prosim o kontrolu combofix

ComboFix 08-07-05.1 - Janitor 2008-07-06 15:19:20.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1012 [GMT 2:00]
Running from: C:\Documents and Settings\Janitor\Plocha\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\windows\system32\zlib.dll

.
((((((((((((((((((((((((( Files Created from 2008-06-06 to 2008-07-06 )))))))))))))))))))))))))))))))
.

2008-07-06 15:10 . 2008-07-06 15:10 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Google Updater
2008-07-06 15:04 . 2008-07-06 15:05 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-07-06 14:53 . 2008-07-06 15:02 <DIR> d-------- C:\Program Files\Norton Security Scan
2008-07-06 14:24 . 2008-07-06 15:16 <DIR> d-a------ C:\Documents and Settings\All Users\Data aplikací\TEMP
2008-07-06 14:14 . 2008-07-06 15:15 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-07-06 14:14 . 2008-07-06 14:14 <DIR> d-------- C:\Documents and Settings\Janitor\Data aplikací\PC Tools
2008-07-06 14:14 . 2005-09-23 07:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-07-06 14:14 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-07-06 14:14 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-07-06 14:14 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-07-06 14:14 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-07-02 20:15 . 2008-07-02 20:15 <DIR> d-------- C:\Grand Theft Auto - San Andreas
2008-07-01 20:38 . 2008-07-01 20:38 <DIR> d-------- C:\Documents and Settings\Janitor\Data aplikací\QIP
2008-07-01 19:51 . 2008-07-01 20:05 <DIR> d-------- C:\Program Files\ICQ6
2008-07-01 19:47 . 2008-07-01 19:47 <DIR> d-------- C:\Program Files\QIP
2008-07-01 19:43 . 2008-07-01 19:43 <DIR> d-------- C:\Program Files\ICQToolbar
2008-07-01 19:34 . 2008-07-01 22:22 <DIR> d-------- C:\Program Files\ICQ6Toolbar
2008-07-01 19:34 . 2008-07-01 19:34 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\ICQ
2008-07-01 19:33 . 2008-07-01 19:35 <DIR> d-------- C:\Documents and Settings\Janitor\Data aplikací\ICQ
2008-06-28 22:04 . 2008-07-03 21:34 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-06-11 08:10 . 2008-06-14 20:00 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 08:10 . 2008-06-14 20:00 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-07 10:24 . 2008-06-08 14:38 <DIR> d-------- C:\Documents and Settings\Janitor\Data aplikací\Winamp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-06 13:10 --------- d-----w C:\Program Files\Google
2008-07-06 08:56 206,480 --sha-w C:\windows\system32\drivers\fidbox2.idx
2008-07-06 08:56 2,326,796 --sha-w C:\windows\system32\drivers\fidbox.idx
2008-07-06 08:56 2,218,016 --sha-w C:\windows\system32\drivers\fidbox2.dat
2008-07-06 08:56 174,257,696 --sha-w C:\windows\system32\drivers\fidbox.dat
2008-07-06 08:29 --------- d-----w C:\Documents and Settings\Janitor\Data aplikací\uTorrent
2008-07-03 10:27 --------- d-----w C:\Documents and Settings\Janitor\Data aplikací\Skype
2008-07-02 20:30 --------- d-----w C:\Program Files\Kaspersky Lab
2008-07-02 06:53 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2008-07-01 17:58 --------- d-----w C:\Documents and Settings\Janitor\Data aplikací\MegauploadToolbar
2008-07-01 17:35 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-24 12:26 --------- d-----w C:\Program Files\Thoosje Sidebar V2.0
2008-06-23 18:52 22,328 ----a-w C:\windows\system32\drivers\PnkBstrK.sys
2008-06-23 18:52 22,328 ----a-w C:\Documents and Settings\Janitor\Data aplikací\PnkBstrK.sys
2008-06-23 18:52 103,736 ----a-w C:\windows\system32\PnkBstrB.exe
2008-06-23 18:51 66,872 ----a-w C:\windows\system32\PnkBstrA.exe
2008-06-07 08:25 --------- d-----w C:\Program Files\Winamp
2008-05-30 18:09 --------- d-----w C:\Program Files\Opera
2008-05-08 12:28 202,752 ----a-w C:\windows\system32\drivers\rmcast.sys
2008-05-07 05:16 1,290,240 ----a-w C:\windows\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\windows\system32\wininet.dll
2001-11-23 04:08 712,704 ----a-w C:\windows\inf\OTHER\AUDIO3D.DLL
.



