19 19:14 -------- d-----w- c:\program files\KONAMI
2010-06-19 19:07 . 2010-06-19 19:07 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-19 19:07 . 2010-06-19 19:10 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-06-18 22:14 . 2010-06-18 22:14 2427248 ----a-w- c:\windows\system32\pbsvc_heroes.exe
2010-06-18 22:03 . 2010-06-18 22:03 -------- d-----w- c:\program files\EA Games
2010-06-18 17:37 . 2010-06-18 17:37 -------- d-s---w- c:\program files\HLSW
2010-06-14 15:26 . 2010-06-25 22:29 -------- d-----w- c:\program files\uTorrent
2010-06-13 19:01 . 2010-06-13 19:01 -------- d-----w- c:\program files\Common Files\DirectX
2010-06-13 18:58 . 2010-06-17 19:04 -------- d-----w- c:\program files\Realtime Worlds
2010-06-13 18:46 . 2005-01-03 15:43 4682 ----a-w- c:\windows\system32\npptNT2.sys
2010-06-13 18:46 . 2010-06-13 18:46 -------- d-----w- c:\program files\Common Files\INCA Shared
2010-06-13 14:18 . 2010-06-13 14:18 -------- d-----w- c:\program files\Neffy
2010-06-12 13:49 . 2010-06-17 17:58 -------- d-----w- c:\program files\StarCraft II Beta
2010-06-12 13:49 . 2010-06-12 13:53 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-06-09 20:47 . 2010-05-06 10:35 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-07 17:00 . 2010-06-07 17:00 -------- d-----w- c:\program files\ASIO4ALL v2
2010-06-07 17:00 . 2010-06-07 17:00 -------- d-----w- c:\program files\Outsim
2010-06-07 16:58 . 2010-07-01 12:49 -------- d-----w- c:\program files\Image-Line
2010-06-07 16:57 . 2010-06-07 16:57 254464 ----a-w- c:\windows\wupdate.exe
2010-06-07 16:57 . 2010-06-07 17:00 -------- d-----w- c:\program files\Vstplugins
2010-06-07 16:48 . 2010-06-07 16:48 -------- d-----w- c:\program files\Sony
2010-06-07 16:47 . 2010-06-07 16:47 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-06-07 16:46 . 2010-06-07 16:46 -------- d-----w- c:\program files\Sony Setup
2010-06-06 12:22 . 2010-07-01 08:47 -------- d-----w- c:\program files\World of Warcraft
2010-06-05 07:22 . 2010-06-05 07:22 -------- d-----w- c:\program files\Archiving
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-04 18:06 . 2010-05-16 12:30 -------- d-----w- c:\program files\Steam
2010-07-04 10:40 . 2010-05-15 20:44 196608 ----a-w- c:\windows\system32\drivers\nStandard.bin
2010-07-03 01:32 . 2010-05-29 21:51 -------- d-----w- c:\program files\Xfire
2010-07-01 22:16 . 2010-06-02 13:21 218808 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-07-01 21:19 . 2010-06-02 13:22 137256 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-07-01 21:18 . 2010-06-02 13:21 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-07-01 18:55 . 2010-05-15 22:14 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-01 12:30 . 2010-05-15 23:24 -------- d-----w- c:\program files\CCleaner
2010-06-30 13:51 . 2010-05-30 09:54 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-06-25 12:56 . 2010-05-15 20:52 -------- d-----w- c:\program files\NVIDIA Corporation
2010-06-24 20:11 . 2010-05-15 20:37 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-22 14:03 . 2010-05-15 21:40 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-06-22 14:03 . 2010-05-15 21:40 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-06-17 19:28 . 2010-06-01 16:21 -------- d-----w- c:\program files\NCSoft
2010-06-14 21:50 . 2010-06-01 20:52 -------- d-----w- c:\program files\The KMPlayer
2010-06-09 21:01 . 2002-09-23 12:00 97214 ----a-w- c:\windows\system32\perfc005.dat
2010-06-09 21:01 . 2002-09-23 12:00 488652 ----a-w- c:\windows\system32\perfh005.dat
2010-06-07 15:35 . 2010-06-07 15:35 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-06-06 10:08 . 2010-05-15 23:26 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-03 20:55 . 2010-05-16 20:03 -------- d-----w- c:\program files\World of Goo
2010-06-03 14:12 . 2010-06-02 13:13 -------- d-----w- c:\program files\Zaparit
2010-06-01 17:12 . 2010-06-01 16:03 -------- d-----w- c:\program files\Java
2010-06-01 16:04 . 2010-06-01 16:04 -------- d-----w- c:\program files\Common Files\Java
2010-06-01 14:52 . 2010-06-01 14:51 -------- d-----w- c:\program files\Activision
2010-06-01 08:10 . 2010-05-15 21:40 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-31 17:37 . 2010-05-31 17:37 -------- d-----w- c:\program files\THQ
2010-05-30 09:59 . 2010-05-30 09:40 -------- d-----w- c:\program files\Dragon Age
2010-05-30 09:54 . 2010-05-30 09:39 -------- d-----w- c:\program files\Common Files\BioWare
2010-05-28 21:37 . 2010-05-28 21:37 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-05-28 20:27 . 2010-05-28 20:21 -------- d-----r- c:\program files\Skype
2010-05-28 20:21 . 2010-05-28 20:21 -------- d-----w- c:\program files\Common Files\Skype
2010-05-28 10:58 . 2010-05-15 20:42 600680 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-05-28 00:09 . 2010-05-28 00:09 41872 ----a-w- c:\windows\system32\xfcodec.dll
2010-05-24 22:15 . 2010-05-21 21:12 -------- d-----w- c:\program files\Winamp
2010-05-24 15:12 . 2010-05-24 15:12 -------- d-----w- c:\program files\MSBuild
2010-05-24 15:12 . 2010-05-24 15:12 -------- d-----w- c:\program files\Reference Assemblies
2010-05-23 22:14 . 2010-05-23 22:14 -------- d-----w- c:\program files\FormatFactory
2010-05-23 14:00 . 2010-05-23 14:00 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-05-17 19:34 . 2010-05-17 19:34 -------- d-----w- c:\program files\Microsoft.NET
2010-05-16 17:58 . 2010-05-16 17:58 -------- d-----w- c:\program files\OpenOffice.org 3
2010-05-16 12:59 . 2010-05-16 12:59 -------- d-----w- c:\program files\Adobe Media Player
2010-05-16 12:55 . 2010-05-16 12:55 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-05-16 10:50 . 2010-05-16 10:50 -------- d-----w- c:\program files\PSPad editor
2010-05-16 10:28 . 2010-05-16 10:28 -------- d-----w- c:\program files\FileZilla FTP Client
2010-05-15 23:32 . 2010-05-15 23:32 -------- d-----w- c:\program files\Doit.im
2010-05-15 23:30 . 2010-05-15 23:30 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-05-15 22:09 . 2010-05-15 22:09 0 ----a-w- c:\windows\nsreg.dat
2010-05-15 21:43 . 2010-05-15 21:43 -------- d-----w- c:\program files\DIFX
2010-05-15 21:43 . 2010-05-15 21:43 -------- d-----w- c:\program files\AnyDATA
2010-05-15 21:40 . 2010-05-15 21:40 52872 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-05-15 21:39 . 2010-05-15 21:39 -------- d-----w- c:\program files\AVG
2010-05-15 21:26 . 2010-05-15 20:26 76487 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-05-15 21:26 . 2010-05-15 20:26 2676 ----a-w- c:\windows\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2010-05-15 21:26 . 2010-05-15 20:26 8972 ----a-w- c:\windows\PCHealth\HelpCtr\Config\Cntstore.bin
2010-05-15 20:50 . 2010-05-15 20:50 -------- d-----w- c:\program files\MSXML 4.0
2010-05-15 20:49 . 2010-05-15 20:49 -------- d-----w- c:\program files\Gaming Mouse
2010-05-15 20:44 . 2010-05-15 20:44 -------- d-----w- c:\program files\ASUS
2010-05-15 20:41 . 2010-05-15 20:37 -------- d-----w- c:\program files\Common Files\InstallShield
2010-05-15 20:37 . 2010-05-15 20:37 -------- d-----w- c:\program files\Realtek
2010-05-15 20:37 . 2010-05-15 20:37 315392 ----a-w- c:\windows\HideWin.exe
2010-05-15 20:34 . 2010-05-15 20:34 -------- d-----w- c:\program files\Intel
2010-05-15 20:26 . 2010-05-15 20:26 -------- d-----w- c:\program files\microsoft frontpage
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\MQ1NR1B5.DAT
2010-05-15 20:26 . 2010-05-15 20:26 558142 ----a-w- c:\windows\java\Packages\4EKLNHVT.ZIP
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\JHF5RX3Z.DAT
2010-05-15 20:26 . 2010-05-15 20:26 155995 ----a-w- c:\windows\java\Packages\8QDJNHF1.ZIP
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\SSG6Y4CO.DAT
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\7DVPZZVL.DAT
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\5FLBJJHZ.DAT
2010-05-15 20:24 . 2010-05-15 20:24 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-05-06 10:35 . 2002-09-23 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 08:09 . 2002-09-23 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-20 05:32 . 2002-09-23 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-12 15:29 . 2010-06-01 17:12 411368 ----a-w- c:\windows\system32\deployJava1.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-04-19 08:25 2117704 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2010-05-16 1238352]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"Infium"="c:\qip\QIP 2010 JadrisPack\qip.exe" [2010-04-12 5734352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 16126464]
"SkyTel"="SkyTel.EXE" [2007-04-04 1822720]
"ASUSGamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-07-12 380928]
