BSOD

Horalka · Napísal **Horalka**: 30.07.2007 12:12

Takže, po dlhom čase od kúpi skoro nového PC mi teraz prišla modrá obrazovka (blue screen of death)... No ale s chybou, ktorú som ešte nikdynevidel... Dole úplne mi napísalo že : Výpis fizické pamäte RAM... Išlo do 100 a potom počítač urobil zvuk ako by sa vypol ale ešte bežal... Pod tím napísalo že sa mám obrátiť na .... No všetko spadlo keď som v Opere klikol na okno... :shock:

Pritom som mal PC asi dosť zatažení... Po novom sputení Windows (resetnutí a prihlásení) mi Windows napísal hlášku že sa zotavil po vážnej chybe... Dal som odoslať, no a naskočila mi opera a Microsoft stránka, tu je
Vie niekto čo sa mi vlastne stalo?

Rbot · Napísal **Rbot**: 30.07.2007 12:42

Aby som vylúčil vírovú nákazu, poprosím log z HijackThis - aktuálnej verzie.

Horalka · Napísal autor témy **Horalka**: 30.07.2007 12:43

aviro dáš mi sem link na novú verziu, HijackThis mám ale neviem či najnovší :oops:

Numline1 · Napísal **Numline1**: 30.07.2007 12:47

Do **** to nepoznate Google ?

http://www.majorgeeks.com/download3155.html

Rbot · Napísal **Rbot**: 30.07.2007 12:47

http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php

Horalka · Napísal autor témy **Horalka**: 30.07.2007 12:49

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:50:48, on 30. 7. 2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Eset\Eset Smart Security\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Eset\Eset Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Free Desktop Clock\DesktopClock.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Adobe\Adobe Photoshop CS3\Photoshop.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\totalcmd\TOTALCMD.EXE
D:\Install\Downloaded\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: 222.111.150.111 gwgt1.joymax.com
O1 - Hosts: 121.128.133.26 gwgt1.joymax.com
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O1 - Hosts: 127.255.255.255 www.alcohol-soft.com
O1 - Hosts: 127.255.255.255 images.alcohol-soft.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: CHelper Class - {99A7C4DD-B2E6-4CA0-BB6E-737A61364155} - C:\Program Files\Eurotran2002i\e11.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\Eset\Eset Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Free Desktop Clock\DesktopClock.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Nástrojová lišta RoboFormu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Prispôsobiť menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Stiahnuť položku pomocou FlashGetu - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Stiahnuť všetky položky pomocou FlashGetu - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Stáhnout pomocí BitSpiritu - C:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: Uložiť formulár - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Vyplniť formulár - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Vyplniť formulár - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Vyplniť formulár - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Uložiť - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Uložiť formulár - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Eurotran - {572BF76C-9EFF-4e1e-93DE-72EF1E91B3DF} - C:\Program Files\Eurotran2002i\e11.dll
O9 - Extra 'Tools' menuitem: Eurotran - {572BF76C-9EFF-4e1e-93DE-72EF1E91B3DF} - C:\Program Files\Eurotran2002i\e11.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Nástrojová lišta RoboFormu - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 1576268578
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{293B9E49-A260-4BB6-9DEC-21D8C2CFE821}: NameServer = 217.119.113.244,217.119.113.245
O17 - HKLM\System\CCS\Services\Tcpip\..\{3BC07F4F-9297-489C-9168-D7DE5F5334AF}: NameServer = 217.119.113.244,217.119.113.245
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Eset Service (ekrn) - Eset - C:\Program Files\Eset\Eset Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 12048 bytes

Rbot · Napísal **Rbot**: 30.07.2007 13:12

Poznáš Bonjour? A ešte sú tam rôzne programy, ktoré nie sú veľmi rozširené.

Fixni:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: 222.111.150.111 gwgt1.joymax.com
O1 - Hosts: 121.128.133.26 gwgt1.joymax.com

FlashGet neodporúčam.