------- Sigcheck -------

2004-08-17 15:49 25088 5050a0b550ccf3ffbc3dad33524a4dc1 C:\windows\system32\ctfmon.exe
2004-08-17 15:49 25088 5050a0b550ccf3ffbc3dad33524a4dc1 C:\windows\system32\dllcache\ctfmon.exe
2004-08-17 15:49 15360 a5baa91475167161dea02ba3c4ca4f59 C:\windows\VistaMizer\old\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2007-12-02 16:13 394680 --a------ C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\windows\system32\ctfmon.exe" [2004-08-17 15:49 25088]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49 153136]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53 153136]
"kis"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" [2006-03-24 18:09 139367]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088]
"Cmaudio"="cmicnfg.cpl" [N/A]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-17 15:49 25088]

C:\Documents and Settings\Janitor\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
Thoosje Sidebar .lnk - C:\Program Files\Thoosje Sidebar V2.0\Thoosje Sidebar .exe [2007-06-19 15:24:52 524288]
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

C:\Documents and Settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 02:06:58 28672]
VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe [2007-08-28 11:46:16 565248]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{35B2861B-2B26-4691-9FF0-09083722C736}"= "C:\WINDOWS\system32\RadExe.dll" [2004-08-30 21:08 200704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=C:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^hp psc 1000 series.lnk]
path=C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\hp psc 1000 series.lnk
backup=C:\windows\pss\hp psc 1000 series.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^QuickTV.lnk]
path=C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\QuickTV.lnk
backup=C:\windows\pss\QuickTV.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-07-06 15:10 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-03-27 08:35 36352 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Ati HotKey Poller"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 viasraid;viasraid;C:\windows\system32\DRIVERS\viasraid.sys [2003-10-31 05:22]
R2 CX88XBAR;AVerMedia, AVerTV 303/403 Crossbar;C:\windows\system32\drivers\CX88XBAR.sys [2002-11-15 07:25]
R2 ICQ Service;ICQ Service;C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 19:26]
R3 PSched;Plánovač paketů technologie QoS;C:\windows\system32\DRIVERS\psched.sys [2004-08-03 23:04]

*Newly Created Service* - CATCHME
*Newly Created Service* - EECTRL
*Newly Created Service* - ERASERUTILDRV10741
*Newly Created Service* - GUSVC
.
Contents of the 'Scheduled Tasks' folder
"2008-02-14 20:59:52 C:\windows\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1194804304.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2008-07-06 12:54:00 C:\windows\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-06 15:22:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2008-07-06 15:25:22
ComboFix-quarantined-files.txt 2008-07-06 13:24:18

Adresářů: 11, Volných bajtů: 7,300,976,640
Adresářů: 16, Volných bajtů: 7,406,592,000

162 --- E O F --- 2008-06-20 05:26:04

Ahoj, nevidim tam nic zle. Nejaky problem?

caf, tak mam dosť značne zasraty comp stale sa sam od seba hockedy resetuje, v kasperskom mi vypisuje stale nejake chytene trojany v statistike mi píše že mam 27 vírov zistenych a 1 neošetreny .... už som pc prebehol spybotom S&D, spywarom doctor,disk som taktiež defragmentoval akurat že ak dam kontrolu virov kasperskym tak my žiadny nenajde "neboli zistene žiadne hrozby" a pritom v statistike ich mam neošetrene, neviem či to nebude tým že som mal licenciu na polroka a už my vypršala tak neviem či to nema s týmto suvis že je skončena licencia

skus to prejst cez mwav...http://www.mwti.net/products/download_center.asp...ale bez kluca ti len najde a nic nezmaze/citas SS?

Presiel som to este raz. Otestuj na www.virustotal.com tieto subory:

C:\WINDOWS\system32\RadExe.dll


Posli na este log z Ultimate Process Manageru (procesy, moduly, po spusteni, ovladace, sluzby) - link v podpise. Spustis subor _MAKE_LOG_CZ.bat a zaskrtas jednotlive policka.


MWAV je zbytocny, lebo najde to iste ako Kaspersky.

hej ale pokial ma kaspersky po termine tak najde ale neznici ani nic nemyslis?a pokial sa mu podari najst kluc k mwav tak je v suchu:::hm?

Windows XP SP 2 (build 2600)
Internet Explorer v7.00.6000.16674 (vista_gdr.080415-1732)
Log vygenerován:6. 7. 2008 19:36:50
================================================================