"WheelMouse"="c:\advanc~1\wh_exec.exe" [2007-10-13 98304]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-06-22 2065760]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-05-19 37888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-06-02 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-06-07 13902440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-06-07 110696]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-06-19 640440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Owner\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Doit.lnk - c:\program files\Doit.im\Doit.im.exe [2010-5-16 95232]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2010-5-28 3493264]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-06-22 14:03 12536 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\qip\\QIP 2010 JadrisPack\\qip.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\THQ\\Company of Heroes\\RelicDownloader\\RelicDownloader.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\StarCraft II Beta\\StarCraft II.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Steam\\SteamApps\\pooky1994\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2010\\pes2010.exe"=
"c:\\wamp\\bin\\apache\\Apache2.2.11\\bin\\httpd.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Game.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\lead and gold gangs of the wild west\\lag_win32_public_dev.exe"=
"c:\\Program Files\\StarCraft II Beta\\Versions\\Base15655\\SC2.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Documents and Settings\\Owner\\Local Settings\\Apps\\2.0\\PDCE9CLA.0Q0\\44OCDP79.H7M\\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\\CurseClient.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor MP Beta\\MoHMPUpdater.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor MP Beta\\MoHMPGame.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [15.5.2010 23:40 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [15.5.2010 23:40 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [15.5.2010 23:40 243024]
R2 avg9emc;AVG E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [22.6.2010 16:03 921440]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [22.6.2010 16:03 308136]
R3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\drivers\whfltr2k.sys [26.1.2007 1:45 6784]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15.8.2008 5:46 284016]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:\windows\system32\drivers\adusbser.sys [15.5.2010 23:43 93440]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [15.5.2010 23:40 430152]
S3 DAUpdaterSvc;Dragon Age: Prameny - aktualizace obsahu;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [15.12.2009 22:07 25832]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.6.2010 21:07 691696]
.
Obsah adresáře 'Naplánované úlohy'
2010-07-04 c:\windows\Tasks\User_Feed_Synchronization-{E4671AE1-E5B8-4912-8FBE-A7FF834E1047}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
IE: Převést cíl vazby do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést cíl vazby do existujícího PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Převést do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Přidat do stávajícího PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Stáhnout Free Download Managerem - file://c:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://c:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://c:\program files\Free Download Manager\dlall.htm
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\extensions\{753fb1ea-f42f-49ba-87a8-aed970191be9}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\extensions\{753fb1ea-f42f-49ba-87a8-aed970191be9}\components\RadioWMPCore.dll
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}\platform\WINNT_x86-msvc\components\pagespeed.dll
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-AdobeBridge - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-04 20:18
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-1214440339-1004336348-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:3e,75,45,5e,a2,4a,2e,bd,b2,cd,a9,d6,b3,d7,8b,75,9a,f8,56,62,80,dd,80,
75,01,c3,f6,0e,68,50,a4,5a,5a,81,3f,3d,aa,98,d0,79,3a,23,0c,0f,e2,3a,30,4c,\
"??"=hex:e2,06,90,c3,a9,ab,f7,ca,1c,f7,63,d7,3e,f2,89,5d
[HKEY_USERS\S-1-5-21-1214440339-1004336348-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:9b,ab,32,ae,ce,43,1f,c5,f4,ce,af,d2,fe,b9,22,c6,62,d6,7d,a3,52,
a4,cf,5f,d2,a1,d6,07,52,01,24,38,ff,b2,0b,34,f0,d3,eb,1e,bb,b2,a6,09,23,b5,\
"rkeysecu"=hex:39,23,7f,0f,a5,84,b6,a1,91,19,24,0a,74,56,01,fa
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(668)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Celkový čas: 2010-07-04 20:19:47
ComboFix-quarantined-files.txt 2010-07-04 18:19
Před spuštěním: Volných bajtů: 269 208 334 336
Po spuštění: Volných bajtů: 269 189 980 160
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
- - End Of File - - 75F8322A2A3D0AA4F35986C6A1B1B86B
----------------------------------------------------------------------
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Verze databáze: 4274
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
4.7.2010 20:00:49
mbam-log-2010-07-04 (20-00-49).txt
Typ skenu: Rychlý sken
Skenované objekty: 120954
Uplynulý čas: 3 minuta(y), 58 sekunda(y)
Infikované procesy v paměti: 2
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 2
Infikované datové položky registru: 1
Infikované složky: 0
Infikované soubory: 41
Infikované procesy v paměti:
C:\Documents and Settings\Owner\Data aplikací\winvsrnc.exe (Backdoor.Bot) -> Unloaded process successfully.
C:\Documents and Settings\Owner\Data aplikací\winsvrcn.exe (Backdoor.Bot) -> Unloaded process successfully.
Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows system updates (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windowssyscontrol (Backdoor.Bot) -> Quarantined and deleted successfully.
Infikované datové položky registru:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)
Infikované soubory:
C:\Documents and Settings\Owner\Data aplikací\winvsrnc.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Data aplikací\winsvrcn.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\bLk68N1L0f.log (Mismatched.Extension) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\cM7j1bgMFg.log (Mismatched.Extension) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\70769.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\73161.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\76021.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\76509.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\78343.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\80297.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\81265.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\86003.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\89210.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\93519.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\94871.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\98071.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\99147.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\99565.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\fDc8F0K6iK.log (Mismatched.Extension) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\Nj6Hm70jD0.log (Mismatched.Extension) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\67001.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\bjn.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\00425.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\00582.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\09192.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\13105.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\14424.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\15091.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\15374.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\20010.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\28296.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\29713.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\42350.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\45940.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\49985.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\52264.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\61551.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\65042.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4DRK4KTB\ih[1].Exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\INZ4VOCJ\ok[1].Exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\mastorscorps.cfg (Trojan.Banker) -> Quarantined and deleted successfully.
Log z ComboFix
----------------------------------------------------------------------
ComboFix 10-07-03.06 - Owner 04.07.2010 20:16:14.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1588 [GMT 2:00]
Spuštěný z: c:\documents and settings\Owner\Plocha\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-06-04 do 2010-07-04 )))))))))))))))))))))))))))))))
.