Horalka · Napísal autor témy **Horalka**: 30.07.2007 13:16

Bonjour... Keď som inštaloval Adobe Photoshop CS3 Ex tak sa Eset Smart Security pítal či povoliť prístup na internet, ináč nie.. A podľa mna to chcelo len pri inštalácií, ale aj na štarte Winu sa ma to píta, no asi je to blbosť... FlashGet - prečo ho neodporúčaš? Len mi nepovec, že Internet Download Manager je lepší... A Tie veci som fixol... Ďakujem, ešte sa vyjadri k tomu Bonjour a FlashGetu

Rbot · Napísal **Rbot**: 30.07.2007 13:20

Neviem čo je lepšie, ale proste tento neodporúčam. Ak chceš, nechaj si ho (na vlastnú žiadosť).

Bonjour naozaj súvisí s tým Adobe.

Horalka · Napísal autor témy **Horalka**: 30.07.2007 13:22

Hmm... Ale ja som myslel že len pri inštalácii, čiže ho môžem povoliť?

Rbot · Napísal **Rbot**: 30.07.2007 13:25

Nie je to škodlivé.

Horalka · Napísal autor témy **Horalka**: 30.07.2007 14:15

Ďakujem... Ale ešte stále neviem čo to spôsobilo tú BSOD... Vedel som že háveď nemám (ale pre istotu diky aviro :-)

), tak potom kde? Žeby trebalo nové ovládače? A tie komponenty v PC sú staré max. 2 mesiace...

Rbot · Napísal **Rbot**: 30.07.2007 14:21

Stiahni a spusť ---> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Riaď sa inštrukciami, počas kontroly neklikaj, PC môže byť reštartovaný.

Po dokončení sa vytvorí log ---> C:/Combofix.txt

Horalka · Napísal autor témy **Horalka**: 30.07.2007 14:31

Kód:

ComboFix 07-07-30.2 - "Janko" 2007-07-30 14:26:07.1 [GMT 2:00] - NTFS 
Syst‚m Microsoft Windows XP Professional  5.1.2600.2.1250.420.1029.18.True
 * Created a new restore point


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\regedit.com
C:\WINDOWS\system32\taskmgr.com


(((((((((((((((((((((((((   Files Created from 2007-06-28 to 2007-07-30  )))))))))))))))))))))))))))))))