Test UPM
Testuji funkce... OK

Běžící procesy
================================================================
C:\WINDOWS\SYSTEM32\SMSS.EXE
C:\WINDOWS\SYSTEM32\CSRSS.EXE
C:\WINDOWS\SYSTEM32\WINLOGON.EXE
C:\WINDOWS\SYSTEM32\SERVICES.EXE
C:\WINDOWS\SYSTEM32\LSASS.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVP.EXE
C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE
C:\PROGRAM FILES\GOOGLE\COMMON\GOOGLE UPDATER\GOOGLEUPDATERSERVICE.EXE
C:\PROGRAM FILES\ICQ6TOOLBAR\ICQ SERVICE.EXE
C:\WINDOWS\SYSTEM32\PNKBSTRA.EXE
C:\WINDOWS\SYSTEM32\PNKBSTRB.EXE
C:\PROGRAM FILES\ALCOHOL SOFT\ALCOHOL 120\STARWIND\STARWINDSERVICEAE.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVP.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE12\GROOVEMONITOR.EXE
C:\WINDOWS\SYSTEM32\LVCOMSX.EXE
C:\PROGRAM FILES\LOGITECH\VIDEO\LOGITRAY.EXE
C:\WINDOWS\SYSTEM32\CTFMON.EXE
C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NMBGMONITOR.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\PROGRAM FILES\VIA\RAID\RAID_TOOL.EXE
C:\PROGRAM FILES\THOOSJE SIDEBAR V2.0\THOOSJE SIDEBAR .EXE
C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NMINDEXINGSERVICE.EXE
C:\WINDOWS\SYSTEM32\ALG.EXE
C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NMINDEXSTORESVR.EXE
C:\WINDOWS\SYSTEM32\WSCNTFY.EXE
C:\PROGRAM FILES\LOGITECH\VIDEO\FXSVR2.EXE
C:\WINDOWS\SYSTEM32\DWWIN.EXE
C:\PROGRAM FILES\OPERA\OPERA.EXE
C:\PROGRAM FILES\ICQ6\ICQ.EXE
C:\PROGRAM FILES\SCREAMER RADIO\SCREAMER.EXE
C:\WINDOWS\SYSTEM32\CMD.EXE
C:\DOCUMENTS AND SETTINGS\JANITOR\PLOCHA\UPM.EXE

Scanner
================================================================
[?] smss.exe
Nemá okno

[?] csrss.exe
Nemá okno

[?] winlogon.exe
Nemá okno

[?] services.exe
Nemá okno

[?] lsass.exe
Nemá okno

[?] svchost.exe
Nemá okno

[?] svchost.exe
Nemá okno

[?] svchost.exe
Skrytý modul: 61300000h C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
Nemá okno

[?] svchost.exe
Nemá okno

[?] svchost.exe
Nemá okno

[?] spoolsv.exe
Nemá okno

[?] explorer.exe

[?] avp.exe
Spouští se po startu HKLM Run ["C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"]
Nemá okno

[?] mDNSResponder.exe
Nemá okno

[?] GoogleUpdaterService.exe
Nemá okno

[?] ICQ Service.exe
Bez výrobce
Nemá okno

[?] PnkBstrA.exe
Bez výrobce v System32
Podobná jména: PNKBSTRA.EXE X PNKBSTRB.EXE
Nemá okno

[?] PnkBstrB.exe
Bez výrobce v System32
Podobná jména: PNKBSTRB.EXE X PNKBSTRA.EXE
Nemá okno

[?] StarWindServiceAE.exe
Nemá okno

[?] svchost.exe
Nemá okno

[?] rundll32.exe

[?] avp.exe
Spouští se po startu HKLM Run ["C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"]

[?] GrooveMonitor.exe
Spouští se po startu HKLM Run ["C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"]
Skrytý modul: 68EF0000h C:\PROGRA~1\MICROS~2\Office12\GrooveUtil.dll
Skrytý modul: 68FF0000h C:\PROGRA~1\MICROS~2\Office12\GrooveNew.dll
Skrytý modul: 69B10000h C:\Program Files\AVerTV2K\MSXML3.DLL

[?] LVCOMSX.EXE
Non Microsoft v System32: Logitech Inc.
Spouští se po startu HKLM Run [C:\WINDOWS\system32\LVCOMSX.EXE]

[?] LogiTray.exe
Spouští se po startu HKLM Run [C:\Program Files\Logitech\Video\LogiTray.exe]
Skrytý modul: 041C0000h C:\Program Files\Logitech\Video\FXSvrps.dll

[?] ctfmon.exe
Spouští se po startu HKCU Run [C:\windows\system32\ctfmon.exe]

[?] NMBgMonitor.exe
Spouští se po startu HKCU Run ["C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"]

[?] hpotdd01.exe
Spouští se po startu Po spuštění [C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe]

[?] raid_tool.exe
Spouští se po startu Po spuštění [C:\Program Files\VIA\RAID\raid_tool.exe]

[?] Thoosje Sidebar .exe
Bez výrobce
Spouští se po startu Po spuštění [C:\Program Files\Thoosje Sidebar V2.0\Thoosje Sidebar .exe]
Skrytý modul: 61300000h C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[?] NMIndexingService.exe
Nemá okno

