Jinak to trvá pár minut...
Zkusíme toto:
Vypni rez. ochranu u ESS.
Vypni rez. štít u ST (pokud jsi ho neodinstaloval).
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Zaseknutí mozilly firefox při načítání některých stránek.
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43294
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Zaseknutí mozilly firefox při načítání některých stránek.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
-
BRABO[*_*]
- Level 1.5
- Příspěvky: 122
- Registrován: leden 08
- Pohlaví:
- Stav:
Offline
Re: Zaseknutí mozilly firefox při načítání některých stránek.
Zde je log:
ComboFix 08-11-14.01 - BRABO2 2008-11-16 16:43:17.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1494 [GMT 1:00]
Spuštěný z: c:\documents and settings\BRABO2\Plocha\ComboFix.exe
* Vytvořen nový Bod Obnovení
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\jestertb.dll
c:\windows\regedit.com
c:\windows\system32\MSINET.oca
c:\windows\system32\taskmgr.com
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_OREANS32
-------\Service_oreans32
((((((((((((((((((((((((( Soubory vytvořené od 2008-10-16 do 2008-11-16 )))))))))))))))))))))))))))))))
.
2008-11-16 15:52 . 2008-11-16 16:01 <DIR> d-------- C:\SDFix
2008-11-16 14:52 . 2008-11-16 14:52 <DIR> d-------- c:\windows\ERUNT
2008-11-16 14:48 . 2008-11-16 15:47 <DIR> d-------- C:\SDFixyx
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\Malwarebytes
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2008-11-16 11:18 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-16 11:18 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-15 20:04 . 2008-11-15 20:04 <DIR> d-------- c:\documents and settings\Administrator\Data aplikací\Spyware Terminator
2008-11-15 19:16 . 2008-11-15 19:16 <DIR> d-------- c:\program files\Trend Micro
2008-11-15 10:04 . 2008-10-31 07:09 270,888 -ra------ c:\windows\system32\drivers\SbFw.sys
2008-11-15 10:03 . 2008-11-15 10:03 <DIR> d-------- c:\program files\Sunbelt Software
2008-11-14 22:47 . 2008-06-21 04:54 65,576 --a------ c:\windows\system32\drivers\SbFwIm.sys
2008-11-11 18:33 . 2008-11-12 17:52 <DIR> d-------- c:\program files\World of Warcraft
2008-11-11 18:33 . 2008-11-11 18:44 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment
2008-11-09 21:25 . 2008-11-09 21:36 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\PSpad
2008-11-09 21:24 . 2008-11-09 21:25 <DIR> d-------- c:\program files\PSPad editor
2008-11-03 14:25 . 2008-11-03 14:26 <DIR> d-------- c:\program files\MP3 Player Utilities 5.11
2008-10-31 17:08 . 2008-10-31 17:08 <DIR> d-------- c:\program files\VirtualDJ
2008-10-31 16:02 . 2005-11-30 21:20 2,314,332 --a------ c:\windows\system32\LIBMMD.DLL
2008-10-29 15:13 . 2008-10-29 15:13 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\Leadertech
2008-10-29 15:13 . 2008-10-29 15:13 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\InstallShield
2008-10-28 22:15 . 2008-10-28 22:15 <DIR> dr-h----- c:\documents and settings\BRABO2\Data aplikací\SecuROM
2008-10-25 19:42 . 2008-10-25 20:01 <DIR> d-------- c:\program files\MTA San Andreas
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-16 08:44 --------- d-----w c:\program files\Common Files\Adobe
2008-11-15 19:22 --------- d-----w c:\program files\Yahoo!
2008-11-15 14:38 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-15 14:38 --------- d-----w c:\program files\Doom 3
2008-11-11 17:20 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\FileZilla
2008-11-09 15:37 --------- d-----w c:\program files\Total Video Converter
2008-11-07 18:22 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\Skype
2008-11-07 18:21 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\skypePM
2008-11-03 16:35 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\gtk-2.0
2008-10-30 12:51 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-29 14:10 --------- d-----w c:\program files\SystemRequirementsLab
2008-10-28 20:43 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-10-28 20:43 22,328 ----a-w c:\documents and settings\BRABO2\Data aplikací\PnkBstrK.sys
2008-10-28 20:43 107,832 ----a-w c:\windows\system32\PnkBstrB.exe
2008-10-28 20:42 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2008-10-28 20:42 2,250,024 ----a-w c:\windows\system32\pbsvc.exe
2008-10-28 20:40 --------- d-----w c:\program files\Ubisoft
2008-10-28 07:12 --------- d-----w c:\program files\Crashday
2008-10-25 18:46 --------- d-----w c:\program files\Rockstar Games
2008-10-03 15:15 --------- d-----w c:\program files\DAEMON Tools Lite
2008-10-03 15:15 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\Disney Interactive Studios
2008-10-03 14:58 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-10-03 14:58 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\DAEMON Tools
2008-10-03 14:44 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2008-09-27 08:58 --------- d-----w c:\documents and settings\NOTSPECIFICT\Data aplikací\Ubisoft
2008-09-25 04:53 --------- d-----w c:\documents and settings\NOTSPECIFICT\Data aplikací\Spyware Terminator
2008-09-24 12:35 --------- d-----w c:\program files\Playlogic
2008-09-16 18:19 --------- d-----w c:\program files\Winamp
2008-09-16 18:19 --------- d-----w c:\program files\Talisman 2
2008-08-17 11:18 1,390,730 ----a-w c:\windows\system32\AutoPartNt.exe
2008-03-21 16:37 32 ----a-w c:\documents and settings\All Users\Data aplikací\ezsid.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-18 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 2321600]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-13 1443072]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"OSSelectorReinstall"="c:\program files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2007-03-15 2225208]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-16 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SDFix"="c:\sdfix\RunThis.bat" [2008-11-06 964661]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
DSLMON.lnk - c:\program files\ADSL\ADSL USB MODEM\DSLMON.exe [2008-02-29 929889]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.fraunhoferacm"= l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Counter-Strike Source\\srcds.exe"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Nero\\Nero8\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Jedi Knight Jedi Academy\\GameData\\jamp.exe"=
"c:\\Program Files\\BitSpirit\\BitSpirit.exe"=
"c:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\BRABO2\\Plocha\\PLOChA STARA\\DHCsvr\\samp-server.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\WinSCP\\WinSCP.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"c:\\Program Files\\Midway Home Entertainment\\BlackSite Area 51\\Binaries\\BlackSite.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2008-11-15 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-06-21 66600]
R2 Plánovač automatické aktualizace LiveUpdate;Plánovač automatické aktualizace LiveUpdate;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-11-09 198336]
R2 SbPF.Launcher;SbPF.Launcher;"c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe" [2008-10-31 95528]
R2 SPF4;Sunbelt Personal Firewall 4;"c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe" [2008-10-31 1365288]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2004-08-18 69120]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\sbfwim.sys [2008-11-14 65576]
.
.
------- Doplňkový sken -------
.
FireFox -: Profile - c:\documents and settings\BRABO2\Data aplikací\Mozilla\Firefox\Profiles\hytqacwa.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://seznam.cz
FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30401.0.dll
FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF -: plugin - c:\program files\Yahoo!\Common\npyaxmpb.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-16 16:50:08
Windows 5.1.2600 Service Pack 2 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\ESET\ESET Smart Security\ekrn.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\NVIDIA Corporation\nTune\nTuneService.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Sunbelt Software\Personal Firewall\SbPFCl.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\program files\Common Files\Teleca Shared\CapabilityManager.exe
c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2008-11-16 16:55:42 - počítač byl restartován
ComboFix-quarantined-files.txt 2008-11-16 15:55:35
Před spuštěním: Volných bajtů: 20 097 507 328
Po spuštění: Volných bajtů: 42,313,740,288
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
208 --- E O F --- 2008-08-15 15:08:17
ComboFix 08-11-14.01 - BRABO2 2008-11-16 16:43:17.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1494 [GMT 1:00]
Spuštěný z: c:\documents and settings\BRABO2\Plocha\ComboFix.exe
* Vytvořen nový Bod Obnovení
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\jestertb.dll
c:\windows\regedit.com
c:\windows\system32\MSINET.oca
c:\windows\system32\taskmgr.com
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_OREANS32
-------\Service_oreans32
((((((((((((((((((((((((( Soubory vytvořené od 2008-10-16 do 2008-11-16 )))))))))))))))))))))))))))))))
.