2010-07-04 15:19 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-04 15:19 . 2010-07-04 15:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-04 15:19 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-04 13:36 . 2010-07-04 13:36 -------- d-----w- c:\program files\Trend Micro
2010-06-25 18:57 . 2010-06-25 18:57 -------- d-----w- c:\program files\IObit
2010-06-25 12:56 . 2010-06-25 12:56 217180 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-06-25 12:56 . 2010-06-25 12:56 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-06-25 12:56 . 2010-06-25 12:56 217180 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-06-25 12:33 . 2010-07-01 21:18 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe
2010-06-23 18:42 . 2010-06-23 18:42 -------- d-----w- c:\program files\WB Games
2010-06-23 16:01 . 2010-06-23 16:01 -------- d-----w- c:\program files\SystemRequirementsLab
2010-06-23 16:01 . 2010-06-23 16:01 -------- d-----w- c:\documents and settings\Owner\SystemRequirementsLab
2010-06-22 14:03 . 2010-06-22 14:03 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-06-21 15:58 . 2010-06-24 20:07 -------- d-----w- c:\program files\TeamViewer
2010-06-21 13:49 . 2010-07-02 23:11 -------- d-----w- C:\Downloads
2010-06-21 12:46 . 2010-06-24 20:08 -------- d-----w- c:\program files\Software Informer
2010-06-21 12:46 . 2010-06-21 12:46 -------- d-----w- c:\program files\Free Download Manager
2010-06-21 12:26 . 2010-07-02 14:48 -------- d-----w- c:\program files\Electronic Arts
2010-06-21 12:24 . 2010-06-21 12:24 -------- d-----w- c:\windows\system32\AGEIA
2010-06-21 12:24 . 2010-06-30 13:51 -------- d-----w- c:\program files\AGEIA Technologies
2010-06-20 13:17 . 2010-06-20 13:17 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)
2010-06-20 10:55 . 2010-06-20 10:55 -------- d-----w- C:\wamp
2010-06-19 20:39 . 2010-07-01 12:28 -------- d-----w- c:\program files\Czech Soccer Manager 2002 FE
2010-06-19 19:14 . 2010-06-19 19:14 -------- d-----w- c:\program files\KONAMI
2010-06-19 19:07 . 2010-06-19 19:07 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-19 19:07 . 2010-06-19 19:10 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-06-18 22:14 . 2010-06-18 22:14 2427248 ----a-w- c:\windows\system32\pbsvc_heroes.exe
2010-06-18 22:03 . 2010-06-18 22:03 -------- d-----w- c:\program files\EA Games
2010-06-18 17:37 . 2010-06-18 17:37 -------- d-s---w- c:\program files\HLSW
2010-06-14 15:26 . 2010-06-25 22:29 -------- d-----w- c:\program files\uTorrent
2010-06-13 19:01 . 2010-06-13 19:01 -------- d-----w- c:\program files\Common Files\DirectX
2010-06-13 18:58 . 2010-06-17 19:04 -------- d-----w- c:\program files\Realtime Worlds
2010-06-13 18:46 . 2005-01-03 15:43 4682 ----a-w- c:\windows\system32\npptNT2.sys
2010-06-13 18:46 . 2010-06-13 18:46 -------- d-----w- c:\program files\Common Files\INCA Shared
2010-06-13 14:18 . 2010-06-13 14:18 -------- d-----w- c:\program files\Neffy
2010-06-12 13:49 . 2010-06-17 17:58 -------- d-----w- c:\program files\StarCraft II Beta
2010-06-12 13:49 . 2010-06-12 13:53 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-06-09 20:47 . 2010-05-06 10:35 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-07 17:00 . 2010-06-07 17:00 -------- d-----w- c:\program files\ASIO4ALL v2
2010-06-07 17:00 . 2010-06-07 17:00 -------- d-----w- c:\program files\Outsim
2010-06-07 16:58 . 2010-07-01 12:49 -------- d-----w- c:\program files\Image-Line
2010-06-07 16:57 . 2010-06-07 16:57 254464 ----a-w- c:\windows\wupdate.exe
2010-06-07 16:57 . 2010-06-07 17:00 -------- d-----w- c:\program files\Vstplugins
2010-06-07 16:48 . 2010-06-07 16:48 -------- d-----w- c:\program files\Sony
2010-06-07 16:47 . 2010-06-07 16:47 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-06-07 16:46 . 2010-06-07 16:46 -------- d-----w- c:\program files\Sony Setup
2010-06-06 12:22 . 2010-07-01 08:47 -------- d-----w- c:\program files\World of Warcraft
2010-06-05 07:22 . 2010-06-05 07:22 -------- d-----w- c:\program files\Archiving
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-04 18:06 . 2010-05-16 12:30 -------- d-----w- c:\program files\Steam
2010-07-04 10:40 . 2010-05-15 20:44 196608 ----a-w- c:\windows\system32\drivers\nStandard.bin
2010-07-03 01:32 . 2010-05-29 21:51 -------- d-----w- c:\program files\Xfire
2010-07-01 22:16 . 2010-06-02 13:21 218808 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-07-01 21:19 . 2010-06-02 13:22 137256 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-07-01 21:18 . 2010-06-02 13:21 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-07-01 18:55 . 2010-05-15 22:14 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-01 12:30 . 2010-05-15 23:24 -------- d-----w- c:\program files\CCleaner
2010-06-30 13:51 . 2010-05-30 09:54 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-06-25 12:56 . 2010-05-15 20:52 -------- d-----w- c:\program files\NVIDIA Corporation
2010-06-24 20:11 . 2010-05-15 20:37 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-22 14:03 . 2010-05-15 21:40 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-06-22 14:03 . 2010-05-15 21:40 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-06-17 19:28 . 2010-06-01 16:21 -------- d-----w- c:\program files\NCSoft
2010-06-14 21:50 . 2010-06-01 20:52 -------- d-----w- c:\program files\The KMPlayer
2010-06-09 21:01 . 2002-09-23 12:00 97214 ----a-w- c:\windows\system32\perfc005.dat
2010-06-09 21:01 . 2002-09-23 12:00 488652 ----a-w- c:\windows\system32\perfh005.dat
2010-06-07 15:35 . 2010-06-07 15:35 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-06-06 10:08 . 2010-05-15 23:26 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-03 20:55 . 2010-05-16 20:03 -------- d-----w- c:\program files\World of Goo
2010-06-03 14:12 . 2010-06-02 13:13 -------- d-----w- c:\program files\Zaparit
2010-06-01 17:12 . 2010-06-01 16:03 -------- d-----w- c:\program files\Java
2010-06-01 16:04 . 2010-06-01 16:04 -------- d-----w- c:\program files\Common Files\Java
2010-06-01 14:52 . 2010-06-01 14:51 -------- d-----w- c:\program files\Activision
2010-06-01 08:10 . 2010-05-15 21:40 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-31 17:37 . 2010-05-31 17:37 -------- d-----w- c:\program files\THQ
2010-05-30 09:59 . 2010-05-30 09:40 -------- d-----w- c:\program files\Dragon Age
2010-05-30 09:54 . 2010-05-30 09:39 -------- d-----w- c:\program files\Common Files\BioWare
2010-05-28 21:37 . 2010-05-28 21:37 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-05-28 20:27 . 2010-05-28 20:21 -------- d-----r- c:\program files\Skype
2010-05-28 20:21 . 2010-05-28 20:21 -------- d-----w- c:\program files\Common Files\Skype
2010-05-28 10:58 . 2010-05-15 20:42 600680 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-05-28 00:09 . 2010-05-28 00:09 41872 ----a-w- c:\windows\system32\xfcodec.dll
2010-05-24 22:15 . 2010-05-21 21:12 -------- d-----w- c:\program files\Winamp
2010-05-24 15:12 . 2010-05-24 15:12 -------- d-----w- c:\program files\MSBuild
2010-05-24 15:12 . 2010-05-24 15:12 -------- d-----w- c:\program files\Reference Assemblies
2010-05-23 22:14 . 2010-05-23 22:14 -------- d-----w- c:\program files\FormatFactory
2010-05-23 14:00 . 2010-05-23 14:00 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-05-17 19:34 . 2010-05-17 19:34 -------- d-----w- c:\program files\Microsoft.NET
2010-05-16 17:58 . 2010-05-16 17:58 -------- d-----w- c:\program files\OpenOffice.org 3
2010-05-16 12:59 . 2010-05-16 12:59 -------- d-----w- c:\program files\Adobe Media Player
2010-05-16 12:55 . 2010-05-16 12:55 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-05-16 10:50 . 2010-05-16 10:50 -------- d-----w- c:\program files\PSPad editor
2010-05-16 10:28 . 2010-05-16 10:28 -------- d-----w- c:\program files\FileZilla FTP Client
2010-05-15 23:32 . 2010-05-15 23:32 -------- d-----w- c:\program files\Doit.im
2010-05-15 23:30 . 2010-05-15 23:30 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-05-15 22:09 . 2010-05-15 22:09 0 ----a-w- c:\windows\nsreg.dat
2010-05-15 21:43 . 2010-05-15 21:43 -------- d-----w- c:\program files\DIFX
2010-05-15 21:43 . 2010-05-15 21:43 -------- d-----w- c:\program files\AnyDATA
2010-05-15 21:40 . 2010-05-15 21:40 52872 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-05-15 21:39 . 2010-05-15 21:39 -------- d-----w- c:\program files\AVG
2010-05-15 21:26 . 2010-05-15 20:26 76487 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-05-15 21:26 . 2010-05-15 20:26 2676 ----a-w- c:\windows\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2010-05-15 21:26 . 2010-05-15 20:26 8972 ----a-w- c:\windows\PCHealth\HelpCtr\Config\Cntstore.bin