[?] alg.exe
Nemá okno

[?] NMIndexStoreSvr.exe

[?] wscntfy.exe

[?] FxSvr2.exe
Skrytý modul: 014C0000h C:\Program Files\Logitech\Video\FXSvrps.dll

[?] dwwin.exe

[?] Opera.exe
EntryPoint v sekci: .ASPACK
|_ Celkový počet sekcí: 6
Skrytý modul: 69B10000h C:\Program Files\AVerTV2K\MSXML3.DLL

[?] ICQ.exe
Skrytý modul: 61300000h C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[?] screamer.exe
Skrytý modul: 61300000h C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[?] cmd.exe

[R] upm.exe


Po spuštění
================================================================

HKCU Run
|_ [S][CTFMON.EXE] C:\windows\system32\ctfmon.exe
|_ [?][BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
|_ [?][LogitechSoftwareUpdate] C:\Program Files\Logitech\Video\ManifestEngine.exe

HKLM Run
|_ [X][Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd (Soubor nenalezen)
|_ [?][NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
|_ [?][kis] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
|_ [S][GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
|_ [?][LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
|_ [?][LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
|_ [?][LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
|_ [!][KernelFaultCheck] C:\windows\system32

HKLM ShellServiceObjectDelayLoad
|_ [S][PostBootReminder] C:\windows\system32\SHELL32.dll
|_ [S][CDBurn] C:\windows\system32\SHELL32.dll
|_ [S][WebCheck] C:\WINDOWS\system32\webcheck.dll
|_ [S][SysTray] C:\windows\system32\stobject.dll
|_ [S][WPDShServiceObj] C:\WINDOWS\system32\WPDShServiceObj.dll

HKU Run
|_ [S][CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE

HKLM Winlogon
|_ [S][Shell] C:\windows\Explorer.exe

HKLM Winlogon Notify
|_ [?][AtiExtEvent] C:\windows\system32\Ati2evxx.dll
|_ [S][crypt32chain] C:\windows\system32\crypt32.dll
|_ [S][cryptnet] C:\windows\system32\cryptnet.dll
|_ [S][cscdll] C:\windows\system32\cscdll.dll
|_ [?][klogon] C:\WINDOWS\system32\klogon.dll
|_ [S][ScCertProp] C:\windows\system32\wlnotify.dll
|_ [S][Schedule] C:\windows\system32\wlnotify.dll
|_ [S][sclgntfy] C:\windows\system32\sclgntfy.dll
|_ [S][SensLogn] C:\windows\system32\WlNotify.dll
|_ [S][termsrv] C:\windows\system32\wlnotify.dll
|_ [S][WgaLogon] C:\windows\system32\WgaLogon.dll
|_ [S][wlballoon] C:\windows\system32\wlnotify.dll

HKLM AppInit_DLLs
|_ [?][AppInit_DLLs] C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

Po spuštění
|_ C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
|_ C:\Program Files\VIA\RAID\raid_tool.exe
|_ [?][Adobe Gamma.lnk] C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
|_ [!][Thoosje Sidebar .lnk] C:\Program Files\Thoosje Sidebar V2.0\Thoosje Sidebar .exe
|_ [S][Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk] C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE


HKLM BHO
|_ [?][{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
|_ [?][{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}] C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
|_ [?][{22BF413B-C6D2-4d91-82A9-A0F997BA588C}] C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
|_ [?][{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}] C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
|_ [S][{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
|_ [!][{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}] C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll
|_ [!][{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] C:\Program Files\Google\GoogleToolbarNotifier

HKCU IE WebBrowser Toolbar
|_ [?][{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}] C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
|_ [?][{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}] C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
|_ [?][{4B3803EA-5230-4DC3-A7FC-33638F3D3542}] C:\PROGRA~1\Crawler\Toolbar\ctbr.dll

HKLM IE Toolbar
|_ [?][{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}] C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
|_ [?][{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}] C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
|_ [?][{4B3803EA-5230-4DC3-A7FC-33638F3D3542}] C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
|_ [?][{855F3B16-6D32-4fe6-8A56-BBB695989046}] C:\Program Files\ICQ6Toolbar\ICQToolBar.dll