2007-07-30 10:27   <DIR>   d--------   C:\Program Files\DOSBox-0.70
2007-07-28 18:40   24,576   ---------   C:\WINDOWS\UniFISH.exe
2007-07-28 14:01   <DIR>   d--------   C:\Program Files\Bonjour
2007-07-28 13:30   203,264   --a------   C:\WINDOWS\system32\britain.scr
2007-07-28 13:30   <DIR>   d--------   C:\WINDOWS\system32\britain dir
2007-07-28 09:18   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DATAAP~1\FLEXnet
2007-07-27 18:55   <DIR>   d--------   C:\Program Files\Common Files\Adobe Systems Shared
2007-07-27 18:55   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DATAAP~1\Adobe Systems
2007-07-26 15:20   <DIR>   d--------   C:\Program Files\BitSpirit
2007-07-26 13:20   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DATAAP~1\InstallShield
2007-07-25 20:05   <DIR>   d--------   C:\DOCUME~1\Janko\DATAAP~1\Builder
2007-07-25 11:29   <DIR>   d--------   C:\DOCUME~1\Janko\DATAAP~1\Eset
2007-07-24 12:40   <DIR>   d--------   C:\WINDOWS\system32\eScan
2007-07-24 12:36   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DATAAP~1\Eset
2007-07-23 10:43   <DIR>   d--------   C:\Program Files\Everstrike Software
2007-07-21 10:13   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DATAAP~1\Lavasoft
2007-07-20 19:02   <DIR>   d--------   C:\Program Files\Common Files\Everstrike Software
2007-07-18 10:01   <DIR>   d--------   C:\DOCUME~1\Hanka\DATAAP~1\Zoner
2007-07-17 13:25   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DATAAP~1\Test Drive Unlimited
2007-07-17 12:54   <DIR>   d--------   C:\Program Files\TDU
2007-07-16 19:24   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DATAAP~1\Kaspersky Lab Setup Files
2007-07-16 13:42   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DATAAP~1\Age of Empires 3
2007-07-16 12:51   <DIR>   d--------   C:\WINDOWS\system32\VIRepair
2007-07-16 09:47   <DIR>   d--------   C:\Program Files\Common Files\BOONTY Shared
2007-07-16 09:47   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DATAAP~1\BOONTY
2007-07-15 19:25   <DIR>   d--------   C:\DOCUME~1\Hanka\DATAAP~1\Real
2007-07-12 16:31   94,208   --a------   C:\WINDOWS\system32\pskill.exe
2007-07-12 16:31   8,636   --a------   C:\WINDOWS\system32\modifype.exe
2007-07-12 16:31   19,968   --a------   C:\WINDOWS\system32\reico.exe
2007-07-12 16:31   111,104   --a------   C:\WINDOWS\system32\Uharc.exe
2007-07-12 16:31   <DIR>   d--------   C:\WINDOWS\system32\VITrans
2007-07-12 16:31   <DIR>   d--------   C:\VTPFiles
2007-07-12 09:35   <DIR>   d--------   C:\Program Files\Common Files\DirectX
2007-07-11 16:50   <DIR>   d--------   C:\Program Files\Creative Zone
2007-07-11 12:23   <DIR>   d--------   C:\Program Files\Common Files\Real
2007-07-11 12:22   <DIR>   d--------   C:\DOCUME~1\Janko\DATAAP~1\Real
2007-07-11 12:05   33,824   --a------   C:\WINDOWS\system32\drivers\oreans32.sys
2007-07-11 10:28   <DIR>   d--------   C:\Program Files\CDRLabel 7.0
2007-07-11 10:28   <DIR>   d--------   C:\Program Files\CD obaly
2007-07-10 10:37   <DIR>   d--------   C:\DOCUME~1\Janko\DATAAP~1\FileFactory Turbo
2007-07-09 19:44   <DIR>   d--------   C:\DOCUME~1\Janko\DATAAP~1\Azureus
2007-07-09 19:25   223,128   --a------   C:\WINDOWS\system32\drivers\vaxscsi.sys
2007-07-09 18:39   <DIR>   d--------   C:\Program Files\Domain Tools
2007-07-09 15:04   <DIR>   d--------   C:\DOCUME~1\Janko\DATAAP~1\OLYMPUS
2007-07-09 14:59   <DIR>   d--------   C:\Program Files\SUPERAntiSpyware
2007-07-09 14:59   <DIR>   d--------   C:\DOCUME~1\Janko\DATAAP~1\SUPERAntiSpyware.com
2007-07-09 14:59   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DATAAP~1\SUPERAntiSpyware.com
2007-07-09 14:58   <DIR>   d--------   C:\Binaries
2007-07-09 14:57   86,016   --a------   C:\WINDOWS\system32\bgsvcgen.exe
2007-07-09 14:57   57,344   --a------   C:\WINDOWS\system32\GenSvcInst.exe
2007-07-09 14:57   32,256   --a------   C:\WINDOWS\system32\drivers\cdrbsdrv.sys
2007-07-09 14:57   319,488   ---------   C:\WINDOWS\system32\Pvmjpg21.dll
2007-07-09 14:57   <DIR>   d--------   C:\WINDOWS\system32\QuickTime
2007-07-09 14:57   <DIR>   d--------   C:\Program Files\OLYMPUS
2007-07-09 14:56   <DIR>   d--------   C:\Program Files\PIXELA
2007-07-09 14:54   <DIR>   d--------   C:\Program Files\QuickTime
2007-07-09 14:53   <DIR>   d--------   C:\Program Files\Apple Software Update
2007-07-09 14:39   <DIR>   d--------   C:\Program Files\Common Files\InstallShield
2007-07-09 14:39   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DATAAP~1\QuickTime
2007-07-09 11:44   <DIR>   d-a------   C:\WINDOWS\zts2.exe
2007-07-09 11:44   <DIR>   d-a------   C:\WINDOWS\system32\vcmgcd32.dll
2007-07-09 11:44   <DIR>   d-a------   C:\WINDOWS\system32\iifgfgf.dll
2007-07-09 11:44   <DIR>   d-a------   C:\WINDOWS\rundll16.exe
2007-07-09 11:44   <DIR>   d-a------   C:\WINDOWS\rundl132.dll
2007-07-09 11:44   <DIR>   d-a------   C:\WINDOWS\logo1_.exe
2007-07-09 11:43   418,304   --a------   C:\WINDOWS\R.COM
2007-07-09 11:43   353,280   --a------   C:\WINDOWS\system32\T.COM
2007-07-05 11:03   2,277,888   --a------   C:\WINDOWS\system32\TUKernel.exe
2007-07-03 18:29   <DIR>   d--------   C:\Program Files\Eurotran2002i
2007-07-03 14:13   299,520   --a------   C:\WINDOWS\uninst.exe
2007-07-02 17:43   54,784   --a------   C:\WINDOWS\system32\drivers\CDAC11BA.EXE
2007-07-02 17:43   <DIR>   d--------   C:\Program Files\Common Files\Macrovision Shared
2007-07-02 17:43   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DATAAP~1\Macrovision
2007-07-02 17:42   12,464   --a------   C:\WINDOWS\system32\drivers\CdaC15BA.SYS
2007-07-01 17:44   <DIR>   d--------   C:\Program Files\Dark Solar System ScreenSaver
2007-07-01 17:43   1,683,456   --a------   C:\WINDOWS\system32\Fish.scr
2007-07-01 13:30   <DIR>   d--------   C:\Program Files\PC Translator 2007 CZ
2007-06-30 12:31   <DIR>   d--------   C:\DOCUME~1\Janko\DATAAP~1\LimeWire
2007-06-30 12:19   24,575   --a------   C:\WINDOWS\system32\umssetwinsyspios5.dll
2007-06-30 12:17   73,728   --a------   C:\WINDOWS\system32\ltlst14N.dll
2007-06-30 12:17   57,344   --a------   C:\WINDOWS\system32\lfbmp14N.dll
2007-06-30 12:17   53,248   --a------   C:\WINDOWS\system32\zlib.dll
2007-06-30 12:17   53,248   --a------   C:\WINDOWS\system32\lttmb14N.dll
2007-06-30 12:17   487,424   --a------   C:\WINDOWS\system32\LTKRN14n.DLL
2007-06-30 12:17   303,104   --a------   C:\WINDOWS\system32\LTDIS14n.DLL
2007-06-30 12:17   274,432   --a------   C:\WINDOWS\system32\LTEFX14n.DLL
2007-06-30 12:17   24,575   --a------   C:\WINDOWS\system32\Pssetwinsyspios55.dll
2007-06-30 12:17   180,224   --a------   C:\WINDOWS\system32\LTFIL14n.DLL
2007-06-30 12:17   1,126,400   --a------   C:\WINDOWS\system32\LTIMG14n.DLL
2007-06-30 12:17   <DIR>   d--------   C:\Program Files\IconCool Software
2007-06-30 11:57   <DIR>   d--------   C:\DOCUME~1\Janko\DATAAP~1\Google
2007-06-29 19:05   <DIR>   d--------   C:\Program Files\FlashFXP
2007-06-29 17:43   <DIR>   d--------   C:\Program Files\Universal Extractor
2007-06-27 17:36   <DIR>   dr-h-----   C:\DOCUME~1\Janko\DATAAP~1\SecuROM
2007-06-26 00:29   44,032   --a------   C:\WINDOWS\system32\drivers\epfwtdi.sys
2007-06-26 00:29   41,984   --a------   C:\WINDOWS\system32\drivers\epfw.sys
2007-06-26 00:29   24,064   --a------   C:\WINDOWS\system32\drivers\epfwndis.sys
2007-06-26 00:29   133,120   --a------   C:\WINDOWS\system32\drivers\eamon.sys
2007-06-26 00:29   11,776   --a------   C:\WINDOWS\system32\drivers\easdrv.sys
2007-06-23 16:40   4,212   ---h-----   C:\WINDOWS\system32\zllictbl.dat