2010-05-15 20:50 . 2010-05-15 20:50 -------- d-----w- c:\program files\MSXML 4.0
2010-05-15 20:49 . 2010-05-15 20:49 -------- d-----w- c:\program files\Gaming Mouse
2010-05-15 20:44 . 2010-05-15 20:44 -------- d-----w- c:\program files\ASUS
2010-05-15 20:41 . 2010-05-15 20:37 -------- d-----w- c:\program files\Common Files\InstallShield
2010-05-15 20:37 . 2010-05-15 20:37 -------- d-----w- c:\program files\Realtek
2010-05-15 20:37 . 2010-05-15 20:37 315392 ----a-w- c:\windows\HideWin.exe
2010-05-15 20:34 . 2010-05-15 20:34 -------- d-----w- c:\program files\Intel
2010-05-15 20:26 . 2010-05-15 20:26 -------- d-----w- c:\program files\microsoft frontpage
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\MQ1NR1B5.DAT
2010-05-15 20:26 . 2010-05-15 20:26 558142 ----a-w- c:\windows\java\Packages\4EKLNHVT.ZIP
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\JHF5RX3Z.DAT
2010-05-15 20:26 . 2010-05-15 20:26 155995 ----a-w- c:\windows\java\Packages\8QDJNHF1.ZIP
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\SSG6Y4CO.DAT
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\7DVPZZVL.DAT
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\5FLBJJHZ.DAT
2010-05-15 20:24 . 2010-05-15 20:24 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-05-06 10:35 . 2002-09-23 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 08:09 . 2002-09-23 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-20 05:32 . 2002-09-23 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-12 15:29 . 2010-06-01 17:12 411368 ----a-w- c:\windows\system32\deployJava1.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-04-19 08:25 2117704 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2010-05-16 1238352]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"Infium"="c:\qip\QIP 2010 JadrisPack\qip.exe" [2010-04-12 5734352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 16126464]
"SkyTel"="SkyTel.EXE" [2007-04-04 1822720]
"ASUSGamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-07-12 380928]
"WheelMouse"="c:\advanc~1\wh_exec.exe" [2007-10-13 98304]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-06-22 2065760]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-05-19 37888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-06-02 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-06-07 13902440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-06-07 110696]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-06-19 640440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Owner\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Doit.lnk - c:\program files\Doit.im\Doit.im.exe [2010-5-16 95232]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2010-5-28 3493264]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-06-22 14:03 12536 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\qip\\QIP 2010 JadrisPack\\qip.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\THQ\\Company of Heroes\\RelicDownloader\\RelicDownloader.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\StarCraft II Beta\\StarCraft II.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Steam\\SteamApps\\pooky1994\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2010\\pes2010.exe"=
"c:\\wamp\\bin\\apache\\Apache2.2.11\\bin\\httpd.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Game.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\lead and gold gangs of the wild west\\lag_win32_public_dev.exe"=
"c:\\Program Files\\StarCraft II Beta\\Versions\\Base15655\\SC2.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Documents and Settings\\Owner\\Local Settings\\Apps\\2.0\\PDCE9CLA.0Q0\\44OCDP79.H7M\\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\\CurseClient.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor MP Beta\\MoHMPUpdater.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor MP Beta\\MoHMPGame.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [15.5.2010 23:40 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [15.5.2010 23:40 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [15.5.2010 23:40 243024]
R2 avg9emc;AVG E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [22.6.2010 16:03 921440]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [22.6.2010 16:03 308136]
R3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\drivers\whfltr2k.sys [26.1.2007 1:45 6784]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15.8.2008 5:46 284016]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:\windows\system32\drivers\adusbser.sys [15.5.2010 23:43 93440]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [15.5.2010 23:40 430152]
S3 DAUpdaterSvc;Dragon Age: Prameny - aktualizace obsahu;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [15.12.2009 22:07 25832]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.6.2010 21:07 691696]
.
Obsah adresáře 'Naplánované úlohy'
2010-07-04 c:\windows\Tasks\User_Feed_Synchronization-{E4671AE1-E5B8-4912-8FBE-A7FF834E1047}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
IE: Převést cíl vazby do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést cíl vazby do existujícího PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Převést do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Přidat do stávajícího PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Stáhnout Free Download Managerem - file://c:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://c:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://c:\program files\Free Download Manager\dlall.htm
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\extensions\{753fb1ea-f42f-49ba-87a8-aed970191be9}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\extensions\{753fb1ea-f42f-49ba-87a8-aed970191be9}\components\RadioWMPCore.dll
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}\platform\WINNT_x86-msvc\components\pagespeed.dll
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-AdobeBridge - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-04 20:18
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-1214440339-1004336348-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:3e,75,45,5e,a2,4a,2e,bd,b2,cd,a9,d6,b3,d7,8b,75,9a,f8,56,62,80,dd,80,
75,01,c3,f6,0e,68,50,a4,5a,5a,81,3f,3d,aa,98,d0,79,3a,23,0c,0f,e2,3a,30,4c,\
"??"=hex:e2,06,90,c3,a9,ab,f7,ca,1c,f7,63,d7,3e,f2,89,5d
[HKEY_USERS\S-1-5-21-1214440339-1004336348-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:9b,ab,32,ae,ce,43,1f,c5,f4,ce,af,d2,fe,b9,22,c6,62,d6,7d,a3,52,
a4,cf,5f,d2,a1,d6,07,52,01,24,38,ff,b2,0b,34,f0,d3,eb,1e,bb,b2,a6,09,23,b5,\
"rkeysecu"=hex:39,23,7f,0f,a5,84,b6,a1,91,19,24,0a,74,56,01,fa
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(668)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Celkový čas: 2010-07-04 20:19:47
ComboFix-quarantined-files.txt 2010-07-04 18:19
Před spuštěním: Volných bajtů: 269 208 334 336
Po spuštění: Volných bajtů: 269 189 980 160
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
- - End Of File - - 75F8322A2A3D0AA4F35986C6A1B1B86B
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43295
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu - pc si dělá co chce
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE
Kód: Vybrat vše
KillAll::
File::
c:\windows\wupdate.exe
c:\windows\system32\ezsidmv.dat
c:\windows\HideWin.exe
Driver::
Npggsvc
Registry::
[-HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[-HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
Firefox::
FF - ProfilePath - c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Ask.comZvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Prosím o kontrolu logu - pc si dělá co chce
ComboFix
----------------------------------------------------------------------
ComboFix 10-07-03.06 - Owner 04.07.2010 21:01:30.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1486 [GMT 2:00]
Spuštěný z: c:\documents and settings\Owner\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Owner\Plocha\CFScript.txt
AV: AVG Anti-Virus *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FILE ::
"c:\windows\HideWin.exe"
"c:\windows\system32\ezsidmv.dat"
"c:\windows\wupdate.exe"
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\HideWin.exe
c:\windows\system32\ezsidmv.dat
c:\windows\wupdate.exe
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-06-04 do 2010-07-04 )))))))))))))))))))))))))))))))
.
2010-07-04 18:21 . 2009-08-06 17:23 215920 ----a-w- c:\windows\system32\muweb.dll
2010-07-04 15:19 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-04 15:19 . 2010-07-04 15:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-04 15:19 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-04 13:36 . 2010-07-04 13:36 -------- d-----w- c:\program files\Trend Micro
2010-06-25 18:57 . 2010-06-25 18:57 -------- d-----w- c:\program files\IObit
2010-06-25 12:56 . 2010-06-25 12:56 217180 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-06-25 12:56 . 2010-06-25 12:56 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-06-25 12:56 . 2010-06-25 12:56 217180 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-06-25 12:33 . 2010-07-01 21:18 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe
2010-06-23 18:42 . 2010-06-23 18:42 -------- d-----w- c:\program files\WB Games
2010-06-23 16:01 . 2010-06-23 16:01 -------- d-----w- c:\program files\SystemRequirementsLab
2010-06-23 16:01 . 2010-06-23 16:01 -------- d-----w- c:\documents and settings\Owner\SystemRequirementsLab
2010-06-22 14:03 . 2010-06-22 14:03 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-06-21 15:58 . 2010-06-24 20:07 -------- d-----w- c:\program files\TeamViewer
2010-06-21 13:49 . 2010-07-02 23:11 -------- d-----w- C:\Downloads
2010-06-21 12:46 . 2010-06-24 20:08 -------- d-----w- c:\program files\Software Informer
2010-06-21 12:46 . 2010-06-21 12:46 -------- d-----w- c:\program files\Free Download Manager
2010-06-21 12:26 . 2010-07-02 14:48 -------- d-----w- c:\program files\Electronic Arts
2010-06-21 12:24 . 2010-06-21 12:24 -------- d-----w- c:\windows\system32\AGEIA
2010-06-21 12:24 . 2010-06-30 13:51 -------- d-----w- c:\program files\AGEIA Technologies
2010-06-20 13:17 . 2010-06-20 13:17 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)
2010-06-20 10:55 . 2010-06-20 10:55 -------- d-----w- C:\wamp
2010-06-19 20:39 . 2010-07-01 12:28 -------- d-----w- c:\program files\Czech Soccer Manager 2002 FE
2010-06-19 19:14 . 2010-06-19 19:14 -------- d-----w- c:\program files\KONAMI
2010-06-19 19:07 . 2010-06-19 19:07 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-19 19:07 . 2010-06-19 19:10 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-06-18 22:14 . 2010-06-18 22:14 2427248 ----a-w- c:\windows\system32\pbsvc_heroes.exe
2010-06-18 22:03 . 2010-06-18 22:03 -------- d-----w- c:\program files\EA Games
2010-06-18 17:37 . 2010-06-18 17:37 -------- d-s---w- c:\program files\HLSW
2010-06-14 15:26 . 2010-06-25 22:29 -------- d-----w- c:\program files\uTorrent
2010-06-13 19:01 . 2010-06-13 19:01 -------- d-----w- c:\program files\Common Files\DirectX
2010-06-13 18:58 . 2010-06-17 19:04 -------- d-----w- c:\program files\Realtime Worlds
2010-06-13 18:46 . 2005-01-03 15:43 4682 ----a-w- c:\windows\system32\npptNT2.sys
2010-06-13 18:46 . 2010-06-13 18:46 -------- d-----w- c:\program files\Common Files\INCA Shared
2010-06-13 14:18 . 2010-06-13 14:18 -------- d-----w- c:\program files\Neffy
2010-06-12 13:49 . 2010-06-17 17:58 -------- d-----w- c:\program files\StarCraft II Beta
2010-06-12 13:49 . 2010-06-12 13:53 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-06-09 20:47 . 2010-05-06 10:35 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-07 17:00 . 2010-06-07 17:00 -------- d-----w- c:\program files\ASIO4ALL v2
2010-06-07 17:00 . 2010-06-07 17:00 -------- d-----w- c:\program files\Outsim
2010-06-07 16:58 . 2010-07-01 12:49 -------- d-----w- c:\program files\Image-Line
2010-06-07 16:57 . 2010-06-07 17:00 -------- d-----w- c:\program files\Vstplugins
2010-06-07 16:48 . 2010-06-07 16:48 -------- d-----w- c:\program files\Sony
2010-06-07 16:47 . 2010-06-07 16:47 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-06-07 16:46 . 2010-06-07 16:46 -------- d-----w- c:\program files\Sony Setup
2010-06-06 12:22 . 2010-07-01 08:47 -------- d-----w- c:\program files\World of Warcraft
2010-06-05 07:22 . 2010-06-05 07:22 -------- d-----w- c:\program files\Archiving
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-04 19:06 . 2010-05-16 12:30 -------- d-----w- c:\program files\Steam
2010-07-04 10:40 . 2010-05-15 20:44 196608 ----a-w- c:\windows\system32\drivers\nStandard.bin
2010-07-03 01:32 . 2010-05-29 21:51 -------- d-----w- c:\program files\Xfire
2010-07-01 22:16 . 2010-06-02 13:21 218808 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-07-01 21:19 . 2010-06-02 13:22 137256 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-07-01 21:18 . 2010-06-02 13:21 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-07-01 18:55 . 2010-05-15 22:14 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-01 12:30 . 2010-05-15 23:24 -------- d-----w- c:\program files\CCleaner
2010-06-30 13:51 . 2010-05-30 09:54 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-06-25 12:56 . 2010-05-15 20:52 -------- d-----w- c:\program files\NVIDIA Corporation
2010-06-24 20:11 . 2010-05-15 20:37 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-22 14:03 . 2010-05-15 21:40 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-06-22 14:03 . 2010-05-15 21:40 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-06-17 19:28 . 2010-06-01 16:21 -------- d-----w- c:\program files\NCSoft
2010-06-14 21:50 . 2010-06-01 20:52 -------- d-----w- c:\program files\The KMPlayer
2010-06-09 21:01 . 2002-09-23 12:00 97214 ----a-w- c:\windows\system32\perfc005.dat
2010-06-09 21:01 . 2002-09-23 12:00 488652 ----a-w- c:\windows\system32\perfh005.dat
2010-06-07 15:35 . 2010-06-07 15:35 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-06-06 10:08 . 2010-05-15 23:26 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-03 20:55 . 2010-05-16 20:03 -------- d-----w- c:\program files\World of Goo
2010-06-03 14:12 . 2010-06-02 13:13 -------- d-----w- c:\program files\Zaparit
2010-06-01 17:12 . 2010-06-01 16:03 -------- d-----w- c:\program files\Java
2010-06-01 16:04 . 2010-06-01 16:04 -------- d-----w- c:\program files\Common Files\Java
2010-06-01 14:52 . 2010-06-01 14:51 -------- d-----w- c:\program files\Activision
2010-06-01 08:10 . 2010-05-15 21:40 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-31 17:37 . 2010-05-31 17:37 -------- d-----w- c:\program files\THQ
2010-05-30 09:59 . 2010-05-30 09:40 -------- d-----w- c:\program files\Dragon Age
2010-05-30 09:54 . 2010-05-30 09:39 -------- d-----w- c:\program files\Common Files\BioWare
2010-05-28 20:27 . 2010-05-28 20:21 -------- d-----r- c:\program files\Skype
2010-05-28 20:21 . 2010-05-28 20:21 -------- d-----w- c:\program files\Common Files\Skype
2010-05-28 10:58 . 2010-05-15 20:42 600680 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-05-28 00:09 . 2010-05-28 00:09 41872 ----a-w- c:\windows\system32\xfcodec.dll
2010-05-24 22:15 . 2010-05-21 21:12 -------- d-----w- c:\program files\Winamp
2010-05-24 15:12 . 2010-05-24 15:12 -------- d-----w- c:\program files\MSBuild
2010-05-24 15:12 . 2010-05-24 15:12 -------- d-----w- c:\program files\Reference Assemblies
2010-05-23 22:14 . 2010-05-23 22:14 -------- d-----w- c:\program files\FormatFactory
2010-05-23 14:00 . 2010-05-23 14:00 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-05-17 19:34 . 2010-05-17 19:34 -------- d-----w- c:\program files\Microsoft.NET
2010-05-16 17:58 . 2010-05-16 17:58 -------- d-----w- c:\program files\OpenOffice.org 3
2010-05-16 12:59 . 2010-05-16 12:59 -------- d-----w- c:\program files\Adobe Media Player
2010-05-16 12:55 . 2010-05-16 12:55 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-05-16 10:50 . 2010-05-16 10:50 -------- d-----w- c:\program files\PSPad editor
2010-05-16 10:28 . 2010-05-16 10:28 -------- d-----w- c:\program files\FileZilla FTP Client
2010-05-15 23:32 . 2010-05-15 23:32 -------- d-----w- c:\program files\Doit.im
2010-05-15 23:30 . 2010-05-15 23:30 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-05-15 22:09 . 2010-05-15 22:09 0 ----a-w- c:\windows\nsreg.dat
2010-05-15 21:43 . 2010-05-15 21:43 -------- d-----w- c:\program files\DIFX
2010-05-15 21:43 . 2010-05-15 21:43 -------- d-----w- c:\program files\AnyDATA
2010-05-15 21:40 . 2010-05-15 21:40 52872 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-05-15 21:39 . 2010-05-15 21:39 -------- d-----w- c:\program files\AVG
2010-05-15 21:26 . 2010-05-15 20:26 76487 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-05-15 21:26 . 2010-05-15 20:26 2676 ----a-w- c:\windows\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2010-05-15 21:26 . 2010-05-15 20:26 8972 ----a-w- c:\windows\PCHealth\HelpCtr\Config\Cntstore.bin
2010-05-15 20:50 . 2010-05-15 20:50 -------- d-----w- c:\program files\MSXML 4.0
2010-05-15 20:49 . 2010-05-15 20:49 -------- d-----w- c:\program files\Gaming Mouse
2010-05-15 20:44 . 2010-05-15 20:44 -------- d-----w- c:\program files\ASUS
2010-05-15 20:41 . 2010-05-15 20:37 -------- d-----w- c:\program files\Common Files\InstallShield
2010-05-15 20:37 . 2010-05-15 20:37 -------- d-----w- c:\program files\Realtek
2010-05-15 20:34 . 2010-05-15 20:34 -------- d-----w- c:\program files\Intel
2010-05-15 20:26 . 2010-05-15 20:26 -------- d-----w- c:\program files\microsoft frontpage
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\MQ1NR1B5.DAT
2010-05-15 20:26 . 2010-05-15 20:26 558142 ----a-w- c:\windows\java\Packages\4EKLNHVT.ZIP
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\JHF5RX3Z.DAT