lNetStat
================================================================
Typ PID Proces Lokální <-> Vzdálená Stav
-------------------------------------------------------------------------------------
TCP (1104) svchost.exe 0.0.0.0:135 LISTENING
TCP (4) Systém 0.0.0.0:445 LISTENING
TCP (572) 0.0.0.0:1110 LISTENING
TCP (1620) tarWindServiceAE.exe0.0.0.0:3260 LISTENING
TCP (1620) tarWindServiceAE.exe0.0.0.0:3261 LISTENING
TCP (4) Systém 5.72.156.242:139 LISTENING
TCP (2632) alg.exe 127.0.0.1:1031 LISTENING
TCP (0) 127.0.0.1:1110 TIME_WAIT
TCP (0) 127.0.0.1:1110 TIME_WAIT
TCP (0) 127.0.0.1:1110 TIME_WAIT
TCP (0) 127.0.0.1:1110 TIME_WAIT
TCP (608) mDNSResponder.exe 127.0.0.1:5354 LISTENING
TCP (4) Systém 192.168.158.61:139 LISTENING
UDP (4) Systém 0.0.0.0:445 <-> 195.250.146.100:8000 ESTABLISHED
UDP (844) lsass.exe 0.0.0.0:500
UDP (608) mDNSResponder.exe 0.0.0.0:1025
UDP (1552) svchost.exe 0.0.0.0:1026
UDP (1552) svchost.exe 0.0.0.0:1092
UDP (844) lsass.exe 0.0.0.0:4500
UDP (1476) svchost.exe 5.72.156.242:123
UDP (4) Systém 5.72.156.242:137
UDP (4) Systém 5.72.156.242:138
UDP (1772) svchost.exe 5.72.156.242:1900
UDP (608) mDNSResponder.exe 5.72.156.242:5353
UDP (1476) svchost.exe 127.0.0.1:123
UDP (740) Thoosje Sidebar .exe127.0.0.1:1045
UDP (1772) svchost.exe 127.0.0.1:1900
UDP (3172) ICQ.exe 127.0.0.1:2393
UDP (1536) PnkBstrA.exe 127.0.0.1:44301
UDP (1548) PnkBstrB.exe 127.0.0.1:45301
UDP (1476) svchost.exe 192.168.158.61:123
UDP (4) Systém 192.168.158.61:137
UDP (4) Systém 192.168.158.61:138
UDP (1772) svchost.exe 192.168.158.61:1900
UDP (608) mDNSResponder.exe 192.168.158.61:5353

Služby (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i služby Microsoftu: False)
================================================================
[!] Kaspersky Internet Security 6.0
|_ Cesta: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe -r
| |_ Výrobce:
| |_ Popis:
| |_ MD5:
|
|_ Jméno: AVP
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency:

[?] ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##
|_ Cesta: C:\Program Files\Bonjour\mDNSResponder.exe
| |_ Výrobce: Apple Computer, Inc.
| |_ Popis: Bonjour Service
| |_ MD5: 73686FE0B2E0469F89FD2075BE724704
|
|_ Jméno: Bonjour Service
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency: Tcpip

[?] Google Updater Service
|_ Cesta: C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
| |_ Výrobce: Google
| |_ Popis: gusvc
| |_ MD5: 1BF044E23206FDDC16891A32922D571B
|
|_ Jméno: gusvc
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency: RPCSS

[!] ICQ Service
|_ Cesta: C:\Program Files\ICQ6Toolbar\ICQ Service.exe
| |_ Výrobce:
| |_ Popis: ICQIEUpdater Module
| |_ MD5: A4E43A7AB1202356BEBEB6B798F15488
|
|_ Jméno: ICQ Service
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ:
|_ Dependency: RPCSS

[?] NMIndexingService
|_ Cesta: C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
| |_ Výrobce: Nero AG
| |_ Popis: Nero Home
| |_ MD5: 433049770B810D7C83C5C94CDB3E09D2
|
|_ Jméno: NMIndexingService
|_ StartName: LocalSystem
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency: RPCSS

[!] PnkBstrA
|_ Cesta: C:\windows\system32\PnkBstrA.exe
| |_ Výrobce:
| |_ Popis:
| |_ MD5: 0E01D7EEBADA0B324DB0CA1EE73440BA
|
|_ Jméno: PnkBstrA
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency:

[!] PnkBstrB
|_ Cesta: C:\windows\system32\PnkBstrB.exe
| |_ Výrobce:
| |_ Popis:
| |_ MD5: 1428E6CC1458A36CBFC1F2E304C7C42D
|
|_ Jméno: PnkBstrB
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency:

[?] StarWind AE Service
|_ Cesta: C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
| |_ Výrobce: Rocket Division Software
| |_ Popis: StarWind iSCSI Target (Alcohol Edition)
| |_ MD5: B1691AF4A072CB674D600DB16DD7308E
|
|_ Jméno: StarWindServiceAE
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency:


Ovladače (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i ovladače Microsoftu: False)
================================================================
[?] AFS2K
|_ Cesta: C:\windows\system32\drivers\AFS2K.sys
| |_ Výrobce: Oak Technology Inc.
| |_ Popis: Audio File System
| |_ MD5: B34B1AB0A7690A0E2301FEC6D17B2FC1
|
|_ Popis: AFS2k
|_ Status: OK
|_ Spuštěno: Ano