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-30 14:24   ---------   d--------   C:\DOCUME~1\Janko\DATAAP~1\uTorrent
2007-07-28 13:28   ---------   d--------   C:\Program Files\FlashGet
2007-07-27 15:51   ---------   d--------   C:\Program Files\TuneUp Utilities 2006
2007-07-26 18:58   ---------   d--------   C:\DOCUME~1\Janko\DATAAP~1\Skype
2007-07-26 13:31   ---------   d--h-----   C:\Program Files\InstallShield Installation Information
2007-07-25 20:04   ---------   d--------   C:\Program Files\Google
2007-07-25 19:41   ---------   d--------   C:\Program Files\Opera
2007-07-25 10:02   ---------   d--------   C:\Program Files\Microsoft Visual Studio 8
2007-07-21 10:13   ---------   d--------   C:\Program Files\Lavasoft
2007-07-21 10:12   ---------   d--------   C:\Program Files\Common Files\Wise Installation Wizard
2007-07-20 08:20   ---------   d--------   C:\Program Files\Mozilla Thunderbird
2007-07-17 15:05   107888   --a------   C:\WINDOWS\system32\CmdLineExt.dll
2007-06-24 09:01   23   --a------   C:\WINDOWS\clofghls.dll
2007-06-21 18:49   271360   --a------   C:\WINDOWS\system32\drivers\atksgt.sys
2007-06-17 00:11   51200   --a------   C:\WINDOWS\nircmd.exe
2007-06-11 18:12   81196   --a------   C:\WINDOWS\system32\perfc005.dat
2007-06-11 18:12   433164   --a------   C:\WINDOWS\system32\perfh005.dat
2007-06-02 17:12   682232   --a------   C:\WINDOWS\system32\drivers\sptd.sys
2007-05-30 15:32   ---------   d--------   C:\DOCUME~1\Janko\DATAAP~1\Zoner
2007-05-30 15:31   ---------   d--------   C:\Program Files\Zoner
2007-05-22 14:27   0   --a------   C:\WINDOWS\PowerReg.dat
2007-05-20 10:08   1474   --a------   C:\WINDOWS\system32\tmp.reg
2007-05-16 17:18   683520   --a------   C:\WINDOWS\system32\inetcomm.dll
2004-08-18 12:00:00   60,416   --sha-w   C:\WINDOWS\BricoPacks\SysFiles\69_msimn.exe
2004-08-18 12:00:00   73,728   --sha-w   C:\WINDOWS\BricoPacks\SysFiles\71_wmplayer.exe