2010-05-15 20:26 . 2010-05-15 20:26 155995 ----a-w- c:\windows\java\Packages\8QDJNHF1.ZIP
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\SSG6Y4CO.DAT
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\7DVPZZVL.DAT
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\5FLBJJHZ.DAT
2010-05-15 20:24 . 2010-05-15 20:24 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-05-06 10:35 . 2002-09-23 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 08:09 . 2002-09-23 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-20 05:32 . 2002-09-23 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-12 15:29 . 2010-06-01 17:12 411368 ----a-w- c:\windows\system32\deployJava1.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-07-04_18.18.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-04 19:06 . 2010-07-04 19:06 16384 c:\windows\temp\Perflib_Perfdata_7d0.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2010-05-16 1238352]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"Infium"="c:\qip\QIP 2010 JadrisPack\qip.exe" [2010-04-12 5734352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 16126464]
"SkyTel"="SkyTel.EXE" [2007-04-04 1822720]
"ASUSGamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-07-12 380928]
"WheelMouse"="c:\advanc~1\wh_exec.exe" [2007-10-13 98304]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-06-22 2065760]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-05-19 37888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-06-02 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-06-07 13902440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-06-07 110696]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-06-19 640440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Owner\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Doit.lnk - c:\program files\Doit.im\Doit.im.exe [2010-5-16 95232]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2010-5-28 3493264]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-06-22 14:03 12536 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\qip\\QIP 2010 JadrisPack\\qip.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\THQ\\Company of Heroes\\RelicDownloader\\RelicDownloader.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\StarCraft II Beta\\StarCraft II.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Steam\\SteamApps\\pooky1994\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2010\\pes2010.exe"=
"c:\\wamp\\bin\\apache\\Apache2.2.11\\bin\\httpd.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Game.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\lead and gold gangs of the wild west\\lag_win32_public_dev.exe"=
"c:\\Program Files\\StarCraft II Beta\\Versions\\Base15655\\SC2.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Documents and Settings\\Owner\\Local Settings\\Apps\\2.0\\PDCE9CLA.0Q0\\44OCDP79.H7M\\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\\CurseClient.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor MP Beta\\MoHMPUpdater.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor MP Beta\\MoHMPGame.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [15.5.2010 23:40 52872]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.6.2010 21:07 691696]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [15.5.2010 23:40 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [15.5.2010 23:40 243024]
R2 avg9emc;AVG E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [22.6.2010 16:03 921440]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [22.6.2010 16:03 308136]
R3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\drivers\whfltr2k.sys [26.1.2007 1:45 6784]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15.8.2008 5:46 284016]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:\windows\system32\drivers\adusbser.sys [15.5.2010 23:43 93440]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [15.5.2010 23:40 430152]
S3 DAUpdaterSvc;Dragon Age: Prameny - aktualizace obsahu;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [15.12.2009 22:07 25832]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
Obsah adresáře 'Naplánované úlohy'
2010-07-04 c:\windows\Tasks\User_Feed_Synchronization-{E4671AE1-E5B8-4912-8FBE-A7FF834E1047}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
IE: Převést cíl vazby do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést cíl vazby do existujícího PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Převést do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Přidat do stávajícího PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Stáhnout Free Download Managerem - file://c:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://c:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://c:\program files\Free Download Manager\dlall.htm
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\extensions\{753fb1ea-f42f-49ba-87a8-aed970191be9}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\extensions\{753fb1ea-f42f-49ba-87a8-aed970191be9}\components\RadioWMPCore.dll
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}\platform\WINNT_x86-msvc\components\pagespeed.dll
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-04 21:07
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spnp.sys >>UNKNOWN [0x8A581938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf74a3cb8
\Driver\atapi -> atapi.sys @ 0xf7849b40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
ParseProcedure -> ntoskrnl.exe @ 0x80578f7a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
ParseProcedure -> ntoskrnl.exe @ 0x80578f7a
NDIS: Atheros L2 Fast Ethernet 10/100 Base-T Controller -> SendCompleteHandler -> NDIS.sys @ 0xf7a37bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7a44a21
SendHandler -> NDIS.sys @ 0xf7a2287b
user & kernel MBR OK
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-1214440339-1004336348-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:3e,75,45,5e,a2,4a,2e,bd,b2,cd,a9,d6,b3,d7,8b,75,9a,f8,56,62,80,dd,80,
75,01,c3,f6,0e,68,50,a4,5a,5a,81,3f,3d,aa,98,d0,79,3a,23,0c,0f,e2,3a,30,4c,\
"??"=hex:e2,06,90,c3,a9,ab,f7,ca,1c,f7,63,d7,3e,f2,89,5d
[HKEY_USERS\S-1-5-21-1214440339-1004336348-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:9b,ab,32,ae,ce,43,1f,c5,f4,ce,af,d2,fe,b9,22,c6,62,d6,7d,a3,52,
a4,cf,5f,d2,a1,d6,07,52,01,24,38,ff,b2,0b,34,f0,d3,eb,1e,bb,b2,a6,09,23,b5,\
"rkeysecu"=hex:39,23,7f,0f,a5,84,b6,a1,91,19,24,0a,74,56,01,fa
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(688)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
- - - - - - - > 'explorer.exe'(3124)
c:\program files\Xfire\xfire_toucan_42784.dll
c:\advanc~1\wh_hook.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\System32\nvsvc32.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\ATKKBService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\PnkBstrA.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\windows\system32\PnkBstrB.exe
c:\program files\AVG\AVG9\avgam.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\System32\wbem\wmiapsrv.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Celkový čas: 2010-07-04 21:10:59 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-07-04 19:10
ComboFix2.txt 2010-07-04 18:19
Před spuštěním: Volných bajtů: 269 209 804 800
Po spuštění: Volných bajtů: 269 195 231 232
- - End Of File - - 45A8573EADDDC9DF22ECF2A11B82F709
Log z HiJackThis
----------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:14:37, on 4.7.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\ADVANC~1\wh_exec.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [WheelMouse] C:\ADVANC~1\wh_exec.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Infium] "C:\qip\QIP 2010 JadrisPack\qip.exe" /isolated/acc já /pass profil /savepass /trylogin /autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Doit.lnk = C:\Program Files\Doit.im\Doit.im.exe
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést cíl vazby do existujícího PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Přidat do stávajícího PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Připojit cíl vazby k existujícímu PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Připojit k existujícímu PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout video Free Download Managerem - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://C:\Program Files\Free Download Manager\dlall.htm
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe
O23 - Service: AVG E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Dragon Age: Prameny - aktualizace obsahu (DAUpdaterSvc) - BioWare - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe
--
End of file - 10136 bytes
----------------------------------------------------------------------
ComboFix 10-07-03.06 - Owner 04.07.2010 21:01:30.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1486 [GMT 2:00]
Spuštěný z: c:\documents and settings\Owner\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Owner\Plocha\CFScript.txt
AV: AVG Anti-Virus *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FILE ::
"c:\windows\HideWin.exe"
"c:\windows\system32\ezsidmv.dat"
"c:\windows\wupdate.exe"
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\HideWin.exe
c:\windows\system32\ezsidmv.dat
c:\windows\wupdate.exe
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-06-04 do 2010-07-04 )))))))))))))))))))))))))))))))
.
2010-07-04 18:21 . 2009-08-06 17:23 215920 ----a-w- c:\windows\system32\muweb.dll
2010-07-04 15:19 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-04 15:19 . 2010-07-04 15:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-04 15:19 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-04 13:36 . 2010-07-04 13:36 -------- d-----w- c:\program files\Trend Micro
2010-06-25 18:57 . 2010-06-25 18:57 -------- d-----w- c:\program files\IObit
2010-06-25 12:56 . 2010-06-25 12:56 217180 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-06-25 12:56 . 2010-06-25 12:56 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-06-25 12:56 . 2010-06-25 12:56 217180 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-06-25 12:33 . 2010-07-01 21:18 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe
2010-06-23 18:42 . 2010-06-23 18:42 -------- d-----w- c:\program files\WB Games
2010-06-23 16:01 . 2010-06-23 16:01 -------- d-----w- c:\program files\SystemRequirementsLab
2010-06-23 16:01 . 2010-06-23 16:01 -------- d-----w- c:\documents and settings\Owner\SystemRequirementsLab
2010-06-22 14:03 . 2010-06-22 14:03 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-06-21 15:58 . 2010-06-24 20:07 -------- d-----w- c:\program files\TeamViewer
2010-06-21 13:49 . 2010-07-02 23:11 -------- d-----w- C:\Downloads
2010-06-21 12:46 . 2010-06-24 20:08 -------- d-----w- c:\program files\Software Informer
2010-06-21 12:46 . 2010-06-21 12:46 -------- d-----w- c:\program files\Free Download Manager
2010-06-21 12:26 . 2010-07-02 14:48 -------- d-----w- c:\program files\Electronic Arts
2010-06-21 12:24 . 2010-06-21 12:24 -------- d-----w- c:\windows\system32\AGEIA
2010-06-21 12:24 . 2010-06-30 13:51 -------- d-----w- c:\program files\AGEIA Technologies
2010-06-20 13:17 . 2010-06-20 13:17 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)
2010-06-20 10:55 . 2010-06-20 10:55 -------- d-----w- C:\wamp
2010-06-19 20:39 . 2010-07-01 12:28 -------- d-----w- c:\program files\Czech Soccer Manager 2002 FE
2010-06-19 19:14 . 2010-06-19 19:14 -------- d-----w- c:\program files\KONAMI
2010-06-19 19:07 . 2010-06-19 19:07 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-19 19:07 . 2010-06-19 19:10 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-06-18 22:14 . 2010-06-18 22:14 2427248 ----a-w- c:\windows\system32\pbsvc_heroes.exe
2010-06-18 22:03 . 2010-06-18 22:03 -------- d-----w- c:\program files\EA Games
2010-06-18 17:37 . 2010-06-18 17:37 -------- d-s---w- c:\program files\HLSW
2010-06-14 15:26 . 2010-06-25 22:29 -------- d-----w- c:\program files\uTorrent
2010-06-13 19:01 . 2010-06-13 19:01 -------- d-----w- c:\program files\Common Files\DirectX
2010-06-13 18:58 . 2010-06-17 19:04 -------- d-----w- c:\program files\Realtime Worlds
2010-06-13 18:46 . 2005-01-03 15:43 4682 ----a-w- c:\windows\system32\npptNT2.sys
2010-06-13 18:46 . 2010-06-13 18:46 -------- d-----w- c:\program files\Common Files\INCA Shared
2010-06-13 14:18 . 2010-06-13 14:18 -------- d-----w- c:\program files\Neffy
2010-06-12 13:49 . 2010-06-17 17:58 -------- d-----w- c:\program files\StarCraft II Beta
2010-06-12 13:49 . 2010-06-12 13:53 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-06-09 20:47 . 2010-05-06 10:35 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-07 17:00 . 2010-06-07 17:00 -------- d-----w- c:\program files\ASIO4ALL v2
2010-06-07 17:00 . 2010-06-07 17:00 -------- d-----w- c:\program files\Outsim
2010-06-07 16:58 . 2010-07-01 12:49 -------- d-----w- c:\program files\Image-Line
2010-06-07 16:57 . 2010-06-07 17:00 -------- d-----w- c:\program files\Vstplugins
2010-06-07 16:48 . 2010-06-07 16:48 -------- d-----w- c:\program files\Sony
2010-06-07 16:47 . 2010-06-07 16:47 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-06-07 16:46 . 2010-06-07 16:46 -------- d-----w- c:\program files\Sony Setup
2010-06-06 12:22 . 2010-07-01 08:47 -------- d-----w- c:\program files\World of Warcraft
2010-06-05 07:22 . 2010-06-05 07:22 -------- d-----w- c:\program files\Archiving
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-04 19:06 . 2010-05-16 12:30 -------- d-----w- c:\program files\Steam
2010-07-04 10:40 . 2010-05-15 20:44 196608 ----a-w- c:\windows\system32\drivers\nStandard.bin
2010-07-03 01:32 . 2010-05-29 21:51 -------- d-----w- c:\program files\Xfire
2010-07-01 22:16 . 2010-06-02 13:21 218808 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-07-01 21:19 . 2010-06-02 13:22 137256 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-07-01 21:18 . 2010-06-02 13:21 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-07-01 18:55 . 2010-05-15 22:14 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-01 12:30 . 2010-05-15 23:24 -------- d-----w- c:\program files\CCleaner
2010-06-30 13:51 . 2010-05-30 09:54 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-06-25 12:56 . 2010-05-15 20:52 -------- d-----w- c:\program files\NVIDIA Corporation
2010-06-24 20:11 . 2010-05-15 20:37 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-22 14:03 . 2010-05-15 21:40 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-06-22 14:03 . 2010-05-15 21:40 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-06-17 19:28 . 2010-06-01 16:21 -------- d-----w- c:\program files\NCSoft
2010-06-14 21:50 . 2010-06-01 20:52 -------- d-----w- c:\program files\The KMPlayer
2010-06-09 21:01 . 2002-09-23 12:00 97214 ----a-w- c:\windows\system32\perfc005.dat
2010-06-09 21:01 . 2002-09-23 12:00 488652 ----a-w- c:\windows\system32\perfh005.dat
2010-06-07 15:35 . 2010-06-07 15:35 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-06-06 10:08 . 2010-05-15 23:26 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-03 20:55 . 2010-05-16 20:03 -------- d-----w- c:\program files\World of Goo
2010-06-03 14:12 . 2010-06-02 13:13 -------- d-----w- c:\program files\Zaparit
2010-06-01 17:12 . 2010-06-01 16:03 -------- d-----w- c:\program files\Java
2010-06-01 16:04 . 2010-06-01 16:04 -------- d-----w- c:\program files\Common Files\Java
2010-06-01 14:52 . 2010-06-01 14:51 -------- d-----w- c:\program files\Activision
2010-06-01 08:10 . 2010-05-15 21:40 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-31 17:37 . 2010-05-31 17:37 -------- d-----w- c:\program files\THQ
2010-05-30 09:59 . 2010-05-30 09:40 -------- d-----w- c:\program files\Dragon Age
2010-05-30 09:54 . 2010-05-30 09:39 -------- d-----w- c:\program files\Common Files\BioWare
2010-05-28 20:27 . 2010-05-28 20:21 -------- d-----r- c:\program files\Skype
2010-05-28 20:21 . 2010-05-28 20:21 -------- d-----w- c:\program files\Common Files\Skype
2010-05-28 10:58 . 2010-05-15 20:42 600680 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-05-28 00:09 . 2010-05-28 00:09 41872 ----a-w- c:\windows\system32\xfcodec.dll
2010-05-24 22:15 . 2010-05-21 21:12 -------- d-----w- c:\program files\Winamp
2010-05-24 15:12 . 2010-05-24 15:12 -------- d-----w- c:\program files\MSBuild
2010-05-24 15:12 . 2010-05-24 15:12 -------- d-----w- c:\program files\Reference Assemblies
2010-05-23 22:14 . 2010-05-23 22:14 -------- d-----w- c:\program files\FormatFactory
2010-05-23 14:00 . 2010-05-23 14:00 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-05-17 19:34 . 2010-05-17 19:34 -------- d-----w- c:\program files\Microsoft.NET
2010-05-16 17:58 . 2010-05-16 17:58 -------- d-----w- c:\program files\OpenOffice.org 3
2010-05-16 12:59 . 2010-05-16 12:59 -------- d-----w- c:\program files\Adobe Media Player
2010-05-16 12:55 . 2010-05-16 12:55 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-05-16 10:50 . 2010-05-16 10:50 -------- d-----w- c:\program files\PSPad editor
2010-05-16 10:28 . 2010-05-16 10:28 -------- d-----w- c:\program files\FileZilla FTP Client
2010-05-15 23:32 . 2010-05-15 23:32 -------- d-----w- c:\program files\Doit.im
2010-05-15 23:30 . 2010-05-15 23:30 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-05-15 22:09 . 2010-05-15 22:09 0 ----a-w- c:\windows\nsreg.dat
2010-05-15 21:43 . 2010-05-15 21:43 -------- d-----w- c:\program files\DIFX
2010-05-15 21:43 . 2010-05-15 21:43 -------- d-----w- c:\program files\AnyDATA
2010-05-15 21:40 . 2010-05-15 21:40 52872 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-05-15 21:39 . 2010-05-15 21:39 -------- d-----w- c:\program files\AVG
2010-05-15 21:26 . 2010-05-15 20:26 76487 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-05-15 21:26 . 2010-05-15 20:26 2676 ----a-w- c:\windows\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2010-05-15 21:26 . 2010-05-15 20:26 8972 ----a-w- c:\windows\PCHealth\HelpCtr\Config\Cntstore.bin
2010-05-15 20:50 . 2010-05-15 20:50 -------- d-----w- c:\program files\MSXML 4.0
2010-05-15 20:49 . 2010-05-15 20:49 -------- d-----w- c:\program files\Gaming Mouse
2010-05-15 20:44 . 2010-05-15 20:44 -------- d-----w- c:\program files\ASUS
2010-05-15 20:41 . 2010-05-15 20:37 -------- d-----w- c:\program files\Common Files\InstallShield
2010-05-15 20:37 . 2010-05-15 20:37 -------- d-----w- c:\program files\Realtek
2010-05-15 20:34 . 2010-05-15 20:34 -------- d-----w- c:\program files\Intel
2010-05-15 20:26 . 2010-05-15 20:26 -------- d-----w- c:\program files\microsoft frontpage
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\MQ1NR1B5.DAT
2010-05-15 20:26 . 2010-05-15 20:26 558142 ----a-w- c:\windows\java\Packages\4EKLNHVT.ZIP
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\JHF5RX3Z.DAT
2010-05-15 20:26 . 2010-05-15 20:26 155995 ----a-w- c:\windows\java\Packages\8QDJNHF1.ZIP
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\SSG6Y4CO.DAT
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\7DVPZZVL.DAT
2010-05-15 20:26 . 2010-05-15 20:26 2678 ----a-w- c:\windows\java\Packages\Data\5FLBJJHZ.DAT
2010-05-15 20:24 . 2010-05-15 20:24 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-05-06 10:35 . 2002-09-23 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 08:09 . 2002-09-23 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-20 05:32 . 2002-09-23 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-12 15:29 . 2010-06-01 17:12 411368 ----a-w- c:\windows\system32\deployJava1.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-07-04_18.18.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-04 19:06 . 2010-07-04 19:06 16384 c:\windows\temp\Perflib_Perfdata_7d0.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2010-05-16 1238352]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"Infium"="c:\qip\QIP 2010 JadrisPack\qip.exe" [2010-04-12 5734352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 16126464]
"SkyTel"="SkyTel.EXE" [2007-04-04 1822720]
"ASUSGamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-07-12 380928]
"WheelMouse"="c:\advanc~1\wh_exec.exe" [2007-10-13 98304]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-06-22 2065760]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-05-19 37888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-06-02 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-06-07 13902440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-06-07 110696]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-06-19 640440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Owner\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Doit.lnk - c:\program files\Doit.im\Doit.im.exe [2010-5-16 95232]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2010-5-28 3493264]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-06-22 14:03 12536 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\qip\\QIP 2010 JadrisPack\\qip.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\THQ\\Company of Heroes\\RelicDownloader\\RelicDownloader.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\StarCraft II Beta\\StarCraft II.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Steam\\SteamApps\\pooky1994\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2010\\pes2010.exe"=
"c:\\wamp\\bin\\apache\\Apache2.2.11\\bin\\httpd.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Game.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\lead and gold gangs of the wild west\\lag_win32_public_dev.exe"=
"c:\\Program Files\\StarCraft II Beta\\Versions\\Base15655\\SC2.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Documents and Settings\\Owner\\Local Settings\\Apps\\2.0\\PDCE9CLA.0Q0\\44OCDP79.H7M\\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\\CurseClient.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor MP Beta\\MoHMPUpdater.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor MP Beta\\MoHMPGame.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [15.5.2010 23:40 52872]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.6.2010 21:07 691696]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [15.5.2010 23:40 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [15.5.2010 23:40 243024]
R2 avg9emc;AVG E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [22.6.2010 16:03 921440]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [22.6.2010 16:03 308136]
R3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\drivers\whfltr2k.sys [26.1.2007 1:45 6784]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15.8.2008 5:46 284016]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:\windows\system32\drivers\adusbser.sys [15.5.2010 23:43 93440]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [15.5.2010 23:40 430152]
S3 DAUpdaterSvc;Dragon Age: Prameny - aktualizace obsahu;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [15.12.2009 22:07 25832]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
Obsah adresáře 'Naplánované úlohy'
2010-07-04 c:\windows\Tasks\User_Feed_Synchronization-{E4671AE1-E5B8-4912-8FBE-A7FF834E1047}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
IE: Převést cíl vazby do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést cíl vazby do existujícího PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Převést do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Přidat do stávajícího PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Stáhnout Free Download Managerem - file://c:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://c:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://c:\program files\Free Download Manager\dlall.htm
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\extensions\{753fb1ea-f42f-49ba-87a8-aed970191be9}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\extensions\{753fb1ea-f42f-49ba-87a8-aed970191be9}\components\RadioWMPCore.dll
FF - component: c:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\kfbuf0cf.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}\platform\WINNT_x86-msvc\components\pagespeed.dll
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-04 21:07
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spnp.sys >>UNKNOWN [0x8A581938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf74a3cb8
\Driver\atapi -> atapi.sys @ 0xf7849b40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
ParseProcedure -> ntoskrnl.exe @ 0x80578f7a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
ParseProcedure -> ntoskrnl.exe @ 0x80578f7a
NDIS: Atheros L2 Fast Ethernet 10/100 Base-T Controller -> SendCompleteHandler -> NDIS.sys @ 0xf7a37bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7a44a21
SendHandler -> NDIS.sys @ 0xf7a2287b
user & kernel MBR OK
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-1214440339-1004336348-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:3e,75,45,5e,a2,4a,2e,bd,b2,cd,a9,d6,b3,d7,8b,75,9a,f8,56,62,80,dd,80,
75,01,c3,f6,0e,68,50,a4,5a,5a,81,3f,3d,aa,98,d0,79,3a,23,0c,0f,e2,3a,30,4c,\
"??"=hex:e2,06,90,c3,a9,ab,f7,ca,1c,f7,63,d7,3e,f2,89,5d
[HKEY_USERS\S-1-5-21-1214440339-1004336348-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:9b,ab,32,ae,ce,43,1f,c5,f4,ce,af,d2,fe,b9,22,c6,62,d6,7d,a3,52,
a4,cf,5f,d2,a1,d6,07,52,01,24,38,ff,b2,0b,34,f0,d3,eb,1e,bb,b2,a6,09,23,b5,\
"rkeysecu"=hex:39,23,7f,0f,a5,84,b6,a1,91,19,24,0a,74,56,01,fa
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(688)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
- - - - - - - > 'explorer.exe'(3124)
c:\program files\Xfire\xfire_toucan_42784.dll
c:\advanc~1\wh_hook.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\System32\nvsvc32.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\ATKKBService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\PnkBstrA.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\windows\system32\PnkBstrB.exe
c:\program files\AVG\AVG9\avgam.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\System32\wbem\wmiapsrv.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Celkový čas: 2010-07-04 21:10:59 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-07-04 19:10
ComboFix2.txt 2010-07-04 18:19
Před spuštěním: Volných bajtů: 269 209 804 800
Po spuštění: Volných bajtů: 269 195 231 232
- - End Of File - - 45A8573EADDDC9DF22ECF2A11B82F709
Log z HiJackThis
----------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:14:37, on 4.7.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\ADVANC~1\wh_exec.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [WheelMouse] C:\ADVANC~1\wh_exec.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Infium] "C:\qip\QIP 2010 JadrisPack\qip.exe" /isolated/acc já /pass profil /savepass /trylogin /autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Doit.lnk = C:\Program Files\Doit.im\Doit.im.exe
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést cíl vazby do existujícího PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Přidat do stávajícího PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Připojit cíl vazby k existujícímu PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Připojit k existujícímu PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout video Free Download Managerem - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://C:\Program Files\Free Download Manager\dlall.htm
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe
O23 - Service: AVG E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Dragon Age: Prameny - aktualizace obsahu (DAUpdaterSvc) - BioWare - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe
--
End of file - 10136 bytes
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43295
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu - pc si dělá co chce
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall
vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš
pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG či Avast, následně T-Cleaner smaž a zapni si AVG či Avast.
Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.
Start-Spustit a zadej ComboFix /Uninstall
vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš
pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG či Avast, následně T-Cleaner smaž a zapni si AVG či Avast.
Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Prosím o kontrolu logu - pc si dělá co chce Vyřešeno
Díky moc
zatím se ten problém neobjevil
zatím se ten problém neobjevil
Kdo je online
Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 1 host