[?] ati2mtag
|_ Cesta: C:\windows\system32\DRIVERS\ati2mtag.sys
| |_ Výrobce: ATI Technologies Inc.
| |_ Popis: ATI Radeon WindowsNT Miniport Driver
| |_ MD5: 633D22A45283762DC05989751CC1397C
|
|_ Popis: ati2mtag
|_ Status: OK
|_ Spuštěno: Ano

[?] CamDrL
|_ Cesta: C:\windows\system32\DRIVERS\Camdrl.sys
| |_ Výrobce: Logitech Inc.
| |_ Popis: Universal Serial Bus Camera Driver
| |_ MD5: CBA8BCE5BF67A3C619D5CE540BED9CF7
|
|_ Popis: Logitech QuickCam Pro 3000(CamDrl)
|_ Status: OK
|_ Spuštěno: Ano

[?] cmuda
|_ Cesta: C:\windows\system32\drivers\cmuda.sys
| |_ Výrobce: C-Media Inc
| |_ Popis: C-Media Audio WDM Driver
| |_ MD5: DDCDE8CED6E753F9EBBD07659F808D9D
|
|_ Popis: C-Media WDM Audio Interface
|_ Status: OK
|_ Spuštěno: Ano

[?] CX23880
|_ Cesta: C:\windows\system32\drivers\cx88vid.sys
| |_ Výrobce: AVerMedia Technologies, Inc.
| |_ Popis: Video Capture Driver
| |_ MD5: 2BC3CB68442640FDB21899BF4D8C8B1C
|
|_ Popis: AVerMedia, AVerTV 303/403 Video Capture
|_ Status: OK
|_ Spuštěno: Ano

[?] CX88XBAR
|_ Cesta: C:\windows\system32\drivers\CX88XBAR.sys
| |_ Výrobce: AVerMedia Technologies, Inc.
| |_ Popis: Crossbar Driver
| |_ MD5: 9324FF14C29145AAE5BC069A5D640335
|
|_ Popis: AVerMedia, AVerTV 303/403 Crossbar
|_ Status: OK
|_ Spuštěno: Ano

[?] CXTUNE
|_ Cesta: C:\windows\system32\drivers\CX88TUNE.sys
| |_ Výrobce: AVerMedia Technologies, Inc.
| |_ Popis: Tuner Driver
| |_ MD5: 6CC0E1177636C020A77985F130D438DD
|
|_ Popis: AVerMedia, AVerTV 303/403 Tuner
|_ Status: OK
|_ Spuštěno: Ano

[?] eeCtrl
|_ Cesta: C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
| |_ Výrobce: Symantec Corporation
| |_ Popis: Symantec Eraser Control Driver
| |_ MD5: E89CC1363CB7F5320AE3B41C1333D0C3
|
|_ Popis: Symantec Eraser Control driver
|_ Status: OK
|_ Spuštěno: Ano

[?] FETNDISB
|_ Cesta: C:\windows\system32\DRIVERS\fetnd5b.sys
| |_ Výrobce: VIA Technologies, Inc.
| |_ Popis: NDIS 5.0 miniport driver
| |_ MD5: B7186B33B6CF3A23841015531E6E7D68
|
|_ Popis: VIA Rhine Family Fast Ethernet Adapter Driver Service
|_ Status: OK
|_ Spuštěno: Ano

[?] hamachi
|_ Cesta: C:\windows\system32\DRIVERS\hamachi.sys
| |_ Výrobce: LogMeIn, Inc.
| |_ Popis: Hamachi Virtual Network Interface Driver
| |_ MD5: 7929A161F9951D173CA9900FE7067391
|
|_ Popis: Hamachi Network Interface
|_ Status: OK
|_ Spuštěno: Ano

[?] kl1
|_ Cesta: C:\windows\system32\drivers\kl1.sys
| |_ Výrobce: Kaspersky Lab
| |_ Popis: Kaspersky Unified Driver
| |_ MD5: 5445B03CD42DEDF5F85B9DAF712FDD09
|
|_ Popis: Kl1
|_ Status: OK
|_ Spuštěno: Ano

[?] klif
|_ Cesta: C:\WINDOWS\system32\drivers\klif.sys
| |_ Výrobce: Kaspersky Lab
| |_ Popis: spuper-ptor
| |_ MD5: 92210989CC1D06F997B9628D8E4B1819
|
|_ Popis: Klif
|_ Status: OK
|_ Spuštěno: Ano

[?] LVUSBSta
|_ Cesta: C:\windows\system32\drivers\lvusbsta.sys
| |_ Výrobce: Logitech Inc.
| |_ Popis: USB Statistic Driver
| |_ MD5: C5EFBD05A5195402121711A6EBBB271F
|
|_ Popis: Logitech USB Monitor Filter
|_ Status: OK
|_ Spuštěno: Ano