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
 
 
*Note* empty entries & legit default entries are not shown 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-27 04:47 C:\WINDOWS\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 C:\WINDOWS\SkyTel.exe]
"SoundMan"="SOUNDMAN.EXE" [2002-03-21 04:23 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2006-05-04 10:26 C:\WINDOWS\ALCWZRD.EXE]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 12:43 C:\WINDOWS\ALCMTR.EXE]
"nwiz"="nwiz.exe" [2006-06-01 11:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 11:22 C:\WINDOWS\system32\nvmctray.dll]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" [2007-07-06 21:53]
"egui"="C:\Program Files\Eset\Eset Smart Security\egui.exe" [2007-06-26 00:29]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-18 14:00]
"SkinClock"="C:\Program Files\Free Desktop Clock\DesktopClock.exe" [2006-10-01 16:50]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 00:29]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoWinKeys"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Janko^Nabídka Start^Programy^Po spuštění^Hotkeys.lnk]
backup=C:\WINDOWS\pss\Hotkeys.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Janko^Nabídka Start^Programy^Po spuštění^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
backup=C:\WINDOWS\pss\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Janko^Nabídka Start^Programy^Po spuštění^Yahoo! Widget Engine.lnk]
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ScreenHunter"=C:\Program Files\Wisdom-soft ScreenHunter 5 Free\ScreenHunter.exe
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
"OM_Monitor"=C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"PCSuiteTrayApplication"=C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"OM_Monitor"=C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe

R1 AmdK8;Ovladaź procesoru AMD;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 BANTExt;Belarc SMBios Access;C:\WINDOWS\system32\Drivers\BANTExt.sys
R1 cdrbsdrv;cdrbsdrv;C:\WINDOWS\system32\drivers\cdrbsdrv.sys
R1 easdrv;easdrv;C:\WINDOWS\system32\DRIVERS\easdrv.sys
R1 epfwtdi;epfwtdi;C:\WINDOWS\system32\DRIVERS\epfwtdi.sys
R1 oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\oreans32.sys
R1 SASDIFSV;SASDIFSV;\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
R1 SASKUTIL;SASKUTIL;\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
R2 atksgt;atksgt;C:\WINDOWS\system32\DRIVERS\atksgt.sys
R2 CdaC15BA;CdaC15BA;\??\C:\WINDOWS\system32\drivers\CdaC15BA.SYS
R2 eamon;EAMON;C:\WINDOWS\system32\DRIVERS\eamon.sys
R2 ekrn;Eset Service;"C:\Program Files\Eset\Eset Smart Security\ekrn.exe"
R2 epfw;epfw;C:\WINDOWS\system32\DRIVERS\epfw.sys
R2 LF30FS;LF30FS;\??\C:\Program Files\Everstrike Software\Lock Folder XP 3.5\LF30XP.sys
R2 lirsgt;lirsgt;C:\WINDOWS\system32\DRIVERS\lirsgt.sys
R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 Epfwndis;Eset Personal Firewall;C:\WINDOWS\system32\DRIVERS\Epfwndis.sys
R3 EPPSCSIx;EPPSCSI Driver;C:\WINDOWS\system32\DRIVERS\EPPSCAN.sys
R3 PSched;Pl novaź paket… technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys
R3 vaxscsi;vaxscsi;C:\WINDOWS\system32\Drivers\vaxscsi.sys
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys
R3 WmFilter;Logitech WingMan HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys
S0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys
S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe"
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0;C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys
S3 idsvc;Windows CardSpace;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service;"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe"
S3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver;C:\WINDOWS\system32\drivers\msmpu401.sys
S3 NtApm;Ovladaź rozhranˇ slu§by NT Apm/Legacy;C:\WINDOWS\system32\DRIVERS\NtApm.sys
S3 odserv;Microsoft Office Diagnostics Service;"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
S3 SASENUM;SASENUM;\??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
S3 usb2vcom;Nokia CA-42 USB;C:\WINDOWS\system32\DRIVERS\usb2vcom.sys
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
Schedule
UxTuneUp