2008-11-16 15:52 . 2008-11-16 16:01 <DIR> d-------- C:\SDFix
2008-11-16 14:52 . 2008-11-16 14:52 <DIR> d-------- c:\windows\ERUNT
2008-11-16 14:48 . 2008-11-16 15:47 <DIR> d-------- C:\SDFixyx
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\Malwarebytes
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2008-11-16 11:18 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-16 11:18 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-15 20:04 . 2008-11-15 20:04 <DIR> d-------- c:\documents and settings\Administrator\Data aplikací\Spyware Terminator
2008-11-15 19:16 . 2008-11-15 19:16 <DIR> d-------- c:\program files\Trend Micro
2008-11-15 10:04 . 2008-10-31 07:09 270,888 -ra------ c:\windows\system32\drivers\SbFw.sys
2008-11-15 10:03 . 2008-11-15 10:03 <DIR> d-------- c:\program files\Sunbelt Software
2008-11-14 22:47 . 2008-06-21 04:54 65,576 --a------ c:\windows\system32\drivers\SbFwIm.sys
2008-11-11 18:33 . 2008-11-12 17:52 <DIR> d-------- c:\program files\World of Warcraft
2008-11-11 18:33 . 2008-11-11 18:44 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment
2008-11-09 21:25 . 2008-11-09 21:36 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\PSpad
2008-11-09 21:24 . 2008-11-09 21:25 <DIR> d-------- c:\program files\PSPad editor
2008-11-03 14:25 . 2008-11-03 14:26 <DIR> d-------- c:\program files\MP3 Player Utilities 5.11
2008-10-31 17:08 . 2008-10-31 17:08 <DIR> d-------- c:\program files\VirtualDJ
2008-10-31 16:02 . 2005-11-30 21:20 2,314,332 --a------ c:\windows\system32\LIBMMD.DLL
2008-10-29 15:13 . 2008-10-29 15:13 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\Leadertech
2008-10-29 15:13 . 2008-10-29 15:13 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\InstallShield
2008-10-28 22:15 . 2008-10-28 22:15 <DIR> dr-h----- c:\documents and settings\BRABO2\Data aplikací\SecuROM
2008-10-25 19:42 . 2008-10-25 20:01 <DIR> d-------- c:\program files\MTA San Andreas
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-16 08:44 --------- d-----w c:\program files\Common Files\Adobe
2008-11-15 19:22 --------- d-----w c:\program files\Yahoo!
2008-11-15 14:38 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-15 14:38 --------- d-----w c:\program files\Doom 3
2008-11-11 17:20 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\FileZilla
2008-11-09 15:37 --------- d-----w c:\program files\Total Video Converter
2008-11-07 18:22 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\Skype
2008-11-07 18:21 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\skypePM
2008-11-03 16:35 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\gtk-2.0
2008-10-30 12:51 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-29 14:10 --------- d-----w c:\program files\SystemRequirementsLab
2008-10-28 20:43 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-10-28 20:43 22,328 ----a-w c:\documents and settings\BRABO2\Data aplikací\PnkBstrK.sys
2008-10-28 20:43 107,832 ----a-w c:\windows\system32\PnkBstrB.exe
2008-10-28 20:42 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2008-10-28 20:42 2,250,024 ----a-w c:\windows\system32\pbsvc.exe
2008-10-28 20:40 --------- d-----w c:\program files\Ubisoft
2008-10-28 07:12 --------- d-----w c:\program files\Crashday
2008-10-25 18:46 --------- d-----w c:\program files\Rockstar Games
2008-10-03 15:15 --------- d-----w c:\program files\DAEMON Tools Lite
2008-10-03 15:15 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\Disney Interactive Studios
2008-10-03 14:58 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-10-03 14:58 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\DAEMON Tools
2008-10-03 14:44 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2008-09-27 08:58 --------- d-----w c:\documents and settings\NOTSPECIFICT\Data aplikací\Ubisoft
2008-09-25 04:53 --------- d-----w c:\documents and settings\NOTSPECIFICT\Data aplikací\Spyware Terminator
2008-09-24 12:35 --------- d-----w c:\program files\Playlogic
2008-09-16 18:19 --------- d-----w c:\program files\Winamp
2008-09-16 18:19 --------- d-----w c:\program files\Talisman 2
2008-08-17 11:18 1,390,730 ----a-w c:\windows\system32\AutoPartNt.exe
2008-03-21 16:37 32 ----a-w c:\documents and settings\All Users\Data aplikací\ezsid.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-18 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 2321600]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-13 1443072]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"OSSelectorReinstall"="c:\program files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2007-03-15 2225208]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-16 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SDFix"="c:\sdfix\RunThis.bat" [2008-11-06 964661]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
DSLMON.lnk - c:\program files\ADSL\ADSL USB MODEM\DSLMON.exe [2008-02-29 929889]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.fraunhoferacm"= l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Counter-Strike Source\\srcds.exe"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Nero\\Nero8\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Jedi Knight Jedi Academy\\GameData\\jamp.exe"=
"c:\\Program Files\\BitSpirit\\BitSpirit.exe"=
"c:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\BRABO2\\Plocha\\PLOChA STARA\\DHCsvr\\samp-server.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\WinSCP\\WinSCP.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"c:\\Program Files\\Midway Home Entertainment\\BlackSite Area 51\\Binaries\\BlackSite.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2008-11-15 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-06-21 66600]
R2 Plánovač automatické aktualizace LiveUpdate;Plánovač automatické aktualizace LiveUpdate;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-11-09 198336]
R2 SbPF.Launcher;SbPF.Launcher;"c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe" [2008-10-31 95528]
R2 SPF4;Sunbelt Personal Firewall 4;"c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe" [2008-10-31 1365288]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2004-08-18 69120]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\sbfwim.sys [2008-11-14 65576]
.
.
------- Doplňkový sken -------
.
FireFox -: Profile - c:\documents and settings\BRABO2\Data aplikací\Mozilla\Firefox\Profiles\hytqacwa.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://seznam.cz
FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30401.0.dll
FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF -: plugin - c:\program files\Yahoo!\Common\npyaxmpb.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-16 16:50:08
Windows 5.1.2600 Service Pack 2 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\ESET\ESET Smart Security\ekrn.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\NVIDIA Corporation\nTune\nTuneService.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Sunbelt Software\Personal Firewall\SbPFCl.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\program files\Common Files\Teleca Shared\CapabilityManager.exe
c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2008-11-16 16:55:42 - počítač byl restartován
ComboFix-quarantined-files.txt 2008-11-16 15:55:35
Před spuštěním: Volných bajtů: 20 097 507 328
Po spuštění: Volných bajtů: 42,313,740,288
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
208 --- E O F --- 2008-08-15 15:08:17
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43294
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Zaseknutí mozilly firefox při načítání některých stránek.
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Někde na fóru bylo že se má toto:
FF -: plugin - c:\program files\Yahoo!\Common\npyaxmpb.dll přejmenovat a smazat, ale nevím..
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE
Kód: Vybrat vše
Folder::
C:\SDFix
C:\SDFixyx
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000000
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Někde na fóru bylo že se má toto:
FF -: plugin - c:\program files\Yahoo!\Common\npyaxmpb.dll přejmenovat a smazat, ale nevím..
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
-
BRABO[*_*]
- Level 1.5
- Příspěvky: 122
- Registrován: leden 08
- Pohlaví:
- Stav:
Offline
Re: Zaseknutí mozilly firefox při načítání některých stránek.
Ok zde je log z ComboFix:
ComboFix 08-11-14.01 - BRABO2 2008-11-16 17:42:14.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1631 [GMT 1:00]
Spuštěný z: c:\documents and settings\BRABO2\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\BRABO2\Plocha\CFScript.txt
* Vytvořen nový Bod Obnovení
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\SDFix
c:\sdfix\Add_DBFix_RunOnce_key.inf
c:\sdfix\AdminCheck2.txt
c:\sdfix\apps\assosfix.reg
c:\sdfix\apps\Cghtme.exe
c:\sdfix\apps\cliptext.exe
c:\sdfix\apps\CSweg.exe
c:\sdfix\apps\DBFix.inf
c:\sdfix\apps\download.exe
c:\sdfix\apps\dummy.sys
c:\sdfix\apps\Enable_Command_Prompt.inf
c:\sdfix\apps\Enable_Command_Prompt.reg
c:\sdfix\apps\ERDNT.E_E
c:\sdfix\apps\ERDNTDOS.LOC
c:\sdfix\apps\ERDNTWIN.LOC
c:\sdfix\apps\ERUNT.EXE
c:\sdfix\apps\ERUNT.LOC
c:\sdfix\apps\fix.reg
c:\sdfix\apps\FixBeep.reg
c:\sdfix\apps\FixBH.reg
c:\sdfix\apps\FixComponents.reg
c:\sdfix\apps\FIXCU.reg
c:\sdfix\apps\FIXLM.reg
c:\sdfix\apps\FixPath.exe
c:\sdfix\apps\FixRedir.reg
c:\sdfix\apps\FixSchedule.reg
c:\sdfix\apps\FixWebCheck.reg
c:\sdfix\apps\fixXP.reg
c:\sdfix\apps\FixXPsp2.reg
c:\sdfix\apps\grep.exe
c:\sdfix\apps\HaxdFix.reg
c:\sdfix\apps\HPFix.reg
c:\sdfix\apps\HPFix2.reg
c:\sdfix\apps\HPFix3.reg
c:\sdfix\apps\HPFix4.reg
c:\sdfix\apps\HPFix5.reg
c:\sdfix\apps\HPFix6.reg
c:\sdfix\apps\HPFix7.reg
c:\sdfix\apps\HPFix8.reg
c:\sdfix\apps\HPFix9.reg
c:\sdfix\apps\Installed.txt
c:\sdfix\apps\isadmin.exe
c:\sdfix\apps\leg2.txt
c:\sdfix\apps\legacy.txt
c:\sdfix\apps\legacybk.txt
c:\sdfix\apps\locate.com
c:\sdfix\apps\LS.exe
c:\sdfix\apps\MD5File.exe
c:\sdfix\apps\moveex.exe
c:\sdfix\apps\MyGcpvFix.reg
c:\sdfix\apps\MyGkFix2.reg
c:\sdfix\apps\Process.exe
c:\sdfix\apps\procs.exe
c:\sdfix\apps\psservice.exe
c:\sdfix\apps\Rem.txt
c:\sdfix\apps\Rem2.txt
c:\sdfix\apps\Replace\regedit.exe
c:\sdfix\apps\Replace\w2k\AUTOEXEC.NT
c:\sdfix\apps\Replace\w2k\beep.sys
c:\sdfix\apps\Replace\w2k\command.com
c:\sdfix\apps\Replace\w2k\command.PIF
c:\sdfix\apps\Replace\w2k\CONFIG.NT
c:\sdfix\apps\Replace\w2k\null.sys
c:\sdfix\apps\Replace\xp\AUTOEXEC.NT
c:\sdfix\apps\Replace\xp\beep.sys
c:\sdfix\apps\Replace\xp\command.com
c:\sdfix\apps\Replace\xp\command.PIF
c:\sdfix\apps\Replace\xp\CONFIG.NT
c:\sdfix\apps\Replace\xp\null.sys
c:\sdfix\apps\Reset_AppInit_DLLs.reg
c:\sdfix\apps\RestartIt!.exe
c:\sdfix\apps\Restore_SafeBoot_Windows2000.reg
c:\sdfix\apps\Restore_SafeBoot_WindowsXP.reg
c:\sdfix\apps\Restore_SafeBoot_WindowsXP_SP2.reg
c:\sdfix\apps\Restore_SafeBoot_WindowsXP_SP3.reg
c:\sdfix\apps\Restore_SecurityCenter.reg
c:\sdfix\apps\Restore_SharedAccess.reg
c:\sdfix\apps\sc.exe
c:\sdfix\apps\sed.exe
c:\sdfix\apps\SF.exe
c:\sdfix\apps\shutdown.exe
c:\sdfix\apps\srv2.txt
c:\sdfix\apps\srv2bk.txt
c:\sdfix\apps\svc.txt
c:\sdfix\apps\svcbk.txt
c:\sdfix\apps\Swreg.exe
c:\sdfix\apps\swsc.exe
c:\sdfix\apps\UnRAR.exe
c:\sdfix\apps\unzip.exe
c:\sdfix\apps\vfind.exe
c:\sdfix\apps\WINMSG.EXE
c:\sdfix\apps\winsec.reg
c:\sdfix\apps\zip.exe
c:\sdfix\attrib.exe
c:\sdfix\backupreg\AppInit_DLLs.reg
c:\sdfix\backupreg\bat_shell_open.reg
c:\sdfix\backupreg\BHO.reg
c:\sdfix\backupreg\com_shell_open.reg
c:\sdfix\backupreg\ControlPanel_Load.reg
c:\sdfix\backupreg\Drivers32.reg
c:\sdfix\backupreg\exe_shell_open.reg
c:\sdfix\backupreg\HKCU_SOFTWARE_Policy.reg
c:\sdfix\backupreg\HKCU_WINDOWS_Policy.reg
c:\sdfix\backupreg\HKCURun.reg
c:\sdfix\backupreg\HKCURunServices.reg
c:\sdfix\backupreg\HKLM_SOFTWARE_Policy.reg
c:\sdfix\backupreg\HKLM_WINDOWS_Policy.reg
c:\sdfix\backupreg\HKLMRun.reg
c:\sdfix\backupreg\HKLMRunServices.reg
c:\sdfix\backupreg\IEDesktop.reg
c:\sdfix\backupreg\IEMain.reg
c:\sdfix\backupreg\Installed_Components.reg
c:\sdfix\backupreg\pif_shell_open.reg
c:\sdfix\backupreg\reg_shell_open.reg
c:\sdfix\backupreg\SecurityProviders.reg
c:\sdfix\backupreg\SharedTaskScheduler.reg
c:\sdfix\backupreg\ShellServiceObjectDelayLoad.reg
c:\sdfix\backupreg\SubSystems.reg
c:\sdfix\backupreg\txt_shell_open.reg
c:\sdfix\backupreg\Winlogon.reg
c:\sdfix\backupreg\WinlogonNotify.reg
c:\sdfix\beepFA0.TXT
c:\sdfix\beepFA1.TXT
c:\sdfix\beepFA2.TXT
c:\sdfix\beepFA3.TXT
c:\sdfix\beepFA4.TXT
c:\sdfix\beepxcodec0.TXT
c:\sdfix\beepxcodec1.TXT
c:\sdfix\beepxcodec2.TXT
c:\sdfix\beepxcodec3.TXT
c:\sdfix\beepxcodec4.TXT
c:\sdfix\bpTEST1.TXT
c:\sdfix\bpTEST3.TXT
c:\sdfix\catchme.exe
c:\sdfix\DBFix.bat
c:\sdfix\delavi0.txt
c:\sdfix\delzip0.txt
c:\sdfix\dest.txt
c:\sdfix\dnif.exe
c:\sdfix\dummy.exe
c:\sdfix\dummy.sys
c:\sdfix\editreg.exe
c:\sdfix\FilekillList1.txt
c:\sdfix\FileList1.txt
c:\sdfix\Find.txt
c:\sdfix\Findav2009.txt
c:\sdfix\Findav2009a.txt
c:\sdfix\Findbhos1.txt
c:\sdfix\FindIRCBrute.txt
c:\sdfix\Findroguerun1.txt
c:\sdfix\Findrun002.txt
c:\sdfix\Findrun002a.txt
c:\sdfix\Findrun30.txt
c:\sdfix\Findrun31.txt
c:\sdfix\Findrun31a.txt
c:\sdfix\Findrun31b.txt
c:\sdfix\Findrun32.txt
c:\sdfix\Findrunbifrose1.txt
c:\sdfix\Findrunbot1.txt
c:\sdfix\FindrunDW_Start.txt
c:\sdfix\Findzip.txt
c:\sdfix\HOSTS
c:\sdfix\Patched2a.txt
c:\sdfix\Patched2b.txt
c:\sdfix\Patched2c.txt
c:\sdfix\RemLat.txt
c:\sdfix\Remlat1.txt
c:\sdfix\Remlat2.txt
c:\sdfix\Remlat3.txt
c:\sdfix\Remlat4.txt
c:\sdfix\Report.txt
c:\sdfix\rtsdnif.exe
c:\sdfix\RunThis.bat
c:\sdfix\SDFIX_ReadMe_Online.url
c:\sdfix\TESTspreadbot1.TXT
c:\sdfix\userinfix.reg
c:\sdfix\W2K_VirusAlert_Repair.inf
c:\sdfix\XP_VirusAlert_Repair.inf
C:\SDFixyx
c:\sdfixyx\Add_DBFix_RunOnce_key.inf
c:\sdfixyx\AdminCheck2.txt
c:\sdfixyx\apps\assosfix.reg
c:\sdfixyx\apps\Cghtme.exe
c:\sdfixyx\apps\cliptext.exe
c:\sdfixyx\apps\CSweg.exe
c:\sdfixyx\apps\DBFix.inf
c:\sdfixyx\apps\download.exe
c:\sdfixyx\apps\dummy.sys
c:\sdfixyx\apps\Enable_Command_Prompt.inf
c:\sdfixyx\apps\Enable_Command_Prompt.reg
c:\sdfixyx\apps\ERDNT.E_E
c:\sdfixyx\apps\ERDNTDOS.LOC
c:\sdfixyx\apps\ERDNTWIN.LOC
c:\sdfixyx\apps\ERUNT.EXE
c:\sdfixyx\apps\ERUNT.LOC
c:\sdfixyx\apps\fix.reg
c:\sdfixyx\apps\FixBeep.reg
c:\sdfixyx\apps\FixBH.reg
c:\sdfixyx\apps\FixComponents.reg
c:\sdfixyx\apps\FIXCU.reg
c:\sdfixyx\apps\FIXLM.reg
c:\sdfixyx\apps\FixPath.exe
c:\sdfixyx\apps\FixRedir.reg
c:\sdfixyx\apps\FixSchedule.reg
c:\sdfixyx\apps\FixWebCheck.reg
c:\sdfixyx\apps\fixXP.reg
c:\sdfixyx\apps\FixXPsp2.reg
c:\sdfixyx\apps\grep.exe
c:\sdfixyx\apps\HaxdFix.reg
c:\sdfixyx\apps\HPFix.reg
c:\sdfixyx\apps\HPFix2.reg
c:\sdfixyx\apps\HPFix3.reg
c:\sdfixyx\apps\HPFix4.reg
c:\sdfixyx\apps\HPFix5.reg
c:\sdfixyx\apps\HPFix6.reg
c:\sdfixyx\apps\HPFix7.reg
c:\sdfixyx\apps\HPFix8.reg
c:\sdfixyx\apps\HPFix9.reg
c:\sdfixyx\apps\Installed.txt
c:\sdfixyx\apps\isadmin.exe
c:\sdfixyx\apps\leg2.txt
c:\sdfixyx\apps\legacy.txt
c:\sdfixyx\apps\legacybk.txt
c:\sdfixyx\apps\locate.com
c:\sdfixyx\apps\LS.exe
c:\sdfixyx\apps\MD5File.exe
c:\sdfixyx\apps\moveex.exe
c:\sdfixyx\apps\MyGcpvFix.reg
c:\sdfixyx\apps\MyGkFix2.reg
c:\sdfixyx\apps\Process.exe
c:\sdfixyx\apps\procs.exe
c:\sdfixyx\apps\psservice.exe
c:\sdfixyx\apps\Rem.txt
c:\sdfixyx\apps\Rem2.txt
c:\sdfixyx\apps\Replace\regedit.exe
c:\sdfixyx\apps\Replace\w2k\AUTOEXEC.NT
c:\sdfixyx\apps\Replace\w2k\beep.sys
c:\sdfixyx\apps\Replace\w2k\command.com
c:\sdfixyx\apps\Replace\w2k\command.PIF
c:\sdfixyx\apps\Replace\w2k\CONFIG.NT
c:\sdfixyx\apps\Replace\w2k\null.sys
c:\sdfixyx\apps\Replace\xp\AUTOEXEC.NT
c:\sdfixyx\apps\Replace\xp\beep.sys
c:\sdfixyx\apps\Replace\xp\command.com
c:\sdfixyx\apps\Replace\xp\command.PIF
c:\sdfixyx\apps\Replace\xp\CONFIG.NT
c:\sdfixyx\apps\Replace\xp\null.sys
c:\sdfixyx\apps\Reset_AppInit_DLLs.reg
c:\sdfixyx\apps\RestartIt!.exe
c:\sdfixyx\apps\Restore_SafeBoot_Windows2000.reg
c:\sdfixyx\apps\Restore_SafeBoot_WindowsXP.reg
c:\sdfixyx\apps\Restore_SafeBoot_WindowsXP_SP2.reg
c:\sdfixyx\apps\Restore_SafeBoot_WindowsXP_SP3.reg
c:\sdfixyx\apps\Restore_SecurityCenter.reg
c:\sdfixyx\apps\Restore_SharedAccess.reg
c:\sdfixyx\apps\sc.exe
c:\sdfixyx\apps\sed.exe
c:\sdfixyx\apps\SF.exe
c:\sdfixyx\apps\shutdown.exe
c:\sdfixyx\apps\srv2.txt
c:\sdfixyx\apps\srv2bk.txt
c:\sdfixyx\apps\svc.txt
c:\sdfixyx\apps\svcbk.txt
c:\sdfixyx\apps\Swreg.exe
c:\sdfixyx\apps\swsc.exe
c:\sdfixyx\apps\UnRAR.exe
c:\sdfixyx\apps\unzip.exe
c:\sdfixyx\apps\vfind.exe
c:\sdfixyx\apps\WINMSG.EXE
c:\sdfixyx\apps\winsec.reg
c:\sdfixyx\apps\zip.exe
c:\sdfixyx\attrib.exe
c:\sdfixyx\backupreg\AppInit_DLLs.reg
c:\sdfixyx\backupreg\bat_shell_open.reg
c:\sdfixyx\backupreg\BHO.reg
c:\sdfixyx\backupreg\com_shell_open.reg
c:\sdfixyx\backupreg\ControlPanel_Load.reg
c:\sdfixyx\backupreg\Drivers32.reg
c:\sdfixyx\backupreg\exe_shell_open.reg
c:\sdfixyx\backupreg\HKCU_SOFTWARE_Policy.reg
c:\sdfixyx\backupreg\HKCU_WINDOWS_Policy.reg
c:\sdfixyx\backupreg\HKCURun.reg
c:\sdfixyx\backupreg\HKCURunServices.reg
c:\sdfixyx\backupreg\HKLM_SOFTWARE_Policy.reg
c:\sdfixyx\backupreg\HKLM_WINDOWS_Policy.reg
c:\sdfixyx\backupreg\HKLMRun.reg
c:\sdfixyx\backupreg\HKLMRunServices.reg
c:\sdfixyx\backupreg\IEDesktop.reg
c:\sdfixyx\backupreg\IEMain.reg
c:\sdfixyx\backupreg\Installed_Components.reg
c:\sdfixyx\backupreg\pif_shell_open.reg
c:\sdfixyx\backupreg\reg_shell_open.reg
c:\sdfixyx\backupreg\SecurityProviders.reg
c:\sdfixyx\backupreg\SharedTaskScheduler.reg
c:\sdfixyx\backupreg\ShellServiceObjectDelayLoad.reg
c:\sdfixyx\backupreg\SubSystems.reg
c:\sdfixyx\backupreg\txt_shell_open.reg
c:\sdfixyx\backupreg\Winlogon.reg
c:\sdfixyx\backupreg\WinlogonNotify.reg
c:\sdfixyx\beepFA0.TXT
c:\sdfixyx\beepFA1.TXT
c:\sdfixyx\beepFA2.TXT
c:\sdfixyx\beepFA3.TXT
c:\sdfixyx\beepFA4.TXT
c:\sdfixyx\beepxcodec0.TXT
c:\sdfixyx\beepxcodec1.TXT
c:\sdfixyx\beepxcodec2.TXT
c:\sdfixyx\beepxcodec3.TXT
c:\sdfixyx\beepxcodec4.TXT
c:\sdfixyx\bpTEST1.TXT
c:\sdfixyx\bpTEST3.TXT
c:\sdfixyx\catchme.exe
c:\sdfixyx\DBFix.bat
c:\sdfixyx\delavi0.txt
c:\sdfixyx\delzip0.txt
c:\sdfixyx\dest.txt
c:\sdfixyx\dnif.exe
c:\sdfixyx\dummy.exe
c:\sdfixyx\dummy.sys
c:\sdfixyx\editreg.exe
c:\sdfixyx\FilekillList1.txt
c:\sdfixyx\FileList1.txt
c:\sdfixyx\Find.txt
c:\sdfixyx\Findav2009.txt
c:\sdfixyx\Findav2009a.txt
c:\sdfixyx\Findbhos1.txt
c:\sdfixyx\FindIRCBrute.txt
c:\sdfixyx\Findroguerun1.txt
c:\sdfixyx\Findrun002.txt
c:\sdfixyx\Findrun002a.txt
c:\sdfixyx\Findrun30.txt
c:\sdfixyx\Findrun31.txt
c:\sdfixyx\Findrun31a.txt
c:\sdfixyx\Findrun31b.txt
c:\sdfixyx\Findrun32.txt
c:\sdfixyx\Findrunbifrose1.txt
c:\sdfixyx\Findrunbot1.txt
c:\sdfixyx\FindrunDW_Start.txt
c:\sdfixyx\Findzip.txt
c:\sdfixyx\HOSTS
c:\sdfixyx\Patched2a.txt
c:\sdfixyx\Patched2b.txt
c:\sdfixyx\Patched2c.txt
c:\sdfixyx\RemLat.txt
c:\sdfixyx\Remlat1.txt
c:\sdfixyx\Remlat2.txt
c:\sdfixyx\Remlat3.txt
c:\sdfixyx\Remlat4.txt
c:\sdfixyx\Report.txt
c:\sdfixyx\Report_old_1.txt
c:\sdfixyx\rtsdnif.exe
c:\sdfixyx\RunThis.bat
c:\sdfixyx\SDFIX_ReadMe_Online.url
c:\sdfixyx\TESTspreadbot1.TXT
c:\sdfixyx\userinfix.reg
c:\sdfixyx\W2K_VirusAlert_Repair.inf
c:\sdfixyx\XP_VirusAlert_Repair.inf
.
((((((((((((((((((((((((( Soubory vytvořené od 2008-10-16 do 2008-11-16 )))))))))))))))))))))))))))))))
.
2008-11-16 14:52 . 2008-11-16 14:52 <DIR> d-------- c:\windows\ERUNT
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\Malwarebytes
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2008-11-16 11:18 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-16 11:18 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-15 20:04 . 2008-11-15 20:04 <DIR> d-------- c:\documents and settings\Administrator\Data aplikací\Spyware Terminator
2008-11-15 19:16 . 2008-11-15 19:16 <DIR> d-------- c:\program files\Trend Micro
2008-11-15 10:04 . 2008-10-31 07:09 270,888 -ra------ c:\windows\system32\drivers\SbFw.sys
2008-11-15 10:03 . 2008-11-15 10:03 <DIR> d-------- c:\program files\Sunbelt Software
2008-11-14 22:47 . 2008-06-21 04:54 65,576 --a------ c:\windows\system32\drivers\SbFwIm.sys
2008-11-11 18:33 . 2008-11-12 17:52 <DIR> d-------- c:\program files\World of Warcraft
2008-11-11 18:33 . 2008-11-11 18:44 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment
2008-11-09 21:25 . 2008-11-09 21:36 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\PSpad
2008-11-09 21:24 . 2008-11-09 21:25 <DIR> d-------- c:\program files\PSPad editor
2008-11-03 14:25 . 2008-11-03 14:26 <DIR> d-------- c:\program files\MP3 Player Utilities 5.11
2008-10-31 17:08 . 2008-10-31 17:08 <DIR> d-------- c:\program files\VirtualDJ
2008-10-31 16:02 . 2005-11-30 21:20 2,314,332 --a------ c:\windows\system32\LIBMMD.DLL
2008-10-29 15:13 . 2008-10-29 15:13 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\Leadertech
2008-10-29 15:13 . 2008-10-29 15:13 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\InstallShield
2008-10-28 22:15 . 2008-10-28 22:15 <DIR> dr-h----- c:\documents and settings\BRABO2\Data aplikací\SecuROM
2008-10-25 19:42 . 2008-10-25 20:01 <DIR> d-------- c:\program files\MTA San Andreas
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-16 08:44 --------- d-----w c:\program files\Common Files\Adobe
2008-11-15 19:22 --------- d-----w c:\program files\Yahoo!
2008-11-15 14:38 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-15 14:38 --------- d-----w c:\program files\Doom 3
2008-11-11 17:20 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\FileZilla
2008-11-09 15:37 --------- d-----w c:\program files\Total Video Converter
2008-11-07 18:22 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\Skype
2008-11-07 18:21 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\skypePM
2008-11-03 16:35 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\gtk-2.0
2008-10-30 12:51 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-29 14:10 --------- d-----w c:\program files\SystemRequirementsLab
2008-10-28 20:43 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-10-28 20:43 22,328 ----a-w c:\documents and settings\BRABO2\Data aplikací\PnkBstrK.sys
2008-10-28 20:43 107,832 ----a-w c:\windows\system32\PnkBstrB.exe
2008-10-28 20:42 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2008-10-28 20:42 2,250,024 ----a-w c:\windows\system32\pbsvc.exe
2008-10-28 20:40 --------- d-----w c:\program files\Ubisoft
2008-10-28 07:12 --------- d-----w c:\program files\Crashday
2008-10-25 18:46 --------- d-----w c:\program files\Rockstar Games
2008-10-03 15:15 --------- d-----w c:\program files\DAEMON Tools Lite
2008-10-03 15:15 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\Disney Interactive Studios
2008-10-03 14:58 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-10-03 14:58 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\DAEMON Tools
2008-10-03 14:44 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2008-09-27 08:58 --------- d-----w c:\documents and settings\NOTSPECIFICT\Data aplikací\Ubisoft
2008-09-25 04:53 --------- d-----w c:\documents and settings\NOTSPECIFICT\Data aplikací\Spyware Terminator
2008-09-24 12:35 --------- d-----w c:\program files\Playlogic
2008-09-16 18:19 --------- d-----w c:\program files\Winamp
2008-09-16 18:19 --------- d-----w c:\program files\Talisman 2
2008-08-17 11:18 1,390,730 ----a-w c:\windows\system32\AutoPartNt.exe
2008-03-21 16:37 32 ----a-w c:\documents and settings\All Users\Data aplikací\ezsid.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-18 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 2321600]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-13 1443072]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"OSSelectorReinstall"="c:\program files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2007-03-15 2225208]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-16 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
DSLMON.lnk - c:\program files\ADSL\ADSL USB MODEM\DSLMON.exe [2008-02-29 929889]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.fraunhoferacm"= l3codecp.acm
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Counter-Strike Source\\srcds.exe"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Nero\\Nero8\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Jedi Knight Jedi Academy\\GameData\\jamp.exe"=
"c:\\Program Files\\BitSpirit\\BitSpirit.exe"=
"c:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\BRABO2\\Plocha\\PLOChA STARA\\DHCsvr\\samp-server.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\WinSCP\\WinSCP.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"c:\\Program Files\\Midway Home Entertainment\\BlackSite Area 51\\Binaries\\BlackSite.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2008-11-15 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-06-21 66600]
R2 Plánovač automatické aktualizace LiveUpdate;Plánovač automatické aktualizace LiveUpdate;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-11-09 198336]
R2 SbPF.Launcher;SbPF.Launcher;"c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe" [2008-10-31 95528]
R2 SPF4;Sunbelt Personal Firewall 4;"c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe" [2008-10-31 1365288]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2004-08-18 69120]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\sbfwim.sys [2008-11-14 65576]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
HKLM-Run-SDFix - c:\sdfix\RunThis.bat
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-16 17:53:03
Windows 5.1.2600 Service Pack 2 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
Celkový čas: 2008-11-16 17:55:07
ComboFix-quarantined-files.txt 2008-11-16 16:55:02
ComboFix2.txt 2008-11-16 15:55:45
Před spuštěním: Volných bajtů: 42 307 543 040
Po spuštění: Volných bajtů: 42,282,889,216
515 --- E O F --- 2008-08-15 15:08:17
Zde log z hjt:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:57:55, on 16.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\ADSL\ADSL USB MODEM\DSLMON.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://cashier.888.com/affiliatenetwork ... NT&Event=3
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\ADSL\ADSL USB MODEM\DSLMON.exe
O8 - Extra context menu item: Add to Video Converter... - C:\Program Files\MP3 Player Utilities 5.11\AVIConverter\grab.html
O8 - Extra context menu item: Baixar com o Rapidown... - C:\Program Files\Rapidown\rapidownGet.htm
O8 - Extra context menu item: Baixar tudo com o Rapidown... - C:\Program Files\Rapidown\rapidownGetAll.htm
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout pomocí BitSpiritu - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_srl.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.cz/buxus/docs/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6499EAC7-CCAB-4094-AA50-2705E2C09CAE}: NameServer = 194.228.41.65 194.228.41.113
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: Plánovač automatické aktualizace LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
--
End of file - 10623 bytes
ComboFix 08-11-14.01 - BRABO2 2008-11-16 17:42:14.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1631 [GMT 1:00]
Spuštěný z: c:\documents and settings\BRABO2\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\BRABO2\Plocha\CFScript.txt
* Vytvořen nový Bod Obnovení
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\SDFix
c:\sdfix\Add_DBFix_RunOnce_key.inf
c:\sdfix\AdminCheck2.txt
c:\sdfix\apps\assosfix.reg
c:\sdfix\apps\Cghtme.exe
c:\sdfix\apps\cliptext.exe
c:\sdfix\apps\CSweg.exe
c:\sdfix\apps\DBFix.inf
c:\sdfix\apps\download.exe
c:\sdfix\apps\dummy.sys
c:\sdfix\apps\Enable_Command_Prompt.inf
c:\sdfix\apps\Enable_Command_Prompt.reg
c:\sdfix\apps\ERDNT.E_E
c:\sdfix\apps\ERDNTDOS.LOC
c:\sdfix\apps\ERDNTWIN.LOC
c:\sdfix\apps\ERUNT.EXE
c:\sdfix\apps\ERUNT.LOC
c:\sdfix\apps\fix.reg
c:\sdfix\apps\FixBeep.reg
c:\sdfix\apps\FixBH.reg
c:\sdfix\apps\FixComponents.reg
c:\sdfix\apps\FIXCU.reg
c:\sdfix\apps\FIXLM.reg
c:\sdfix\apps\FixPath.exe
c:\sdfix\apps\FixRedir.reg
c:\sdfix\apps\FixSchedule.reg
c:\sdfix\apps\FixWebCheck.reg
c:\sdfix\apps\fixXP.reg
c:\sdfix\apps\FixXPsp2.reg
c:\sdfix\apps\grep.exe
c:\sdfix\apps\HaxdFix.reg
c:\sdfix\apps\HPFix.reg
c:\sdfix\apps\HPFix2.reg
c:\sdfix\apps\HPFix3.reg
c:\sdfix\apps\HPFix4.reg
c:\sdfix\apps\HPFix5.reg
c:\sdfix\apps\HPFix6.reg
c:\sdfix\apps\HPFix7.reg
c:\sdfix\apps\HPFix8.reg
c:\sdfix\apps\HPFix9.reg
c:\sdfix\apps\Installed.txt
c:\sdfix\apps\isadmin.exe
c:\sdfix\apps\leg2.txt
c:\sdfix\apps\legacy.txt
c:\sdfix\apps\legacybk.txt
c:\sdfix\apps\locate.com
c:\sdfix\apps\LS.exe
c:\sdfix\apps\MD5File.exe
c:\sdfix\apps\moveex.exe
c:\sdfix\apps\MyGcpvFix.reg
c:\sdfix\apps\MyGkFix2.reg
c:\sdfix\apps\Process.exe
c:\sdfix\apps\procs.exe
c:\sdfix\apps\psservice.exe
c:\sdfix\apps\Rem.txt
c:\sdfix\apps\Rem2.txt
c:\sdfix\apps\Replace\regedit.exe
c:\sdfix\apps\Replace\w2k\AUTOEXEC.NT
c:\sdfix\apps\Replace\w2k\beep.sys
c:\sdfix\apps\Replace\w2k\command.com
c:\sdfix\apps\Replace\w2k\command.PIF
c:\sdfix\apps\Replace\w2k\CONFIG.NT
c:\sdfix\apps\Replace\w2k\null.sys
c:\sdfix\apps\Replace\xp\AUTOEXEC.NT
c:\sdfix\apps\Replace\xp\beep.sys
c:\sdfix\apps\Replace\xp\command.com
c:\sdfix\apps\Replace\xp\command.PIF
c:\sdfix\apps\Replace\xp\CONFIG.NT
c:\sdfix\apps\Replace\xp\null.sys
c:\sdfix\apps\Reset_AppInit_DLLs.reg
c:\sdfix\apps\RestartIt!.exe
c:\sdfix\apps\Restore_SafeBoot_Windows2000.reg
c:\sdfix\apps\Restore_SafeBoot_WindowsXP.reg
c:\sdfix\apps\Restore_SafeBoot_WindowsXP_SP2.reg
c:\sdfix\apps\Restore_SafeBoot_WindowsXP_SP3.reg
c:\sdfix\apps\Restore_SecurityCenter.reg
c:\sdfix\apps\Restore_SharedAccess.reg
c:\sdfix\apps\sc.exe
c:\sdfix\apps\sed.exe
c:\sdfix\apps\SF.exe
c:\sdfix\apps\shutdown.exe
c:\sdfix\apps\srv2.txt
c:\sdfix\apps\srv2bk.txt
c:\sdfix\apps\svc.txt
c:\sdfix\apps\svcbk.txt
c:\sdfix\apps\Swreg.exe
c:\sdfix\apps\swsc.exe
c:\sdfix\apps\UnRAR.exe
c:\sdfix\apps\unzip.exe
c:\sdfix\apps\vfind.exe
c:\sdfix\apps\WINMSG.EXE
c:\sdfix\apps\winsec.reg
c:\sdfix\apps\zip.exe
c:\sdfix\attrib.exe
c:\sdfix\backupreg\AppInit_DLLs.reg
c:\sdfix\backupreg\bat_shell_open.reg
c:\sdfix\backupreg\BHO.reg
c:\sdfix\backupreg\com_shell_open.reg
c:\sdfix\backupreg\ControlPanel_Load.reg
c:\sdfix\backupreg\Drivers32.reg
c:\sdfix\backupreg\exe_shell_open.reg
c:\sdfix\backupreg\HKCU_SOFTWARE_Policy.reg
c:\sdfix\backupreg\HKCU_WINDOWS_Policy.reg
c:\sdfix\backupreg\HKCURun.reg
c:\sdfix\backupreg\HKCURunServices.reg
c:\sdfix\backupreg\HKLM_SOFTWARE_Policy.reg
c:\sdfix\backupreg\HKLM_WINDOWS_Policy.reg
c:\sdfix\backupreg\HKLMRun.reg
c:\sdfix\backupreg\HKLMRunServices.reg
c:\sdfix\backupreg\IEDesktop.reg
c:\sdfix\backupreg\IEMain.reg
c:\sdfix\backupreg\Installed_Components.reg
c:\sdfix\backupreg\pif_shell_open.reg
c:\sdfix\backupreg\reg_shell_open.reg
c:\sdfix\backupreg\SecurityProviders.reg
c:\sdfix\backupreg\SharedTaskScheduler.reg
c:\sdfix\backupreg\ShellServiceObjectDelayLoad.reg
c:\sdfix\backupreg\SubSystems.reg
c:\sdfix\backupreg\txt_shell_open.reg
c:\sdfix\backupreg\Winlogon.reg
c:\sdfix\backupreg\WinlogonNotify.reg
c:\sdfix\beepFA0.TXT
c:\sdfix\beepFA1.TXT
c:\sdfix\beepFA2.TXT
c:\sdfix\beepFA3.TXT
c:\sdfix\beepFA4.TXT
c:\sdfix\beepxcodec0.TXT
c:\sdfix\beepxcodec1.TXT
c:\sdfix\beepxcodec2.TXT
c:\sdfix\beepxcodec3.TXT
c:\sdfix\beepxcodec4.TXT
c:\sdfix\bpTEST1.TXT
c:\sdfix\bpTEST3.TXT
c:\sdfix\catchme.exe
c:\sdfix\DBFix.bat
c:\sdfix\delavi0.txt
c:\sdfix\delzip0.txt
c:\sdfix\dest.txt
c:\sdfix\dnif.exe
c:\sdfix\dummy.exe
c:\sdfix\dummy.sys
c:\sdfix\editreg.exe
c:\sdfix\FilekillList1.txt
c:\sdfix\FileList1.txt
c:\sdfix\Find.txt
c:\sdfix\Findav2009.txt
c:\sdfix\Findav2009a.txt
c:\sdfix\Findbhos1.txt
c:\sdfix\FindIRCBrute.txt
c:\sdfix\Findroguerun1.txt
c:\sdfix\Findrun002.txt
c:\sdfix\Findrun002a.txt
c:\sdfix\Findrun30.txt
c:\sdfix\Findrun31.txt
c:\sdfix\Findrun31a.txt
c:\sdfix\Findrun31b.txt
c:\sdfix\Findrun32.txt
c:\sdfix\Findrunbifrose1.txt
c:\sdfix\Findrunbot1.txt
c:\sdfix\FindrunDW_Start.txt
c:\sdfix\Findzip.txt
c:\sdfix\HOSTS
c:\sdfix\Patched2a.txt
c:\sdfix\Patched2b.txt
c:\sdfix\Patched2c.txt
c:\sdfix\RemLat.txt
c:\sdfix\Remlat1.txt
c:\sdfix\Remlat2.txt
c:\sdfix\Remlat3.txt
c:\sdfix\Remlat4.txt
c:\sdfix\Report.txt
c:\sdfix\rtsdnif.exe
c:\sdfix\RunThis.bat
c:\sdfix\SDFIX_ReadMe_Online.url
c:\sdfix\TESTspreadbot1.TXT
c:\sdfix\userinfix.reg
c:\sdfix\W2K_VirusAlert_Repair.inf
c:\sdfix\XP_VirusAlert_Repair.inf
C:\SDFixyx
c:\sdfixyx\Add_DBFix_RunOnce_key.inf
c:\sdfixyx\AdminCheck2.txt
c:\sdfixyx\apps\assosfix.reg
c:\sdfixyx\apps\Cghtme.exe
c:\sdfixyx\apps\cliptext.exe
c:\sdfixyx\apps\CSweg.exe
c:\sdfixyx\apps\DBFix.inf
c:\sdfixyx\apps\download.exe
c:\sdfixyx\apps\dummy.sys
c:\sdfixyx\apps\Enable_Command_Prompt.inf
c:\sdfixyx\apps\Enable_Command_Prompt.reg
c:\sdfixyx\apps\ERDNT.E_E
c:\sdfixyx\apps\ERDNTDOS.LOC
c:\sdfixyx\apps\ERDNTWIN.LOC
c:\sdfixyx\apps\ERUNT.EXE
c:\sdfixyx\apps\ERUNT.LOC
c:\sdfixyx\apps\fix.reg
c:\sdfixyx\apps\FixBeep.reg
c:\sdfixyx\apps\FixBH.reg
c:\sdfixyx\apps\FixComponents.reg
c:\sdfixyx\apps\FIXCU.reg
c:\sdfixyx\apps\FIXLM.reg
c:\sdfixyx\apps\FixPath.exe
c:\sdfixyx\apps\FixRedir.reg
c:\sdfixyx\apps\FixSchedule.reg
c:\sdfixyx\apps\FixWebCheck.reg
c:\sdfixyx\apps\fixXP.reg
c:\sdfixyx\apps\FixXPsp2.reg
c:\sdfixyx\apps\grep.exe
c:\sdfixyx\apps\HaxdFix.reg
c:\sdfixyx\apps\HPFix.reg
c:\sdfixyx\apps\HPFix2.reg
c:\sdfixyx\apps\HPFix3.reg
c:\sdfixyx\apps\HPFix4.reg
c:\sdfixyx\apps\HPFix5.reg
c:\sdfixyx\apps\HPFix6.reg
c:\sdfixyx\apps\HPFix7.reg
c:\sdfixyx\apps\HPFix8.reg
c:\sdfixyx\apps\HPFix9.reg
c:\sdfixyx\apps\Installed.txt
c:\sdfixyx\apps\isadmin.exe
c:\sdfixyx\apps\leg2.txt
c:\sdfixyx\apps\legacy.txt
c:\sdfixyx\apps\legacybk.txt
c:\sdfixyx\apps\locate.com
c:\sdfixyx\apps\LS.exe
c:\sdfixyx\apps\MD5File.exe
c:\sdfixyx\apps\moveex.exe
c:\sdfixyx\apps\MyGcpvFix.reg
c:\sdfixyx\apps\MyGkFix2.reg
c:\sdfixyx\apps\Process.exe
c:\sdfixyx\apps\procs.exe
c:\sdfixyx\apps\psservice.exe
c:\sdfixyx\apps\Rem.txt
c:\sdfixyx\apps\Rem2.txt
c:\sdfixyx\apps\Replace\regedit.exe
c:\sdfixyx\apps\Replace\w2k\AUTOEXEC.NT
c:\sdfixyx\apps\Replace\w2k\beep.sys
c:\sdfixyx\apps\Replace\w2k\command.com
c:\sdfixyx\apps\Replace\w2k\command.PIF
c:\sdfixyx\apps\Replace\w2k\CONFIG.NT
c:\sdfixyx\apps\Replace\w2k\null.sys
c:\sdfixyx\apps\Replace\xp\AUTOEXEC.NT
c:\sdfixyx\apps\Replace\xp\beep.sys
c:\sdfixyx\apps\Replace\xp\command.com
c:\sdfixyx\apps\Replace\xp\command.PIF
c:\sdfixyx\apps\Replace\xp\CONFIG.NT
c:\sdfixyx\apps\Replace\xp\null.sys
c:\sdfixyx\apps\Reset_AppInit_DLLs.reg
c:\sdfixyx\apps\RestartIt!.exe
c:\sdfixyx\apps\Restore_SafeBoot_Windows2000.reg
c:\sdfixyx\apps\Restore_SafeBoot_WindowsXP.reg
c:\sdfixyx\apps\Restore_SafeBoot_WindowsXP_SP2.reg
c:\sdfixyx\apps\Restore_SafeBoot_WindowsXP_SP3.reg
c:\sdfixyx\apps\Restore_SecurityCenter.reg
c:\sdfixyx\apps\Restore_SharedAccess.reg
c:\sdfixyx\apps\sc.exe
c:\sdfixyx\apps\sed.exe
c:\sdfixyx\apps\SF.exe
c:\sdfixyx\apps\shutdown.exe
c:\sdfixyx\apps\srv2.txt
c:\sdfixyx\apps\srv2bk.txt
c:\sdfixyx\apps\svc.txt
c:\sdfixyx\apps\svcbk.txt
c:\sdfixyx\apps\Swreg.exe
c:\sdfixyx\apps\swsc.exe
c:\sdfixyx\apps\UnRAR.exe
c:\sdfixyx\apps\unzip.exe
c:\sdfixyx\apps\vfind.exe
c:\sdfixyx\apps\WINMSG.EXE
c:\sdfixyx\apps\winsec.reg
c:\sdfixyx\apps\zip.exe
c:\sdfixyx\attrib.exe
c:\sdfixyx\backupreg\AppInit_DLLs.reg
c:\sdfixyx\backupreg\bat_shell_open.reg
c:\sdfixyx\backupreg\BHO.reg
c:\sdfixyx\backupreg\com_shell_open.reg
c:\sdfixyx\backupreg\ControlPanel_Load.reg
c:\sdfixyx\backupreg\Drivers32.reg
c:\sdfixyx\backupreg\exe_shell_open.reg
c:\sdfixyx\backupreg\HKCU_SOFTWARE_Policy.reg
c:\sdfixyx\backupreg\HKCU_WINDOWS_Policy.reg
c:\sdfixyx\backupreg\HKCURun.reg
c:\sdfixyx\backupreg\HKCURunServices.reg
c:\sdfixyx\backupreg\HKLM_SOFTWARE_Policy.reg
c:\sdfixyx\backupreg\HKLM_WINDOWS_Policy.reg
c:\sdfixyx\backupreg\HKLMRun.reg
c:\sdfixyx\backupreg\HKLMRunServices.reg
c:\sdfixyx\backupreg\IEDesktop.reg
c:\sdfixyx\backupreg\IEMain.reg
c:\sdfixyx\backupreg\Installed_Components.reg
c:\sdfixyx\backupreg\pif_shell_open.reg
c:\sdfixyx\backupreg\reg_shell_open.reg
c:\sdfixyx\backupreg\SecurityProviders.reg
c:\sdfixyx\backupreg\SharedTaskScheduler.reg
c:\sdfixyx\backupreg\ShellServiceObjectDelayLoad.reg
c:\sdfixyx\backupreg\SubSystems.reg
c:\sdfixyx\backupreg\txt_shell_open.reg
c:\sdfixyx\backupreg\Winlogon.reg
c:\sdfixyx\backupreg\WinlogonNotify.reg
c:\sdfixyx\beepFA0.TXT
c:\sdfixyx\beepFA1.TXT
c:\sdfixyx\beepFA2.TXT
c:\sdfixyx\beepFA3.TXT
c:\sdfixyx\beepFA4.TXT
c:\sdfixyx\beepxcodec0.TXT
c:\sdfixyx\beepxcodec1.TXT
c:\sdfixyx\beepxcodec2.TXT
c:\sdfixyx\beepxcodec3.TXT
c:\sdfixyx\beepxcodec4.TXT
c:\sdfixyx\bpTEST1.TXT
c:\sdfixyx\bpTEST3.TXT
c:\sdfixyx\catchme.exe
c:\sdfixyx\DBFix.bat
c:\sdfixyx\delavi0.txt
c:\sdfixyx\delzip0.txt
c:\sdfixyx\dest.txt
c:\sdfixyx\dnif.exe
c:\sdfixyx\dummy.exe
c:\sdfixyx\dummy.sys
c:\sdfixyx\editreg.exe
c:\sdfixyx\FilekillList1.txt
c:\sdfixyx\FileList1.txt
c:\sdfixyx\Find.txt
c:\sdfixyx\Findav2009.txt
c:\sdfixyx\Findav2009a.txt
c:\sdfixyx\Findbhos1.txt
c:\sdfixyx\FindIRCBrute.txt
c:\sdfixyx\Findroguerun1.txt
c:\sdfixyx\Findrun002.txt
c:\sdfixyx\Findrun002a.txt
c:\sdfixyx\Findrun30.txt
c:\sdfixyx\Findrun31.txt
c:\sdfixyx\Findrun31a.txt
c:\sdfixyx\Findrun31b.txt
c:\sdfixyx\Findrun32.txt
c:\sdfixyx\Findrunbifrose1.txt
c:\sdfixyx\Findrunbot1.txt
c:\sdfixyx\FindrunDW_Start.txt
c:\sdfixyx\Findzip.txt
c:\sdfixyx\HOSTS
c:\sdfixyx\Patched2a.txt
c:\sdfixyx\Patched2b.txt
c:\sdfixyx\Patched2c.txt
c:\sdfixyx\RemLat.txt
c:\sdfixyx\Remlat1.txt
c:\sdfixyx\Remlat2.txt
c:\sdfixyx\Remlat3.txt
c:\sdfixyx\Remlat4.txt
c:\sdfixyx\Report.txt
c:\sdfixyx\Report_old_1.txt
c:\sdfixyx\rtsdnif.exe
c:\sdfixyx\RunThis.bat
c:\sdfixyx\SDFIX_ReadMe_Online.url
c:\sdfixyx\TESTspreadbot1.TXT
c:\sdfixyx\userinfix.reg
c:\sdfixyx\W2K_VirusAlert_Repair.inf
c:\sdfixyx\XP_VirusAlert_Repair.inf
.
((((((((((((((((((((((((( Soubory vytvořené od 2008-10-16 do 2008-11-16 )))))))))))))))))))))))))))))))
.
2008-11-16 14:52 . 2008-11-16 14:52 <DIR> d-------- c:\windows\ERUNT
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\Malwarebytes
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2008-11-16 11:18 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-16 11:18 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-15 20:04 . 2008-11-15 20:04 <DIR> d-------- c:\documents and settings\Administrator\Data aplikací\Spyware Terminator
2008-11-15 19:16 . 2008-11-15 19:16 <DIR> d-------- c:\program files\Trend Micro
2008-11-15 10:04 . 2008-10-31 07:09 270,888 -ra------ c:\windows\system32\drivers\SbFw.sys
2008-11-15 10:03 . 2008-11-15 10:03 <DIR> d-------- c:\program files\Sunbelt Software
2008-11-14 22:47 . 2008-06-21 04:54 65,576 --a------ c:\windows\system32\drivers\SbFwIm.sys
2008-11-11 18:33 . 2008-11-12 17:52 <DIR> d-------- c:\program files\World of Warcraft
2008-11-11 18:33 . 2008-11-11 18:44 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment
2008-11-09 21:25 . 2008-11-09 21:36 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\PSpad
2008-11-09 21:24 . 2008-11-09 21:25 <DIR> d-------- c:\program files\PSPad editor
2008-11-03 14:25 . 2008-11-03 14:26 <DIR> d-------- c:\program files\MP3 Player Utilities 5.11
2008-10-31 17:08 . 2008-10-31 17:08 <DIR> d-------- c:\program files\VirtualDJ
2008-10-31 16:02 . 2005-11-30 21:20 2,314,332 --a------ c:\windows\system32\LIBMMD.DLL
2008-10-29 15:13 . 2008-10-29 15:13 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\Leadertech
2008-10-29 15:13 . 2008-10-29 15:13 <DIR> d-------- c:\documents and settings\BRABO2\Data aplikací\InstallShield
2008-10-28 22:15 . 2008-10-28 22:15 <DIR> dr-h----- c:\documents and settings\BRABO2\Data aplikací\SecuROM
2008-10-25 19:42 . 2008-10-25 20:01 <DIR> d-------- c:\program files\MTA San Andreas
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-16 08:44 --------- d-----w c:\program files\Common Files\Adobe
2008-11-15 19:22 --------- d-----w c:\program files\Yahoo!
2008-11-15 14:38 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-15 14:38 --------- d-----w c:\program files\Doom 3
2008-11-11 17:20 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\FileZilla
2008-11-09 15:37 --------- d-----w c:\program files\Total Video Converter
2008-11-07 18:22 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\Skype
2008-11-07 18:21 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\skypePM
2008-11-03 16:35 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\gtk-2.0
2008-10-30 12:51 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-29 14:10 --------- d-----w c:\program files\SystemRequirementsLab
2008-10-28 20:43 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-10-28 20:43 22,328 ----a-w c:\documents and settings\BRABO2\Data aplikací\PnkBstrK.sys
2008-10-28 20:43 107,832 ----a-w c:\windows\system32\PnkBstrB.exe
2008-10-28 20:42 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2008-10-28 20:42 2,250,024 ----a-w c:\windows\system32\pbsvc.exe
2008-10-28 20:40 --------- d-----w c:\program files\Ubisoft
2008-10-28 07:12 --------- d-----w c:\program files\Crashday
2008-10-25 18:46 --------- d-----w c:\program files\Rockstar Games
2008-10-03 15:15 --------- d-----w c:\program files\DAEMON Tools Lite
2008-10-03 15:15 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\Disney Interactive Studios
2008-10-03 14:58 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-10-03 14:58 --------- d-----w c:\documents and settings\BRABO2\Data aplikací\DAEMON Tools
2008-10-03 14:44 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2008-09-27 08:58 --------- d-----w c:\documents and settings\NOTSPECIFICT\Data aplikací\Ubisoft
2008-09-25 04:53 --------- d-----w c:\documents and settings\NOTSPECIFICT\Data aplikací\Spyware Terminator
2008-09-24 12:35 --------- d-----w c:\program files\Playlogic
2008-09-16 18:19 --------- d-----w c:\program files\Winamp
2008-09-16 18:19 --------- d-----w c:\program files\Talisman 2
2008-08-17 11:18 1,390,730 ----a-w c:\windows\system32\AutoPartNt.exe
2008-03-21 16:37 32 ----a-w c:\documents and settings\All Users\Data aplikací\ezsid.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-18 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 2321600]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-13 1443072]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"OSSelectorReinstall"="c:\program files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2007-03-15 2225208]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-16 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
DSLMON.lnk - c:\program files\ADSL\ADSL USB MODEM\DSLMON.exe [2008-02-29 929889]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.fraunhoferacm"= l3codecp.acm
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Counter-Strike Source\\srcds.exe"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Nero\\Nero8\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Jedi Knight Jedi Academy\\GameData\\jamp.exe"=
"c:\\Program Files\\BitSpirit\\BitSpirit.exe"=
"c:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\BRABO2\\Plocha\\PLOChA STARA\\DHCsvr\\samp-server.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\WinSCP\\WinSCP.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"c:\\Program Files\\Midway Home Entertainment\\BlackSite Area 51\\Binaries\\BlackSite.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2008-11-15 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-06-21 66600]
R2 Plánovač automatické aktualizace LiveUpdate;Plánovač automatické aktualizace LiveUpdate;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-11-09 198336]
R2 SbPF.Launcher;SbPF.Launcher;"c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe" [2008-10-31 95528]
R2 SPF4;Sunbelt Personal Firewall 4;"c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe" [2008-10-31 1365288]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2004-08-18 69120]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\sbfwim.sys [2008-11-14 65576]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
HKLM-Run-SDFix - c:\sdfix\RunThis.bat
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-16 17:53:03
Windows 5.1.2600 Service Pack 2 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
Celkový čas: 2008-11-16 17:55:07
ComboFix-quarantined-files.txt 2008-11-16 16:55:02
ComboFix2.txt 2008-11-16 15:55:45
Před spuštěním: Volných bajtů: 42 307 543 040
Po spuštění: Volných bajtů: 42,282,889,216
515 --- E O F --- 2008-08-15 15:08:17
Zde log z hjt:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:57:55, on 16.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\ADSL\ADSL USB MODEM\DSLMON.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://cashier.888.com/affiliatenetwork ... NT&Event=3
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\ADSL\ADSL USB MODEM\DSLMON.exe
O8 - Extra context menu item: Add to Video Converter... - C:\Program Files\MP3 Player Utilities 5.11\AVIConverter\grab.html
O8 - Extra context menu item: Baixar com o Rapidown... - C:\Program Files\Rapidown\rapidownGet.htm
O8 - Extra context menu item: Baixar tudo com o Rapidown... - C:\Program Files\Rapidown\rapidownGetAll.htm
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout pomocí BitSpiritu - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_srl.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.cz/buxus/docs/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6499EAC7-CCAB-4094-AA50-2705E2C09CAE}: NameServer = 194.228.41.65 194.228.41.113
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: Plánovač automatické aktualizace LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
--
End of file - 10623 bytes
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43294
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Zaseknutí mozilly firefox při načítání některých stránek.
logy O.K.
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u
vyčisti systém CCleanerem
a použij i T-Cleaner
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
Aktualizuj javu:
Java SE Runtime Environment 6u10
Vyber OS ( předpokládám Windows), zatržítko agree-continue
Vyber:
Windows Offline Installation
jre-6u10-windows-i586-p.exe
Ostatní javy odeber v přidat/odebrat programy.
Potom popiš stav PC.
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u
vyčisti systém CCleanerem
a použij i T-Cleaner
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
Aktualizuj javu:
Java SE Runtime Environment 6u10
Vyber OS ( předpokládám Windows), zatržítko agree-continue
Vyber:
Windows Offline Installation
jre-6u10-windows-i586-p.exe
Ostatní javy odeber v přidat/odebrat programy.
Potom popiš stav PC.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
-
BRABO[*_*]
- Level 1.5
- Příspěvky: 122
- Registrován: leden 08
- Pohlaví:
- Stav:
Offline
Re: Zaseknutí mozilly firefox při načítání některých stránek.
Ok vše jsem udělal jak píšeš a prohlížeč vypadá dobře zatim žádná chyba. Takže ty moc děkuji bez tebe bych byl novíš kde 
. Seš borec. Kdyby něco dám vědět.
. Seš borec. Kdyby něco dám vědět.-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43294
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Zaseknutí mozilly firefox při načítání některých stránek.
Nemáš zač, jj. když tak dej vědět..
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Kdo je online
Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 103 hostů