[?] Ptilink
|_ Cesta: C:\windows\system32\DRIVERS\ptilink.sys
| |_ Výrobce: Parallel Technologies, Inc.
| |_ Popis: Parallel Technologies DirectParallel IO Library
| |_ MD5: 80D317BD1C3DBC5D4FE7B1678C60CADD
|
|_ Popis: Direct Parallel Link Driver
|_ Status: OK
|_ Spuštěno: Ano

[?] PxHelp20
|_ Cesta: C:\windows\system32\Drivers\PxHelp20.sys
| |_ Výrobce: Sonic Solutions
| |_ Popis: Px Engine Device Driver for Windows 2000/XP
| |_ MD5: D86B4A68565E444D76457F14172C875A
|
|_ Popis: PxHelp20
|_ Status: OK
|_ Spuštěno: Ano

[!] RadProbe
|_ Cesta: C:\windows\system32\DRIVERS\RadProbe.sys
| |_ Výrobce:
| |_ Popis: Radeon Probe
| |_ MD5: 1EF10FFFD34D67DCFF49E0A0B577257C
|
|_ Popis: Radeon Probe Driver
|_ Status: OK
|_ Spuštěno: Ano

[!] sptd
|_ Cesta: C:\windows\system32\Drivers\sptd.sys
| |_ Výrobce:
| |_ Popis:
| |_ MD5:
|
|_ Popis: sptd
|_ Status: OK
|_ Spuštěno: Ano

[?] viaagp1
|_ Cesta: C:\windows\system32\DRIVERS\viaagp1.sys
| |_ Výrobce: VIA Technologies, Inc.
| |_ Popis: VIA NT AGP Filter
| |_ MD5: 4B039BBD037B01F5DB5A144C837F283A
|
|_ Popis: VIA AGP Filter
|_ Status: OK
|_ Spuštěno: Ano

[?] ViaIde
|_ Cesta: C:\windows\system32\DRIVERS\viaide.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic PCI IDE Bus Driver
| |_ MD5: 59CB1338AD3654417BEA49636457F65D
|
|_ Popis: ViaIde
|_ Status: OK
|_ Spuštěno: Ano

[?] viasraid
|_ Cesta: C:\windows\system32\DRIVERS\viasraid.sys
| |_ Výrobce: VIA Technologies inc,.ltd
| |_ Popis: VIA SATA RAID DRIVER FOR WINXP
| |_ MD5: EBE101C01D80A42868F57B327BE1B564
|
|_ Popis: viasraid
|_ Status: OK
|_ Spuštěno: Ano


Moduly (Zobraz i DLL Microsoftu: False, Jen bez výrobce: True, Zobraz registrované: False)
================================================================
[!] hpzsnt07.dll
|_ Cesta: C:\WINDOWS\system32\hpzsnt07.dll
|_ MD5: FB44C8568224451A43B745C39C182406
|_ Výrobce: HP
|_ Procesy
|_ spoolsv.exe (2004)

[!] ezcddax9.dll
|_ Cesta: C:\Program Files\Easy CD-DA Extractor 9\ezcddax9.dll
|_ MD5: 5541C0B68E48007C54A225224A1AAC11
|_ Výrobce:
|_ Procesy
|_ explorer.exe (408)

[!] rarext.dll
|_ Cesta: C:\Program Files\WinRAR\RarExt.dll
|_ MD5: CE1FF0C418276F34728CC0CA525FD959
|_ Výrobce:
|_ Procesy
|_ explorer.exe (408)

[!] radexe.dll
|_ Cesta: C:\WINDOWS\system32\RadExe.dll
|_ MD5: CC17A04F4EAC38461073EB16CD09FC0E
|_ Výrobce:
|_ Procesy
|_ explorer.exe (408)

[!] sdanalogclock3.dll
|_ Cesta: C:\Program Files\Thoosje Sidebar V2.0\SDPlugins\SDAnalogClock3.dll
|_ MD5: D92B43D0D0C9E3456FD32841AE9DA590
|_ Výrobce:
|_ Procesy
|_ Thoosje Sidebar .exe (740)

[!] dxtrash.dll
|_ Cesta: C:\Program Files\Thoosje Sidebar V2.0\SDPlugins\DXTrash.dll
|_ MD5: 5F3A32311CF91192C8DC850E34E92D5C
|_ Výrobce:
|_ Procesy
|_ Thoosje Sidebar .exe (740)

[!] sdmailnotify2.dll
|_ Cesta: C:\Program Files\Thoosje Sidebar V2.0\SDPlugins\SDMailNotify2.dll
|_ MD5: 30F0FBFA435FB73EF82905005234C61B
|_ Výrobce: ?
|_ Procesy
|_ Thoosje Sidebar .exe (740)

[!] npswf32.dll
|_ Cesta: C:\Program Files\Opera\program\plugins\NPSWF32.dll
|_ MD5: 40D0B608BBF9A19F681CCF976D4CA5B9
|_ Výrobce: ?
|_ Procesy
|_ Opera.exe (3220)

[!] lde.dll
|_ Cesta: C:\Documents and Settings\Janitor\Plocha\LDE.dll
|_ MD5: 0F13A4173A599AAA15E3B270E5E27A7F
|_ Výrobce:
|_ Procesy
|_ upm.exe (4032)


Soubor -
================================================================
MD5:


================================================================
Ultimate Process Manager v4.0.0 - [ Lodus Software ]

vysledok 0/33 (0%)

Kde presne su tie infiltracie hlasene?

Rozšiřující informace
File size: 200704 bytes
MD5...: cc17a04f4eac38461073eb16cd09fc0e
SHA1..: 8189dc45fe6ec3e8256159210c0fbca9fb2bcb3c
SHA256: c9dffe400e9d0eb27b910c6b525d00f5ae67ed42c6fc5dd4bd09e1b15801c519
SHA512: f10b55afb4aa406c6942e73e17dc750120483aa7329d6a41f83886c1846acdc2
e9523ae5e7ce14272530639f1fc84caaaf58f1604a5636daad0442ec6f6d91cb
PEiD..: Armadillo v1.xx - v2.xx
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10023f25
timedatestamp.....: 0x4133974b (Mon Aug 30 21:08:27 2004)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2558e 0x26000 6.02 efdfa2792e7e87f56d4f16b831cca163
.rdata 0x27000 0x3183 0x4000 3.91 0786c9d5703d1b58dd0647de856d2aaa
.data 0x2b000 0x3d08 0x2000 4.12 64e81138bfb58e981597ee7850fdbbb1
.rsrc 0x2f000 0xe10 0x1000 3.88 c9b5e1886734fad7734fb3851c2a8c62
.reloc 0x30000 0x2da6 0x3000 6.31 38d19320c802763ca279985c98923be0

( 10 imports )
> SHLWAPI.dll: PathRenameExtensionA, PathFindExtensionA, StrToIntA
> MFC42.DLL: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> MSVCRT.dll: _adjust_fdiv, _initterm, __1type_info@@UAE@XZ, _terminate@@YAXXZ, _except_handler3, _onexit, __dllonexit, _mbsicmp, _cwait, clock, pow, _ftol, memcmp, memset, realloc, malloc, free, __CxxFrameHandler, _purecall, memcpy
> KERNEL32.dll: LoadLibraryA, GetProcAddress, HeapDestroy, IsDBCSLeadByte, lstrcpynA, lstrcmpiA, LoadLibraryExA, GetLastError, FindResourceA, LoadResource, SizeofResource, FreeLibrary, lstrcpyA, GetModuleFileNameA, GetShortPathNameA, MultiByteToWideChar, lstrlenW, InterlockedDecrement, EnterCriticalSection, InterlockedIncrement, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, GetVersion, lstrlenA, lstrcatA, DeviceIoControl, CreateFileA, CloseHandle, GetVersionExA, SetPriorityClass, OpenProcess, Process32Next, Process32First, CreateToolhelp32Snapshot, LocalFree, LocalAlloc, WideCharToMultiByte
> USER32.dll: MessageBoxA, EnumDisplaySettingsA, ChangeDisplaySettingsA, CharNextA
> ADVAPI32.dll: RegEnumKeyExA, RegCreateKeyA, RegQueryValueExA, RegEnumValueA, RegQueryInfoKeyA, RegSetValueExA, RegCreateKeyExA, RegDeleteKeyA, RegOpenKeyExA, RegDeleteValueA, RegCloseKey
> SHELL32.dll: ShellExecuteA
> COMCTL32.dll: -
> ole32.dll: CoTaskMemRealloc, CoTaskMemAlloc, CoTaskMemFree, CoCreateInstance
> OLEAUT32.dll: -, -, -, -, -, -, -

( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer

Toto mi nebolo treba. Kde deteguje Kaspersky tie "viry"?

aha

zjištěno: trojský kůň Trojan-Downloader.JS.Psyme.hx Adresa URL: http://besttopsearch2007.com/counter/in ... t.DCScript

zjištěno: trojský kůň Trojan-Downloader.HTML.Agent.ij Adresa URL: http://iptv.extel.sk/index.php?show=tv&prog=2

zjištěno: trojský kůň Trojan-Downloader.HTML.Agent.ij Soubor: C:\Documents and Settings\Janitor\Data aplikací\Opera\Opera\profile\cache4\opr1ZBXW.htm

Vyzera to, ze su stale stahovane z internetu. Vymaz cache javy a preskenuj pc ESET Online Scannerom.