Contents of the 'Scheduled Tasks' folder
2007-07-27 15:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job - C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
2007-07-23 15:28:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-30 14:28:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cursors\Schemes]
"\f\1e?r?n?\xe9? ?u?k?a?z?a?t?e?l?e? ?"="C:\WINDOWS\cursors\arrow_r.cur,C:\WINDOWS\cursors\help_r.cur,C:\WINDOWS\cursors\wait_r.cur,C:\WINDOWS\cursors\busy_r.cur,C:\WINDOWS\cursors\cross_r.cur,C:\WINDOWS\cursors\beam_r.cur,C:\WINDOWS\cursors\pen_r.cur,C:\WINDOWS\cursors\no_r.cur,C:\WINDOWS\cursors\size4_r.cur,C:\WINDOWS\cursors\size3_r.cur,C:\WINDOWS\cursors\size2_r.cur,C:\WINDOWS\cursors\size1_r.cur,C:\WINDOWS\cursors\move_r.cur,C:\WINDOWS\cursors\up_r.cur"
"\f\1e?r?n?\xe9? ?u?k?a?z?a?t?e?l?e? ?(?v?e?l?k?\xe9?)?"="C:\WINDOWS\cursors\arrow_rm.cur,C:\WINDOWS\cursors\help_rm.cur,C:\WINDOWS\cursors\wait_rm.cur,C:\WINDOWS\cursors\busy_rm.cur,C:\WINDOWS\cursors\cross_rm.cur,C:\WINDOWS\cursors\beam_rm.cur,C:\WINDOWS\cursors\pen_rm.cur,C:\WINDOWS\cursors\no_rm.cur,C:\WINDOWS\cursors\size4_rm.cur,C:\WINDOWS\cursors\size3_rm.cur,C:\WINDOWS\cursors\size2_rm.cur,C:\WINDOWS\cursors\size1_rm.cur,C:\WINDOWS\cursors\move_rm.cur,C:\WINDOWS\cursors\up_rm.cur"
"\f\1e?r?n?\xe9? ?u?k?a?z?a?t?e?l?e? ?(?n?e?j?v?\e\1t?a\1\xed?)?"="C:\WINDOWS\cursors\arrow_rl.cur,C:\WINDOWS\cursors\help_rl.cur,C:\WINDOWS\cursors\wait_rl.cur,C:\WINDOWS\cursors\busy_rl.cur,C:\WINDOWS\cursors\cross_rl.cur,C:\WINDOWS\cursors\beam_rl.cur,C:\WINDOWS\cursors\pen_rl.cur,C:\WINDOWS\cursors\no_rl.cur,C:\WINDOWS\cursors\size4_rl.cur,C:\WINDOWS\cursors\size3_rl.cur,C:\WINDOWS\cursors\size2_rl.cur,C:\WINDOWS\cursors\size1_rl.cur,C:\WINDOWS\cursors\move_rl.cur,C:\WINDOWS\cursors\up_rl.cur"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG08.00.00.01WORKSTATION"="D420A469549CD239013251B767E758A0EB7B97D1DE8669969E62AB59A2D34EC9834041F6577AA96468D32A962F17992C100BF4EF3F28667CD41EAA67EACF40065AF3903961E10EE454DCFD7324C6CD08D19CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667A6171C11EC38DE3DBA7FD869164D6794C038D530D6EB34524A92C7265AC2E26E6B26E7FA6E335BD7B4CBC1A5885301501339413114AA745296C5C269177688C64C649EB3160B99132670C3BF020A6CED6A4A610EB5E42386C241A4B605B23D84CD577F93D9562E47C446042CE472F90337DDCF745BA8EEA94BB3066045B5E024999ADBC55AD101D38FF32D07F3E4BDF6E6CAAF99888DB5C530BCA3D13CF23A73E1BA29087D6BE26F86958F85B4EF2F046D564945835EB63AF3F0DF071293F197DBB902ADEB4A8521B0379C6EF153A8B5C03E88D4589818B91F5ABC1232711609BF0EA31B92457EC6185FEC1D3A86E9F0DA32FCB7556FDFC9BC76E418CD1C17924822704CA26A4911C883397F5E3318E8BB56DA720E4A7B46DC352651585849543953EDCE92F84383548E619AF434B7A8E4417A9DDAC1BCDE927B6F0C0A1C6941D4F4C54519E5AF7953DFE985589DB60EDD02D66554A5551476A356A9DE14132364CBC6E5B5D9341D5BC9F6EAA735624A30959089DBF8603EA4F9151F18204793B691637BA8B05B708D14550B43F1EFE2EB716C5E13F0D887BABE8776B8D26B8398F42F62F57B144888F8F338D2837633A37D504DE0F79E70DCA8ADCA89F3C9B5E198E58E6800B04DF429635940CA6FE66C15C95173AE77C8355FAD4F967E8EC3E89165060DB4E77B7AC55DEAB8DDBC01618907FAB6650BB96B8050492FA34D970D692F633447D225C6673CFAAE852157A29DDDEDDE23653D331C82116845F8F2AC206853F21770ED8C977D2ED83F4313D10AC5E4E2A2F7213D395415997B6C672C265C9A24BAA4CE8157453B31BDAEB2157B58297F53160942CE7B566092E35DF561788DE2F83414DD975A6CF5E35387988FD81D3156F86DFDCBD0681C888212762CCC1711CE49DFE0402722294E84370A5DA9B33C83BC963010D0767091CC931DD592B5D36C73A5CA2CBACF9049F93C9B6A5276A96462231C709C3D4696AA475F9EA17B1537A430622BC7FB3756CDE204B47F8041B7CC8809B5790E49316C63353E780E0148329971FEA6C2EAAA80CEFE2B000395EF450BC41E504DE83141749C5DB82808E9D853C46050523D2F75F4CAB249C1F634F8479B5A2D765B1ABF59161A2919611E35242D78646F0483739EA921F115FDDD762A648E41941725E0C7A406B1C10599C9220367A6EFDB77A66A62C43669857C34F6F4D462C958BB81455129E19931C4FDBC1DC07CBF9F111D4A3FDDF63E2D52"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000051f

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Ad-Watch Real-Time Scanner]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\AWRTPD.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Ad-Watch Registry Filter]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\AWRTRD.sys"

Completion time: 2007-07-30 14:29:00
C:\ComboFix-quarantined-files.txt ... 2007-07-30 14:28

   --- E O F ---

ComboFix nereštartoval PC, ale zmenil mi hodinky, mal som FreeDesktop Clock, no on to dal naspäť ale to ma neštve...
Ale čo je tento driver AWRTPD.sys? Idem poGoogle-iť

Horalka · Napísal autor témy **Horalka**: 30.07.2007 14:33

Na konci ComboFixu som si všimol že je aj niaky log že quarantine filkes, tu je:

2004-08-18 14:00 353280 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\TASKMGR.COM.vir
2004-08-18 14:00 418304 --a------ C:\Qoobox\Quarantine\C\WINDOWS\REGEDIT.COM.vir

Věpis CESTY slo§ky svazku SYSTEM
S‚riov‚ źˇslo svazku je E8B1-9845
C:\QOOBOX
\---Quarantine
+---C
| \---WINDOWS
| | REGEDIT.COM.vir
| |
| \---system32
| TASKMGR.COM.vir
|
\---Registry_backups

Vir z roku 2004? :shock:

Rbot · Napísal **Rbot**: 30.07.2007 14:50

Otestovať na http://www.virustotal.com

C:\WINDOWS\PowerReg.dat

Horalka · Napísal autor témy **Horalka**: 30.07.2007 14:52

Kód:

ERROR
The requested URL could not be retrieved

While trying to retrieve the URL: http://www.virustotal.com/vt/en/recepcion? 

The following error was encountered: 
Access Denied. 

Access control configuration prevents your request from being allowed at this time. Please contact your service provider if you feel this is incorrect. 

Your cache administrator is webmaster@hispasec.com.

Toto mi napísalo keď som dal upload :loony:

Rbot · Napísal **Rbot**: 30.07.2007 14:58

Do políčka skopíruj toto:

Kód:

C:\WINDOWS\PowerReg.dat

Potom daj "Send file"

Horalka · Napísal autor témy **Horalka**: 30.07.2007 15:01

Teraz zase toto :loony:

Kód:

0 bytes size received / Se ha recibido un archivo vacio

Rbot · Napísal **Rbot**: 30.07.2007 15:03

Tak je to OK.

Ešte je nejaký problém s PC?

Horalka · Napísal autor témy **Horalka**: 30.07.2007 15:05

Nie, ďakujem aviro...

Rbot · Napísal **Rbot**: 30.07.2007 15:07

Ešte aj Microsoft si chcel zaťažovať. :lol:

Rbot · Napísal **Rbot**: 30.07.2007 22:16

Ešte som to podrobne skontroloval, aj keď vravíš, že nie sú problémy.

Cez Avenger:

Kód:

Files to delete:
C:\WINDOWS\system32\drivers\oreans32.sys
C:\WINDOWS\system32\reico.exe
C:\WINDOWS\system32\Uharc.exe 
C:\WINDOWS\system32\umssetwinsyspios5.dll
C:\WINDOWS\system32\Pssetwinsyspios55.dll
C:\WINDOWS\clofghls.dll
C:\WINDOWS\system32\tmp.reg

Drivers to unload:
oreans32

Na http://www.virustotal.com

Kód:

C:\WINDOWS\system32\drivers\atksgt.sys

Horalka · Napísal autor témy **Horalka**: 31.07.2007 9:24

Sú ešte väčšie problémy! Dnes som zapol normálne PC a spustila sa normálne obrazovka že Win sa nahráva a odrazu na pol sekundy sa objavila BSOD obrazovka a Win sa zresetol, ale na druhý krát to už išlo... Do kelu čo sa stalo? :cry: