|
| |||||||
| Registrovať | Site Spy | Zoznam členov | Darovanie | Hľadať | Dnešné príspevky | Označiť témy ako prečítané | Pravidlá fóra |
 |
 |
| | Thread Tools |
|
#1
16. októbra 2008, 09:51
| |||
| |||
| Ať dělám nemůžu zbavit TROJAN.VUNDO.H Som sa pokúsil niekoľkokrát s Malwarebytes vypustiť VUNDO.H vírus. Je vyzve k restartu a běhám Malwarebytes opäť len nájsť, že je stále v systéme. Tiež som si vypnúť obnovenia systému pred začatím týchto. Ďakujeme za vašu pomoc! |
|
#2
16. októbra 2008, 11:27
| |||
| |||
| Ať dělám nemůžu zbavit TROJAN.VUNDO.H HijackThis a vyberte Otvoriť Do systému kontrolovať len. Umiestnite zatržítko vedľa týchto poznámok: (ak existuje)
Koniec HijackThis. ---------- Stiahnuť OTMoveIt2 by Oldtimer a uložiť ho do svojho Desktop. Poznámka: Ak prevádzkujete na Vista, právo-kliknite na OTMoveIt2.exe a vyberte Spustiť ako správca. 1. Double-kliknite OTMoveIt2.exe spustite. 2. Skopírujte riadky v codebox nižšie. Kód: [zabít explorer] C: \ WINDOWS \ SYSTEM32 \ digestp.dll EmptyTemp [start explorer] 4. Kliknutím na červenú Moveit! tlačidlo. 5. Kopírovať všetko v okne Výsledky (v rámci zelenej bar) a vložte ho do vašej ďalšej odpoveď. 6. Zavrieť OTMoveIt2 Poznámka: Ak súbor alebo priečinok nedá presunúť okamžite môžete byť vyzvaní na reštartovanie počítača za účelom ukončenia procesu prechodu. Je-li vyzvaní k reštartu, vyberte Áno. Ak sa tak nestane, reštartujte rovnako.
__________________  |
|
#3
16. októbra 2008, 12:39
| |||
| |||
| Ať dělám nemůžu zbavit TROJAN.VUNDO.H Tak som všetko, čo vyslaný. O únos šel pokutu a 2 súbory sú zmazané. V OTMOVEIT2 program - I skopírovali 4 riadky [zabít explorer] C: \ WINDOWS \ SYSTEM32 \ digestp.dll EmptyTemp [start explorer pod žltou bar a vybraných moveit. Podľa zelené políčko programy povedal preskúmala usmrtia úspešne však mám chybu okna. Povedal OTMOVEIT2 OTMOVEIT2.EXE - Zlý obraz Aplikácia alebo knižnica DLL C: \ Windows \ rakxhfy.dll nie je platný okná obrázku. Prosíme, skontrolujte túto proti installtion disk. Musel som restart a OTMOVEIT prišli znovu a ja som prišiel na rovnakú chybu ako dialóg vyššie. Ako sa môžem zbaviť tohto OTMOVEIT2, keď reboots. Existuje niečo iného, že je potrebné urobiť? |
|
#4
16. októbra 2008, 12:45
| |||
| |||
| Ať dělám nemůžu zbavit TROJAN.VUNDO.H Áno, existuje viac robiť. Nerobte si starosti sa chybové hlásenie ... Stiahnuť náhodný systém informačný nástroj (rsit) náhodnými / náhodne a uložte ho na plochu.
__________________ |
|
#5
16. októbra 2008, 13:26
| |||
| |||
| Ať dělám nemůžu zbavit TROJAN.VUNDO.H log.txt: Váš súbor 28.7 KB bytes presahuje fóra limit 19,5 KB pre tento typ súborov. Musel som WinZip log súboru na to, aby sa vám to cdonstraints z COMPUTER JUICE zablokovanie súbory. |
|
#6
16. októbra 2008, 13:34
| |||
| |||
| Ať dělám nemůžu zbavit TROJAN.VUNDO.H LOG FILE Logfile náhodných systém informačný nástroj 1,04 (písomná náhodnými / náhodný) Úcastníkov Vlastník v 2008-10-16 15:56:08 Microsoft Windows XP Home Edition Service Pack 3 Systémovej jednotke C: má 136 GB (92%) bez 149 GB Celkom RAM: 382 MB (30% free) Logfile Trend Micro HijackThis v2.0.2 Scan uložené v 3:56:33 PM na 10.16.2008 Platforma: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Zavádzacia mód: Normálny Bežiace procesy: C: \ WINDOWS \ System32 \ Smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ Services.exe C: \ WINDOWS \ system32 \ lsass.exe C: \ WINDOWS \ system32 \ Ati2evxx.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe C: \ WINDOWS \ system32 \ Ati2evxx.exe C: \ WINDOWS \ Explorer.exe C: \ WINDOWS \ system32 \ Spoolsv.exe C: \ Program Files \ Symantec \ LiveUpdate \ AluSchedulerSvc.exe C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe C: \ Program Files \ Ahead \ InCD \ InCDsrv.exe C: \ Program Files \ Common Files \ Microsoft Shared \ VS7DEBUG \ MDM.EXE C: \ Program Files \ Common Files \ Nová Hraničné \ PrismXL \ PRISMXL.SYS C: \ Program Files \ QuickTime \ qttask.exe C: \ Program Files \ Adobe \ Photoshop Album Odľahčenú Edition \ 3.0 \ Apps \ apdproxy.exe C: \ Program Files \ Common Files \ Real \ Update_OB \ realsched.exe C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe C: \ Program Files \ Messenger \ Msmsgs.exe C: \ WINDOWS \ system32 \ Ctfmon.exe C: \ Program Files \ SuperAntiSpyware \ SUPERAntiSpyware.exe C: \ Program Files \ Olympus \ DeviceDetector \ DevDtct2.exe C: \ Program Files \ Google \ Google Updater \ GoogleUpdater.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ Program Files \ Internet Explorer \ iexplore.exe C: \ Documents and Settings \ Vlastník \ Local Settings \ Temporary Internet Files \ Content.IE5 \ 6QBVSP54 \ rsit [1]. Exe C: \ Program Files \ Common Files \ Symantec Shared \ CoH \ coh32.exe C: \ Program Files \ Trend Micro \ HijackThis \ Owner.exe R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.emachines.com/ R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll O2 - BHO: RealPlayer Download a Record Plugin pre Internet Explorer - (3049C3E9-B461-4BC5-8870-4C09146192CA) - C: \ Program Files \ Real \ RealPlayer \ rpbrowserrecordplugin.dll O2 - BHO: NCO 2.0 IE BHO - (602ADB0E-4AFF-4217-8AA1-95DAC4DFA408) - C: \ Program Files \ Common Files \ Symantec Shared \ coShared \ Browser \ 2.6 \ coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - (6D53EC84-6AAE-4787-AEEE-F4628F01010C) - C: \ PROGRA ~ 1 \ Common ~ 1 \ SYMANT ~ 1 \ IDS \ IPSBHO.dll O2 - BHO: Google Toolbar Helper - (AA58ED58-01DD-4d91-8333-CF10577473F7) - c: \ program files \ google \ googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Program Files \ Google \ GoogleToolbarNotifier \ 3.1.807.1746 \ sw g.dll O2 - BHO: (bez názvu) - (D6EEB0C3-825E-4FBC-BE0F-38CD08E932FE) - c: \ windows \ system32 \ digestp.dll O3 - Toolbar: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C: \ Program Files \ Yahoo! \ Companion \ Inštalácia \ CPN \ yt.dll O3 - Toolbar: & Google - (2318C2B1-4965-11D4-9B18-009027A5CD4F) - c: \ program files \ google \ googletoolbar1.dll O3 - Toolbar: Zobraziť Norton Toolbar - (7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA) - C: \ Program Files \ Common Files \ Symantec Shared \ coShared \ Browser \ 2.6 \ CoIEPlg.dll O4 - HKLM \ .. \ Run: [QuickTime Úloha] "C: \ Program Files \ QuickTime \ qttask.exe"-atboottime O4 - HKLM \ .. \ Run: [Adobe Foto Downloader] "C: \ Program Files \ Adobe \ Photoshop Album Odľahčenú Edition \ 3.0 \ Apps \ apdproxy.exe" O4 - HKLM \ .. \ Run: [Adobe Reader Speed Launcher] "C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ reader_sl.exe" O4 - HKLM \ .. \ Run: [TkBellExe] "C: \ Program Files \ Common Files \ Real \ Update_OB \ realsched.exe"-osboot O4 - HKLM \ .. \ Run: [ccApp] "C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe" O4 - HKLM \ .. \ Run: [osCheck] "C: \ Program Files \ Norton 360 \ osCheck.exe" O4 - HKCU \ .. \ Run: [MSMSGS] "C: \ Program Files \ Messenger \ Msmsgs.exe" / pozadia O4 - HKCU \ .. \ Run: [Cttfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe O4 - HKCU \ .. \ Run: [SuperAntiSpyware] C: \ Program Files \ SuperAntiSpyware \ SUPERAntiSpyware.exe O4 - Global spustení: Zariadenia detektor 3.lnk = C: \ Program Files \ Olympus \ DeviceDetector \ DevDtct2.exe O4 - Global spustení: Google Updater.lnk = C: \ Program Files \ Google \ Google Updater \ GoogleUpdater.exe O4 - Global spustení: Microsoft Office.lnk = C: \ Program Files \ Microsoft Office \ Office \ OSA9.EXE O8 - Extra kontextového menu položku: E & xportovať do programu Microsoft Excel - res: / / C: \ PROGRA ~ 1 \ micros ~ 2 \ Office11 \ EXCEL.EXE/3000 O9 - Extra tlačidlá: Výskum - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 1 \ micros ~ 2 \ Office11 \ REFIEBAR.DLL O9 - Extra tlačidlá: Real.com - (CD67F990-D8E9-11D2-98FE-00C0F0318AFE) - C: \ WINDOWS \ system32 \ Shdocvw.dll O9 - Extra tlačidlá: (bez názvu) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostické \ xpnetdiag.exe O9 - Extra 'Tools' MENUITEM: @ xpsp3res.dll, -20001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostické \ xpnetdiag.exe O9 - Extra tlačidlá: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ Msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ Msmsgs.exe O16 - DPF: (215B8138-A3CF-44C5-803F-8226143CFC0A) (Trend Micro ActiveX Scan Agent 6.6) -- http://housecall65.trendmicro.com/ho...vex/hcImpl.cab O16 - DPF: (2D8ED06D-3C30-438B-96AE-4D110FDC1FB8) (ActiveScan 2.0 Installer Class) -- http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: (6414512B-B978-451D-A0D8-FCFDF33E833C) (WUWebControl Class) -- http://www.update.microsoft.com/wind...?1211623928390 O16 - DPF: (6E32070A-766D-4EE6-879C-DC1FA91D2FC3) (MUWebControl Class) -- http://www.update.microsoft.com/micr...?1211630845500 O16 - DPF: (D27CDB6E-AE6D-11CF-96B8-444553540000) (Shockwave Flash Object) -- http://fpdownload2.macromedia.com/ge...sh/swflash.cab O20 - Winlogon Upozornenie:! SASWinLogon - C: \ Program Files \ SuperAntiSpyware \ SASWINLO.dll O20 - Winlogon Upozornenie: paubftzz - C: \ WINDOWS \ SYSTEM32 \ digestp.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc - C: \ WINDOWS \ system32 \ Ati2evxx.exe O23 - Service: Plánovač automatické LiveUpdate - Symantec Corporation - C: \ Program Files \ Symantec \ LiveUpdate \ AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe O23 - Service: Symantec Lic NetConnect služby (CLTNetCnService) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ VAScanner \ comHost.exe O23 - Service: Google Updater Service (gusvc) - Google - C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C: \ Program Files \ Ahead \ InCD \ InCDsrv.exe O23 - Service: LiveUpdate - Symantec Corporation - C: \ Program Files \ Symantec \ LiveUpdate \ LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe O23 - Service: PrismXL - Nová Hraničné Technologies, Inc - C: \ Program Files \ Common Files \ Nová Hraničné \ PrismXL \ PRISMXL.SYS O23 - Service: Symantec Core LC - Neznámy vlastník - C: \ PROGRA ~ 1 \ Common ~ 1 \ SYMANT ~ 1 \ CCPD-LC \ symlcsvc.exe -- Koniec súboru - 7993 bytes ====== ====== Priečinok Naplánované úlohy C: \ WINDOWS \ úlohy \ Automatické Úplné Backup.job C: \ WINDOWS \ úlohy \ Denný Změnil Files.job C: \ WINDOWS \ úlohy \ PEACTREE TÝŽDENNÉ SPÄŤ UP.job ====== Registry výpisem ====== [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Explorer \ Browser Helper Objects \ (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3)] Adobe PDF Reader Link Helper - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll [2006-10-23 62080] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Explorer \ Browser Helper Objects \ (3049C3E9-B461-4BC5-8870-4C09146192CA)] RealPlayer Sťahovanie a Record Plugin pre Internet Explorer - C: \ Program Files \ Real \ RealPlayer \ rpbrowserrecordplugin.dll [2008-04-19 308856] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Explorer \ Browser Helper Objects \ (602ADB0E-4AFF-4217-8AA1-95DAC4DFA408)] C: \ Program Files \ Common Files \ Symantec Shared \ coShared \ Browser \ 2.6 \ coIEPlg.dll [2008-06-30 349552] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Explorer \ Browser Helper Objects \ (6D53EC84-6AAE-4787-AEEE-F4628F01010C)] Symantec Intrusion Prevention - C: \ PROGRA ~ 1 \ Common ~ 1 \ SYMANT ~ 1 \ IDS \ IPSBHO.dll [2008-10-16 116088] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Explorer \ Browser Helper Objects \ (AA58ED58-01DD-4d91-8333-CF10577473F7)] Google Toolbar Helper - C: \ Program Files \ google \ googletoolbar1.dll [2007-06-04 2554944] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Explorer \ Browser Helper Objects \ (AF69DE43-7D58-4638-B6FA-CE66B5AD205D)] Oznamovač Google Toolbar BHO - C: \ Program Files \ Google \ GoogleToolbarNotifier \ 3.1.807.1746 \ sw g.dll [2008-09-26 737776] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Explorer \ Browser Helper Objects \ (D6EEB0C3-825E-4FBC-BE0F-38CD08E932FE)] c: \ windows \ system32 \ digestp.dll [2004-08-04 105984] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ Toolbar] (EF99BD32-C1FB-11D2-892F-0090271D4F88) - Yahoo! Toolbar - C: \ Program Files \ Yahoo! \ Companion \ Inštalácia \ CPN \ yt.dll [2005-08-04 343112] (2318C2B1-4965-11D4-9B18-009027A5CD4F) - & Google - c: \ program files \ google \ googletoolbar1.dll [2007-06-04 2554944] ID (7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA) - Zobraziť Norton Toolbar - C: \ Program Files \ Common Files \ Symantec Shared \ coShared \ Browser \ 2.6 \ CoIEPlg.dll [2008-06-30 349552] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ Curr entVersion \ Run] "QuickTime Úloha" = C: \ Program Files \ QuickTime \ qttask.exe [2005-01-28 98304] "Adobe Foto Downloader" = C: \ Program Files \ Adobe \ Photoshop Album Odľahčenú Edition \ 3.0 \ Apps \ apdproxy.exe [2005-06-06 57344] "Adobe Reader Speed Launcher" = C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ reader_sl.exe [2008-01-11 39792] "TkBellExe" = C: \ Program Files \ Common Files \ Real \ Update_OB \ realsched.exe [2008-04-19 185896] "ccApp" = C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe [2008-02-18 51048] "osCheck" = C: \ Program Files \ Norton 360 \ osCheck.exe [2008-02-26 988512] [HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ Curr ntVersion \ Run] "MSMSGS" = C: \ Program Files \ Messenger \ Msmsgs.exe [2008-04-13 1695232] "Ctfmon.exe" = C: \ WINDOWS \ system32 \ Ctfmon.exe [2008-04-13 15360] "SuperAntiSpyware" = C: \ Program Files \ SuperAntiSpyware \ SUPERAntiSpyware.exe [2008-05-28 1506544] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ ATIPTA] C: \ Program Files \ ATI Technologies \ ATI Control Panel \ atiptaxx.exe [2004-11-12 344064] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ ccApp] C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe [2008-02-18 51048] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ CHotkey] C: \ WINDOWS \ zHotkey.exe [2004-05-17 543232] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe [2008-04-13 15360] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ InCD] C: \ Program Files \ Ahead \ InCD \ InCD.exe [2003-09-01 1200178] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ MSMSGS] C: \ Program Files \ Messenger \ Msmsgs.exe [2008-04-13 1695232] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ NeroCheck] C: \ WINDOWS \ system32 \ \ NeroCheck.exe [2001-07-09 155648] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ NeroFilterCheck] C: \ WINDOWS \ system32 \ NeroCheck.exe [2001-07-09 155648] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ Recguard] C: \ WINDOWS \ SMINST \ RECGUARD.EXE [2002-09-13 212992] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ RemoteControl] C: \ Program Files \ Cyberlink \ PowerDVD \ PDVDServ.exe [2003-10-31 32768] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ ShowWnd] C: \ WINDOWS \ ShowWnd.exe [2003-09-19 36864] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ SoundMan] C: \ WINDOWS \ SOUNDMAN.EXE [2004-11-15 77824] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ SunKistEM] C: \ Program Files \ Digital Media Reader \ shwiconem.exe [2004-11-15 135168] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ UpdateManager] C: \ Program Files \ Common Files \ Sonic \ Update Manager \ sgtray.exe [2003-08-19 110592] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupfolder \ C: ^ Documents and Settings ^ All Users ^ Ponuka Štart ^ Programy ^ Po spuštění ^ BigFix.lnk] C: \ PROGRA ~ 1 \ BigFix \ BigFix.exe [2002-07-31 1742384] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupfolder \ C: ^ Documents and Settings ^ All Users ^ Ponuka Štart ^ Programy ^ Po spuštění ^ Microsoft Office.lnk] C: \ PROGRA ~ 1 \ micros ~ 2 \ Office \ OSA9.EXE [2000-01-21 65588] C: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Startup Zariadenia detektor 3.lnk - C: \ Program Files \ Olympus \ DeviceDetector \ DevDtct2.exe Google Updater.lnk - C: \ Program Files \ Google \ Google Updater \ GoogleUpdater.exe Microsoft Office.lnk - C: \ Program Files \ Microsoft Office \ Office \ OSA9.EXE [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ Informujte \! SASWinLogon] C: \ Program Files \ SuperAntiSpyware \ SASWINLO.dll [2007-04-19 294912] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ Informujte \ AtiExtEvent] C: \ WINDOWS \ system32 \ Ati2evxx.dll [2006-02-21 61440] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ Informujte \ paubftzz] C: \ WINDOWS \ system32 \ digestp.dll [2004-08-04 105984] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ ShellServiceObjectDelayLoad] UPnPMonitor - (e57ce738-33e8-4c51-8354-bb4de9d215d1) - C: \ WINDOWS \ system32 \ upnpui.dll [2008-04-13 239616] WPDShServiceObj - (AAA288BA-9A4C-45B0-95D7-94D524869DB5) - C: \ WINDOWS \ system32 \ WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Explorer \ ShellExecuteHooks] "(5AE067D3-9AFB-48E0-853A-EBB7F4A000DA)" = C: \ Program Files \ SuperAntiSpyware \ SASSEH.DLL [2008-05-13 77824] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ Curr entVersion \ Policies \ System] "dontdisplaylastusername" = 0 "legalnoticecaption" = "legalnoticetext" = "shutdownwithoutlogon" = 1 "undockwithoutlogon" = 1 [HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ Curr ntVersion \ Policies \ Explorer] "NoDriveTypeAutoRun" = 145 [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Servic es \ sharedaccess \ Parameters \ firewallpolicy \ štandardný profil \ authorizedapplications \ list] "% Windir% \ system32 \ Sessmgr.exe" = "% windir% \ system32 \ Sessmgr.exe: *: Enabled: @ xpsp2res.dll, -22019" "C: \ Program Files \ Common Files \ AOL \ ACS \ AOLDial.exe" = "C: \ Program Files \ Common Files \ AOL \ ACS \ AOLDial.exe: *: Enabled: AOL" "C: \ Program Files \ Common Files \ AOL \ ACS \ AOLacsd.exe" = "C: \ Program Files \ Common Files \ AOL \ ACS \ AOLacsd.exe: *: Enabled: AOL" "C: \ Program Files \ America Online 9.0 \ waol.exe" = "C: \ Program Files \ America Online 9.0 \ waol.exe: *: Enabled: America Online 9.0" "% Windir% \ Network Diagnostické \ xpnetdiag.exe" = "% windir% \ Network Diagnostické \ xpnetdiag.exe: *: Enabled: @ xpsp3res.dll, -20000" "C: \ Program Files \ Internet Explorer \ iexplore.exe" = "C: \ Program Files \ Internet Explorer \ iexplore.exe: *: Zdravotne postihnutí: Internet Explorer" "C: \ WINDOWS \ LMI42.tmp \ lmi_rescue.exe" = "C: \ WINDOWS \ LMI42.tmp \ lmi_rescue.exe: *: Enabled: LogMeIn Rescue" [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Servic es \ sharedaccess \ Parameters \ firewallpolicy \ domainpr ofile \ authorizedapplications \ list] "% Windir% \ system32 \ Sessmgr.exe" = "% windir% \ system32 \ Sessmgr.exe: *: Enabled: @ xpsp2res.dll, -22019" "C: \ Program Files \ Common Files \ AOL \ ACS \ AOLDial.exe" = "C: \ Program Files \ Common Files \ AOL \ ACS \ AOLDial.exe: *: Enabled: AOL" "C: \ Program Files \ Common Files \ AOL \ ACS \ AOLacsd.exe" = "C: \ Program Files \ Common Files \ AOL \ ACS \ AOLacsd.exe: *: Enabled: AOL" "C: \ Program Files \ America Online 9.0 \ waol.exe" = "C: \ Program Files \ America Online 9.0 \ waol.exe: *: Enabled: America Online 9.0" "% Windir% \ Network Diagnostické \ xpnetdiag.exe" = "% windir% \ Network Diagnostické \ xpnetdiag.exe: *: Enabled: @ xpsp3res.dll, -20000" [HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ curry ntversion \ explorer \ mountpoints2 \ (4f63278d-8557-11d9-be24-806d6172696f)] shell \ AutoRun \ command - C: \ WINDOWS \ system32 \ rundll32.exe Shell32.dll, ShellExec_RunDLL Info.exe Folder.htt 480 480 [HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ curry ntversion \ explorer \ mountpoints2 \ (e1ec6b61-710a-11d9-B301-806d6172696f)] shell \ AutoRun \ command - C: \ WINDOWS \ system32 \ rundll32.exe Shell32.dll, ShellExec_RunDLL Info.exe Folder.htt 480 480 ====== Zoznam súborov a priečinkov vytvorených v poslednej 1 mesiac ====== 2008-10-16 15:56:08 ---- D ---- C: \ rsit 2008-10-16 15:19:05 ---- D ---- C: \ _OTMoveIt 2008-10-16 14:07:16 ---- D ---- C: \ Program Files \ Panda Bezpečnosť 2008-10-16 13:48:04 ---- A ---- C: \ WINDOWS \ system32 \ CF23987.exe 2008-10-16 13:47:57 ---- A ---- C: \ Bug.txt 2008-10-16 13:20:06 ---- D ---- C: \ VundoFix zálohovanie 2008-10-16 13:20:06 ---- A ---- C: \ VundoFix.txt 2008-10-16 12:26:25 ---- D ---- C: \ Documents and Settings \ All Users \ Data aplikací \ SUPERAntiSpyware.com 2008-10-16 12:25:40 ---- D ---- C: \ Program Files \ SuperAntiSpyware 2008-10-16 12:25:39 ---- D ---- C: \ Documents and Settings \ Vlastník \ Data aplikací \ SUPERAntiSpyware.com 2008-10-16 12:25:12 ---- D ---- C: \ Program Files \ Common Files \ Wise Sprievodca inštaláciou 2008-10-16 11:20:45 ---- HDC ---- C: \ WINDOWS \ $ NtUninstallKB956803 $ 2008-10-16 11:20:36 ---- HDC ---- C: \ WINDOWS \ $ NtUninstallKB956391 $ 2008-10-16 11:20:27 ---- HDC ---- C: \ WINDOWS \ $ NtUninstallKB957095 $ 2008-10-16 11:17:11 ---- HDC ---- C: \ WINDOWS \ $ NtUninstallKB954211 $ 2008-10-16 11:16:54 ---- HDC ---- C: \ WINDOWS \ $ NtUninstallKB956841 $ 2008-10-16 11:08:22 ---- D ---- C: \ WINDOWS \ system32 \ N360_BACKUP 2008-10-16 10:48:03 ---- DC ---- C: \ WINDOWS \ system32 \ DRVSTORE 2008-10-16 10:47:42 ---- D ---- C: \ Documents and Settings \ All Users \ Data aplikací \ () 3276BE95_AF08_429F_A64F_CA64CB79BCF6 2008-10-16 10:24:37 ---- D ---- C: \ Program Files \ Windows Bočný panel 2008-10-16 10:24:06 ---- D ---- C: \ Program Files \ Norton 360 2008-10-16 10:22:49 ---- A ---- C: \ WINDOWS \ system32 \ S32EVNT1.DLL 2008-10-15 17:26:20 ---- D ---- C: \ Program Files \ NoNAV 2008-10-15 16:41:28 ---- D ---- C: \ SymNoNav 2008-10-15 16:22:38 ---- D ---- C: \ WINDOWS \ LMI42.tmp 2008-10-15 15:10:33 ---- D ---- C: \ Program Files \ Trend Micro 2008-10-11 12:25:41 ---- D ---- C: \ WINDOWS \ nedeľa 2008-10-11 12:25:41 ---- D ---- C: \ Documents and Settings \ Vlastník \ Data aplikací \ nedeľa 2008-10-11 12:00:57 ---- D ---- C: \ Program Files \ CCleaner 2008-10-11 11:38:42 ---- D ---- C: \ Documents and Settings \ Vlastník \ Data aplikací \ Malwarebytes 2008-10-11 11:38:37 ---- D ---- C: \ Program Files \ Malwarebytes' Anti-Malware 2008-10-11 11:38:37 ---- D ---- C: \ Documents and Settings \ All Users \ Data aplikací \ Malwarebytes ====== Zoznam súborov a priečinkov upravil v poslednej 1 mesiac ====== 2008-10-16 15:44:12 ---- D ---- C: \ Program Files \ Common Files \ Symantec Zdieľaná 2008-10-16 15:43:38 ---- D ---- C: \ WINDOWS \ Temp 2008-10-16 15:27:24 ---- D ---- C: \ WINDOWS \ system32 \ CatRoot2 2008-10-16 15:25:42 ---- A ---- C: \ WINDOWS \ SchedLgU.Txt 2008-10-16 15:12:27 ---- A ---- C: \ WINDOWS \ hpbafd.ini 2008-10-16 15:12:19 ---- A ---- C: \ WINDOWS \ system32 \ NTS5CSET.INI 2008-10-16 15:05:13 ---- D ---- C: \ WINDOWS 2008-10-16 14:13:35 ---- D ---- C: \ WINDOWS \ system32 \ drivers 2008-10-16 14:07:16 ---- RD ---- C: \ Program Files 2008-10-16 14:07:16 ---- HD ---- C: \ WINDOWS \ inf 2008-10-16 14:06:35 ---- SD ---- C: \ WINDOWS \ Downloaded Program Files 2008-10-16 13:49:56 ---- D ---- C: \ Documents and Settings \ All Users \ Data aplikací \ Google Updater 2008-10-16 13:48:11 ---- D ---- C: \ WINDOWS \ system32 2008-10-16 12:26:10 ---- SHD ---- C: \ WINDOWS \ Installer 2008-10-16 12:25:12 ---- D ---- C: \ Program Files \ Common Files 2008-10-16 11:50:16 ---- D ---- C: \ WINDOWS \ Minidump 2008-10-16 11:50:16 ---- D ---- C: \ WINDOWS \ Debug 2008-10-16 11:20:47 ---- RSHDC ---- C: \ WINDOWS \ system32 \ dllcache 2008-10-16 11:20:43 ---- HD ---- C: \ WINDOWS \ $ hf_mig $ 2008-10-16 11:20:07 ---- D ---- C: \ Program Files \ Internet Explorer 2008-10-16 11:19:54 ---- D ---- C: \ WINDOWS \ ie7updates 2008-10-16 11:19:07 ---- A ---- C: \ WINDOWS \ win.ini 2008-10-16 11:08:11 ---- D ---- C: \ Documents and Settings \ Vlastník \ Data aplikací \ Symantec 2008-10-16 11:04:17 ---- D ---- C: \ Program Files \ Symantec 2008-10-16 11:01:12 ---- D ---- C: \ Documents and Settings \ All Users \ Data aplikací \ Symantec 2008-10-16 10:46:55 ---- D ---- C: \ WINDOWS \ Prefetch 2008-10-15 17:42:01 ---- D ---- C: \ Documents and Settings 2008-10-15 15:38:45 ---- D ---- C: \ WINDOWS \ winsxs 2008-10-15 15:38:45 ---- D ---- C: \ Program Files \ Common Files \ Microsoft Shared 2008-10-15 14:55:27 ---- D ---- C: \ WINDOWS \ system32 \ Obnoviť 2008-10-15 13:23:32 ---- A ---- C: \ WINDOWS \ PCW120.ini 2008-10-15 13:23:22 ---- D ---- C: \ SHARED 2008-10-14 14:58:10 ---- D ---- C: \ Shard 2008-10-11 11:30:23 ---- SHD ---- C: \ System Volume Information 2008-10-07 15:19:40 ---- A ---- C: \ WINDOWS \ system32 \ MRT.exe 2008-10-03 13:41:15 ---- A ---- C: \ WINDOWS \ system32 \ ieframe.dll 2008-09-24 08:36:56 ---- D ---- C: \ Program Files \ Common Files \ Peach ====== Zoznam vodiči (R = Spúšťanie, S = Zastavené, 0 = Zavádzacia, 1 = System, 2 = Auto, 3 = Demand, 4 = Zakázané )====== R1 AmdPPM; HwPState Procesor AMD Driver, C: \ WINDOWS \ system32 \ DRIVERS \ AmdPPM.sys [2007-04-16 33792] R1 eeCtrl; Symantec Eraser kontrolu vodiča; \? \ C: \ Program Files \ Common Files \ Symantec Shared \ EENGINE \ eeCtrl.sys [] R1 InCDPass; InCDPass, C: \ WINDOWS \ system32 \ DRIVERS \ InCDPass.sys [2003-09-01 28528] R1 incdrm; EasyWrite InCD Reader; C: \ WINDOWS \ system32 \ drivers \ incdrm.sys [2003-08-21 25520] R1 SASDIFSV; SASDIFSV; \? \ C: \ Program Files \ SuperAntiSpyware \ SASDIFSV.SYS [] R1 SASKUTIL; SASKUTIL; \? \ C: \ Program Files \ SuperAntiSpyware \ SASKUTIL.sys [] R1 SPBBCDrv; SPBBCDrv; \? \ C: \ Program Files \ Common Files \ Symantec Shared \ SPBBC \ SPBBCDrv.sys [] R1 SRTSPX; SRTSPX, C: \ WINDOWS \ System32 \ Drivers \ SRTSPX.SYS [2008-01-31 43696] R1 SYMTDI; SYMTDI, C: \ WINDOWS \ System32 \ Drivers \ SYMTDI.SYS [2008-06-13 184240] R2 CO_Mon; CO_Mon; \? \ C: \ WINDOWS \ system32 \ drivers \ CO_Mon.sys [] R2 mdmxsdk; mdmxsdk, C: \ WINDOWS \ system32 \ DRIVERS \ mdmxsdk.sys [2004-03-17 13059] R2 tmcomm; tmcomm; \? \ C: \ WINDOWS \ system32 \ drivers \ tmcomm.sys [] R3 ALCXWDM; Tlačové Realtek AC97 Audio (WDM), C: \ WINDOWS \ system32 \ drivers \ ALCXWDM.SYS [2004-11-18 2297664] R3 Arp1394; 1394 ARP klienta protokolu, C: \ WINDOWS \ system32 \ DRIVERS \ arp1394.sys [2008-04-13 60800] R3 ati2mtag; ati2mtag, C: \ WINDOWS \ system32 \ DRIVERS \ ati2mtag.sys [2006-02-21 1505792] R3 COH_Mon; COH_Mon; \? \ C: \ WINDOWS \ system32 \ Drivers \ COH_Mon.sys [] R3 EraserUtilRebootDrv; EraserUtilRebootDrv; \? \ C: \ Program Files \ Common Files \ Symantec Shared \ EENGINE \ EraserUtilRebootDrv.sys [] R3 GEARAspiWDM; GEAR ASPI ovládač filtrov, C: \ WINDOWS \ System32 \ Drivers \ GEARAspiWDM.sys [2008-04-17 15464] R3 HSF_DP; HSF_DP, C: \ WINDOWS \ system32 \ DRIVERS \ HSF_DP.sys [2004-06-17 1041536] R3 HSFHWBS2; HSFHWBS2, C: \ WINDOWS \ system32 \ DRIVERS \ HSFHWBS2.sys [2004-06-17 220032] R3 NAVENG; NAVENG; \? \ C: \ PROGRA ~ 1 \ Common ~ 1 \ SYMANT ~ 1 \ VIRUSD ~ 1 \ 2008101 6.004 \ NAVENG.SYS [] R3 NAVEX15; NAVEX15; \? \ C: \ PROGRA ~ 1 \ Common ~ 1 \ SYMANT ~ 1 \ VIRUSD ~ 1 \ 2008101 6.004 \ NAVEX15.SYS [] R3 NIC1394; 1394 Čistá Driver, C: \ WINDOWS \ system32 \ DRIVERS \ nic1394.sys [2008-04-13 61824] R3 RTL8139; Realtek RTL8139 (A / B / C)-založené PCI Fast Ethernet Adapter NT Driver; C: \ WINDOWS \ system32 \ DRIVERS \ RTL8139.SYS [2004-08-04 20992] R3 SASENUM; SASENUM; \? \ C: \ Program Files \ SuperAntiSpyware \ SASENUM.SYS [] R3 SRTSP; SRTSP, C: \ WINDOWS \ System32 \ Drivers \ SRTSP.SYS [2008-01-31 279088] R3 SunkFilt; Alcor Micro Reader Corp; \? \ C: \ WINDOWS \ System32 \ Drivers \ sunkfilt.sys [] R3 SYMDNS; SYMDNS, C: \ WINDOWS \ System32 \ Drivers \ SYMDNS.SYS [2008-06-13 13616] R3 SymEvent; SymEvent; \? \ C: \ WINDOWS \ system32 \ Drivers \ SYMEVENT.SYS [] R3 SYMFW; SYMFW, C: \ WINDOWS \ System32 \ Drivers \ SYMFW.SYS [2008-06-13 96432] R3 SYMIDS; SYMIDS, C: \ WINDOWS \ System32 \ Drivers \ SYMIDS.SYS [2008-06-13 38576] R3 SYMIDSCO; SYMIDSCO; \? \ C: \ PROGRA ~ 1 \ Common ~ 1 \ SYMANT ~ 1 \ SymcData \ ipsdefs \ 20081014.001 \ SymIDSCo.sys [] R3 SymIMMP; SymIMMP, C: \ WINDOWS \ system32 \ DRIVERS \ SymIM.sys [2008-06-13 31280] R3 SYMNDIS; SYMNDIS, C: \ WINDOWS \ System32 \ Drivers \ SYMNDIS.SYS [2008-06-13 37424] R3 SYMREDRV; SYMREDRV, C: \ WINDOWS \ System32 \ Drivers \ SYMREDRV.SYS [2008-06-13 22320] R3 usbehci; Microsoft USB 2.0 Rozšírená Host Controller Miniport Driver, C: \ WINDOWS \ system32 \ DRIVERS \ Usbehci.sys [2008-04-13 30208] R3 usbhub; USB2 Povolené Hub, C: \ WINDOWS \ system32 \ DRIVERS \ usbhub.sys [2008-04-13 59520] R3 usbohci; Microsoft USB Open Host Controller Miniport Driver, C: \ WINDOWS \ system32 \ DRIVERS \ usbohci.sys [2008-04-13 17152] R3 USBSTOR; USB Mass Storage Driver; C: \ WINDOWS \ system32 \ DRIVERS \ USBSTOR.SYS [2008-04-13 26368] R3 winachsf; winachsf, C: \ WINDOWS \ system32 \ DRIVERS \ HSF_CNXT.sys [2004-06-17 685056] R4 InCDfs; InCD File System, C: \ WINDOWS \ system32 \ drivers \ InCDfs.sys [2003-09-01 88800] S1 P3; PentiumIII Procesor Intel Driver, C: \ WINDOWS \ system32 \ DRIVERS \ p3.sys [2008-04-13 42752] S3 mosta; MAC most, C: \ WINDOWS \ system32 \ DRIVERS \ bridge.sys [2008-04-13 71552] S3 BridgeMP; Miniport mosta MAC, C: \ WINDOWS \ system32 \ DRIVERS \ bridge.sys [2008-04-13 71552] S3 mxnic; Macronix MX987xx Rodinné Fast Ethernet NT Driver; C: \ WINDOWS \ system32 \ DRIVERS \ mxnic.sys [2001-08-17 19968] S3 nv, nv, C: \ WINDOWS \ system32 \ DRIVERS \ nv4_mini.sys [2004-08-04 1897408] S3 SRTSPL; SRTSPL, C: \ WINDOWS \ System32 \ Drivers \ SRTSPL.SYS [2008-01-31 317616] S3 SymIM; Symantec Network Security Medzispotreba Filter Service, C: \ WINDOWS \ system32 \ DRIVERS \ SymIM.sys [2008-06-13 31280] S3 usbuhci; Microsoft USB Universal Host Controller Miniport Driver, C: \ WINDOWS \ system32 \ DRIVERS \ usbuhci.sys [2008-04-13 20608] S3 VNUSB; VN Series Zariadenia, C: \ WINDOWS \ system32 \ DRIVERS \ VNUSB.sys [2003-12-15 38448] S3 wanatw; WAN Miniport (ATW), C: \ WINDOWS \ system32 \ DRIVERS \ wanatw4.sys [] S3 WudfPf; Windows Driver Foundation - User-módu Driver rámcového Platforma Driver, C: \ WINDOWS \ system32 \ DRIVERS \ WudfPf.sys [2006-09-28 77568] S3 WudfRd; Windows Driver Foundation - User-módu Driver rámcového Reflector; C: \ WINDOWS \ system32 \ DRIVERS \ wudfrd.sys [2006-09-28 82944] S4 sr; Obnovovanie systému Filter Driver, C: \ WINDOWS \ system32 \ DRIVERS \ sr.sys [2008-04-13 73472] ====== List služieb (R = Spúšťanie, S = Zastavené, 0 = Zavádzacia, 1 = System, 2 = Auto, 3 = Demand, 4 = Zakázané )====== R2 Ati Hotkey Poller, Ati Hotkey Poller, C: \ WINDOWS \ system32 \ Ati2evxx.exe [2006-02-21 405504] Automatické R2 LiveUpdate Plánovač; Automatické LiveUpdate Plánovač, C: \ Program Files \ Symantec \ LiveUpdate \ AluSchedulerSvc.exe [2008-02-21 238968] R2 ccEvtMgr; Symantec Event Manager, C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe [2008-02-18 149352] R2 ccSetMgr; Symantec Settings Manager; C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe [2008-02-18 149352] R2 CLTNetCnService; Symantec Lic NetConnect služby, C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe [2008-02-18 149352] R2 gusvc; Google Updater Service; C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe [2007-06-04 138680] R2 InCDsrv; InCD File System Service, C: \ Program Files \ Ahead \ InCD \ InCDsrv.exe [2003-09-01 798772] R2 LiveUpdate Notice; LiveUpdate Notice, C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe [2008-02-18 149352] R2 MDM; Machine Debug Manager; C: \ Program Files \ Common Files \ Microsoft Shared \ VS7DEBUG \ MDM.EXE [2003-06-19 322120] R2 PrismXL; PrismXL, C: \ Program Files \ Common Files \ Nová Hraničné \ PrismXL \ PRISMXL.SYS [2005-01-28 172032] S3 aspnet_state; ASP.NET štátnej službe, C: \ WINDOWS \ Microsoft.NET \ Framework \ v1.1.4322 \ aspn t_state.exe [2004-07-15 32768] S3 comHost KOM Host, C: \ Program Files \ Common Files \ Symantec Shared \ VAScanner \ comHost.exe [2007-08-22 55640] S3 LiveUpdate; LiveUpdate, C: \ Program Files \ Symantec \ LiveUpdate \ LuComServer_3_4.EXE [2008-09-05 3220856] S3 osi; Office Source Engine; C: \ Program Files \ Common Files \ Microsoft Shared \ Source Engine \ Ose.exe [2003-07-28 89136] S3 Symantec Core LC; Symantec Core LC, C: \ PROGRA ~ 1 \ Common ~ 1 \ SYMANT ~ 1 \ CCPD-LC \ symlcsvc.exe [2008-10-16 1245064] S3 WMPNetworkSvc, Windows Media Player siete Zdieľanie Service, C: \ Program Files \ Windows Media Player \ WMPNetwk.exe [2006-10-18 913408] S3 WudfSvc; Windows Driver Foundation - User-módu Driver rámcový, C: \ WINDOWS \ system32 \ svchost.exe [2008-04-13 14336] ----------------- EOF ----------------- |
|
#7
16. októbra 2008, 13:50
| |||
| |||
| Ať dělám nemůžu zbavit TROJAN.VUNDO.H V digestp.dll Stále nie je preč. Po prvé: Stiahnuť Zakázať alebo odstrániť program Windows Messenger na ploche odstrániť Windows Messenger. Don't zmiasť Windows Messenger s MSN Messenger pretože nie sú rovnaké. Windows Messenger je častou príčinou okien. Rozbaľte súbor na plochu. Otvoriť MessengerDisable.exe a vybrať spodnej krabice -- Odinštalovať Windows Messenger a kliknite Použiť. Odísť z MessengerDisable potom odstrániť dva súbory, ktoré boli umiestnené na ploche. ---------- Poznámka: nižšie uvedených pokynov boli vytvorené špeciálne pre tohto užívateľa. Ak si nie ste týmto užívateľom DON'T postupujte podľa týchto pokynov, ktoré by mohli poškodiť chod vášho systému Prejsť na Štart> Spustiť a typ notepad.exe Potom kliknite na OK Skopírujte a vložte nižšie do poznámkového bloku a uložiť ako fixme.reg aby Vaša Desktop Kód: REGEDIT4 [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects \ (D6EEB0C3-825E-4FBC-BE0F-38CD08E932FE)] [-HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ MSMSGS] [-- HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ Informujte \ paubftzz] Uistite sa, že by ste mi povedať, keď dostane správu o úspechu pripočítaním vyššie do registra. Ak nebudete mať úspech správa, že nefunguje. Odstráňte fixme.reg od Desktop. ---------- Váš Java je zastaraný. Staršie verzie zraniteľnosti, ktoré majú škodlivý stránok môžete použiť na infikovať váš počítač. Najprv nainštalovať novú Sun Java Runtime Environment Uistite sa, že zatvorte všetky okná prehľadávača pred začatím inštalácie. Demontujete starú verziu (y) Stiahnuť Javára
Podozrivé súbory na skenovanie Nájdete na VirSCAN.org ZDARMA on-line služby scan (Ak je viac ako jeden súbor musí skenovaná sa musí vykonať samostatne a protokoluje posta pre každé z nich) 1. Skopírujte a prilepte nasledujúcu cestu k súboru do Podozrivé súbory na skenovanie Schránka na hornej časti stránky. Kód: C: \ WINDOWS \ system32 \ CF23987.exe 3. Tlač Ctrl + W na klávesnici (oba súčasne) vložte cestu k súboru do okna. 4. Kliknite na Upload tlačidlo. To sa vykoná vyhľadávanie v niekoľkých rôznych vírusov motory. Váš súbor bude možné do fronty, ktorá zvyčajne trvá menej ako minútu na jasné. Dôležité upozornenie: Počkajte na všetky testovanie motorov dokončiť. 5. Keď je skenovanie dokončené prejdite nadol a kliknite na Kopírovať do schránky tlačidlo. Táto kópia bude odkaz na správu do schránky. 6. Vložiť obsah schránky do budúceho odpoveď. ---------- Po vyslanie VirSCAN.org výsledky. Stiahnuť ATF Cleaner podľa Atribune na ploche. Alternatívny odkaz na stiahnutie Poznámka: Vista užívatelia musia používať Spustiť ako správca
Dôležité upozornenie: Reštartovať počítač, ako budete pokračovať.
__________________ |
|
#8
16. októbra 2008, 14:39
| |||
| |||
| Ať dělám nemůžu zbavit TROJAN.VUNDO.H 1. Úspech v Fixme.reg 2. Potom tu sú 2 log súbory, ktoré ste chceli ma poslať A. javára 1.11 Odstránenie Log. Správa nasledujúci po riadku. ------------------------------------ V javára odstránenie procesu sa začala v októbri Št 16 17:23:09 2008 Nájdené a odstránené: C: \ Windows \ System32 \ jpicpl32.cpl Nájdené a odstránené: C: \ Windows \ Installer \ (7148F0A8-6813-11D6-A77B-00B0D0142000) Nájdené a odstránené: SOFTWARE \ JavaSoft \ Java Runtime Environment \ 1,4 Nájdené a odstránené: SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ uninstal l \ (7148F0A8-6813-11D6-A77B-00B0D0142000) Nájdené a odstránené: SOFTWARE \ Classes \ CLSID \ (CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA) Nájdené a odstránené: SOFTWARE \ Classes \ CLSID \ (CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB) Nájdené a odstránené: SOFTWARE \ Classes \ Installer \ Produkty \ 8A0F841731866D 117AB7000B0D410200 Nájdené a odstránené: SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Install r \ UserData \ S-1-5-18 \ Produkty \ 8A0F841731866D117AB7000B0D410200 Nájdené a odstránené: SOFTWARE \ Classes \ JavaPlugin.142 Nájdené a odstránené: SOFTWARE \ JavaSoft \ Java Plug-in \ 1.4.2 Nájdené a odstránené: SOFTWARE \ JavaSoft \ Java Runtime Environment \ 1.4.2 Nájdené a odstránené: SOFTWARE \ JavaSoft \ Java Web Start \ 1.4.2 Nájdené a odstránené: SOFTWARE \ JavaSoft \ Java Web Start \ 1.0.1 Nájdené a odstránené: SOFTWARE \ JavaSoft \ Java Web Start \ 1.0.1_02 Nájdené a odstránené: SOFTWARE \ JavaSoft \ Java Web Start \ 1.0.1_03 Nájdené a odstránené: SOFTWARE \ JavaSoft \ Java Web Start \ 1.0.1_04 Nájdené a odstránené: SOFTWARE \ JavaSoft \ Java Web Start \ 1,2 Nájdené a odstránené: SOFTWARE \ JavaSoft \ Java Web Start \ 1.2.0_01 ------------------------------------ Skončené správ. Javára 1.11 Odstránenie Log. Správa nasledujúci po riadku. ------------------------------------ V javára odstránenie procesu sa začala v októbri Št 16 17:23:18 2008 ------------------------------------ Skončené správ. B. VirSCAN. Org scanned Správa: Scanned čas: 2008/10/16 17:27:59 (EDT) Scanner výsledky: Všetky Skenery hlásené nenaąli malware! Názov súboru: CF23987.exe Veľkosť súboru: 389120 bajt Typ súboru: PE32 spustitelnému pre MS Windows (konzola) Intel 80386 32-bit MD5: b65faf059812f22a1058ecfcb520e47b SHA1: 8148c039b0f0a166bc1a1801fe6d14716bdcec1f Online správa: http://virscan.org/report/36cd3be0f2...66947033e.html Scanner Engine Ver Ver Sig Sig Čas Scan výsledok a-štvorčekované 4.0.0.16 2008.10.15 2008-10-15 1,54 -- AhnLab V3 ... .. - 0,18 -- AntiVir 7.9.0.5 7.0.7.51 2008-10-16 0,08 -- Anti 2.0.18 20081016,1488960 2008-10-16 0,12 -- Arcavir 1.0.5 200810161244 2008-10-16 1,23 -- Authentium 5.1.1 200810150216 2008-10-15 1,17 -- AVAST! 3.0.1 081015-0 2008-10-15 0,72 -- AVG 7.5.52.442 270.8.1/1728 2008-10-16 1,68 -- BitDefender 7.60825.1875439 7,21294 2008-10-17 3,13 -- CA (VET) 9.0.0.143 31.6.6151 2008-10-16 5,37 -- ClamAV 0.94 8435 2008 -10-17 0.13 -- Comodo 2,11 2.0.0.678 2008-10-16 0,44 -- CP Secure 1.1.0.715 2008.10.17 2008-10-17 6,26 -- Dr.Web 4.44.0.9170 2008.10.16 2008-10-16 3,41 -- Ewido 4.0.0.2 2008.10.16 2008-10-16 2,90 -- F-Prot 4.4.4.56 20081016 2008-10-16 1,19 -- F-Secure 5.51.6100 2008 .10.16.09 2008-10-16 3,55 -- Fortinet 2.81-3.113 9.647 2008-10-15 0.23 -- GData 19.1058/19.65 20081016 2008-10-16 2,65 -- ViRobot 20081016 2008.10.16 2008-10-16 0,40 -- IKARUS T3.1.01.34 2008.10.16.71662 2008-10-16 3,99 -- JiangMin 11.0.706 2008.10.16 2008-10-16 1,26 -- Kaspersky 5.5.10 2008-10-16 2008-10-16 0.04 -- KingSoft 2008.9.8.18 2008.10.16.17 2008-10-16 0,66 -- McAfee 5.3.00 5406 2008-10-15 2,13 -- Microsoft 1.4005 2008-10-16 2008-10-16 3.93 -- mks_vir 2,01 2008.10.16 2008-10-16 2,75 -- Norman 5.93.01 5.93.00 2008-10-16 5,21 -- Panda 9.05.01 2008.10.16 2008-10-16 2,28 -- Trend Micro 8.700-1004 5.604.11 2008-10-16 0,03 -- Quick Liečiť 9,50 2008.10.16 2008-10-16 1,99 -- Rising 20,0 20.66.32.00 2008-10-16 0,77 -- Sophos 2.79.0 4,34 2008-10-17 1,86 -- Sunbelt 3.1.1728.1 2317 2008-10-16 0,48 -- Symantec 1.3.0.24 20081016,004 2008-10-16 0,05 -- nProtect 2008-10-16.00 2247055 2008-10-16 4,22 -- V Hacker 6.3.1.0 v00116 2008-10-16 0,45 -- VBA32 3.12.8.7 20081016,1009 2008-10-16 1,43 -- VirusBuster 4.5.11.10 10.90.4/651643 2008-10-16 0,99 -- |
|
#9
16. októbra 2008, 14:41
| |||
| |||
| Ať dělám nemůžu zbavit TROJAN.VUNDO.H Stiahnite ComboFix by subs z jedného z nižšie uvedených odkazov. Isteže top uložiť do Desktop. Link # 1 Link # 2 ** Poznámka: Je dôležité, že je uložený priamo na váš Desktop Zavrieť všetky otvorené webové prehliadače. (Firefox, Internet Explorer, atď) pred začatím ComboFix. Dočasne znemožniť tvoj antivirus, A akékoľvek Anti-Spyware Ochrana v reálnom čase pred vykonávajúci kontrolu. Kliknite tento odkaz zobraziť zoznam bezpečnostných programov, ktoré by mali byť zakázané, a ako je zakázať. Dvojitým kliknutím combofix.exe & sledovať inštrukcie. Po dokončení bude vyrábať ComboFix log pre vás. Post ComboFix log V ďalšej odpovedi. Dôležité upozornenie: Don't mouseclick ComboFix okná, ak je v chode. To môže spôsobiť, že na stánku. Nezabudnite re-umožní váš antivírus a antispyware ochrany pri ComboFix je kompletná.
__________________ |
|
#10
16. októbra 2008, 15:11
| |||
| |||
| Ať dělám nemůžu zbavit TROJAN.VUNDO.H ComboFix 08-10-16.01 - Majiteľ 2008-10-16 17:52:25.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.95 [GMT -4:00] Spustenie z: C: \ Documents and Settings \ Vlastník \ Plocha \ ComboFix.exe * Vznik nového bodu obnovenia . ((((((((((((((((((((((((((((((((((((((( Ostatné Vymazanie ))))))))) )))))))))))))))))))))))))))))))))))))))) . C: \ WINDOWS \ jestertb.dll D: \ Autorun.inf . ((((((((((((((((((((((((( Súbory vytvorené od 2008-09-16 do 2008-10-16 ))))))))))) )))))))))))))))))))) . 2008-10-16 16:16. 2008-10-16 16:17 <DIR> d -------- C: \ Documents and Settings \ All Users \ Data aplikací \ WinZip 2008-10-16 15:56. 2008-10-16 16:23 <DIR> d -------- C: \ rsit 2008-10-16 15:19. 2008-10-16 15:19 <DIR> d -------- C: \ _OTMoveIt 2008-10-16 14:07. 2008-10-16 14:07 <DIR> d -------- C: \ Program Files \ Panda Bezpečnosť 2008-10-16 14:07. 2008-06-19 17:24 28544 - a ------ C: \ WINDOWS \ system32 \ drivers \ pavboot.sys 2008-10-16 13:20. 2008-10-16 13:20 <DIR> d -------- C: \ VundoFix zálohovanie 2008-10-16 12:26. 2008-10-16 12:26 <DIR> d -------- C: \ Documents and Settings \ All Users \ Data aplikací \ SUPERAntiSpyware.com 2008-10-16 12:25. 2008-10-16 13:40 <DIR> d -------- C: \ Program Files \ SuperAntiSpyware 2008-10-16 12:25. 2008-10-16 12:25 <DIR> d -------- C: \ Program Files \ Common Files \ Wise Sprievodca inštaláciou 2008-10-16 12:25. 2008-10-16 12:25 <DIR> d -------- C: \ Documents and Settings \ Vlastník \ Data aplikací \ SUPERAntiSpyware.com 2008-10-16 11:08. 2008-10-16 11:08 <DIR> d -------- C: \ WINDOWS \ system32 \ N360_BACKUP 2008-10-16 10:48. 2008-10-16 10:48 <DIR> d ---- c --- C: \ WINDOWS \ system32 \ DRVSTORE 2008-10-16 10:47. 2008-10-16 10:47 <DIR> d -------- C: \ Documents and Settings \ All Users \ Data aplikací \ () 3276BE95_AF08_429F_A64F_CA64CB79BCF6 2008-10-16 10:24. 2008-10-16 10:24 <DIR> d -------- C: \ Program Files \ Windows Bočný panel 2008-10-16 10:24. 2008-10-16 11:44 <DIR> d -------- C: \ Program Files \ Norton 360 2008-10-16 10:22. 2008-10-16 11:04 123952 - a ------ C: \ WINDOWS \ system32 \ drivers \ SYMEVENT.SYS 2008-10-16 10:22. 2008-10-16 11:04 60800 - a ------ C: \ WINDOWS \ system32 \ S32EVNT1.DLL 2008-10-16 10:22. 2008-10-16 11:04 10671 - a ------ C: \ WINDOWS \ system32 \ drivers \ SYMEVENT.CAT 2008-10-16 10:22. 2008-10-16 11:04 805 - a ------ C: \ WINDOWS \ system32 \ drivers \ SYMEVENT.INF 2008-10-16 10:16. 2008-09-08 06:41 333.824 ----- c --- C: \ WINDOWS \ system32 \ dllcache \ Srv.sys 2008-10-16 10:15. 2008-08-14 06:11 2.189.184 ----- c --- C: \ WINDOWS \ system32 \ dllcache \ ntoskrnl.exe 2008-10-16 10:15. 2008-08-14 06:09 2.145.280 ----- c --- C: \ WINDOWS \ system32 \ dllcache \ ntkrnlmp.exe 2008-10-16 10:15. 2008-08-14 05:33 2.066.048 ----- c --- C: \ WINDOWS \ system32 \ dllcache \ ntkrnlpa.exe 2008-10-16 10:15. 2008-08-14 05:33 2.023.936 ----- c --- C: \ WINDOWS \ system32 \ dllcache \ ntkrpamp.exe 2008-10-16 10:15. 2008-09-15 08:12 1.846.400 ----- c --- C: \ WINDOWS \ system32 \ dllcache \ Win32k.sys 2008-10-16 10:09. 2008-10-16 10:10 <DIR> d -------- C: \ Documents and Settings \ Správca \. Housecall6.6 2008-10-15 17:42. 2004-08-27 05:54 <DIR> d -------- C: \ Documents and Settings \ Správca \ WINDOWS 2008-10-15 17:42. 2005-01-28 05:22 <DIR> d -------- C: \ Documents and Settings \ Správca \ Data aplikací \ SampleView 2008-10-15 17:42. 2005-01-28 05:26 <DIR> d -------- C: \ Documents and Settings \ Správca \ Data aplikací \ McAfee 2008-10-15 17:42. 2008-10-15 17:42 <DIR> d -------- C: \ Documents and Settings \ Správca \ Data aplikací \ Malwarebytes 2008-10-15 17:42. 2008-10-16 10:09 <DIR> d -------- C: \ Documents and Settings \ Správca 2008-10-15 17:26. 2008-10-15 17:26 <DIR> d -------- C: \ Program Files \ NoNAV 2008-10-15 16:41. 2008-10-15 17:26 <DIR> d -------- C: \ SymNoNav 2008-10-15 16:22. 2008-10-15 17:27 <DIR> d -------- C: \ WINDOWS \ LMI42.tmp 2008-10-15 15:10. 2008-10-15 15:10 <DIR> d -------- C: \ Program Files \ Trend Micro 2008-10-11 13:05. 2008-10-11 12:33 102664 - a ------ C: \ WINDOWS \ system32 \ drivers \ tmcomm.sys 2008-10-11 12:33. 2008-10-15 15:21 <DIR> d -------- C: \ Documents and Settings \ Vlastník \. Housecall6.6 2008-10-11 12:25. 2008-10-11 12:25 <DIR> d -------- C: \ WINDOWS \ nedeľa 2008-10-11 12:00. 2008-10-11 12:01 <DIR> d -------- C: \ Program Files \ CCleaner 2008-10-11 11:38. 2008-10-11 11:38 <DIR> d -------- C: \ Program Files \ Malwarebytes' Anti-Malware 2008-10-11 11:38. 2008-10-11 11:38 <DIR> d -------- C: \ Documents and Settings \ Vlastník \ Data aplikací \ Malwarebytes 2008-10-11 11:38. 2008-10-11 11:38 <DIR> d -------- C: \ Documents and Settings \ All Users \ Data aplikací \ Malwarebytes 2008-10-11 11:38. 2008-09-10 00:04 38528 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbamswissarmy.sys 2008-10-11 11:38. 2008-09-10 00:03 17200 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbam.sys 2008-09-23 13:17. 2008-09-23 13:17 133 - a ------ C: \ Documents and Settings \ All Users \ Data aplikací \ ustore.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Správa )))))))) )))))))))))))))))))))))))))))))))))))))))))) . 2008-10-16 21:53 --------- d ----- w C: \ Program Files \ Common Files \ Symantec Zdieľaná 2008-10-16 17:49 --------- d ----- w C: \ Documents and Settings \ All Users \ Data aplikací \ Google Updater 2008-10-16 15:08 --------- d ----- w C: \ Documents and Settings \ Vlastník \ Data aplikací \ Symantec 2008-10-16 15:04 --------- d ----- w C: \ Program Files \ Symantec 2008-10-16 15:01 --------- d ----- w C: \ Documents and Settings \ All Users \ Data aplikací \ Symantec 2008-09-24 12:36 --------- d ----- w C: \ Program Files \ Common Files \ Peach 2008-09-08 10:41 333.824 ---- aw C: \ WINDOWS \ system32 \ drivers \ Srv.sys 2008-08-19 10:32 --------- d ----- w C: \ Program Files \ Microsoft Silverlight 2005-10-20 18:06 76-c ---- w C: \ Documents and Settings \ Vlastník \ Data aplikací \ wklnhst.dat 2005-05-27 00:43 0-csha-w C: \ WINDOWS \ SMINST \ HPCD.sys 2008-05-24 13:39 32.768-csha-w C: \ WINDOWS \ system32 \ config \ systemprofile \ Local Settings \ histórie \ History.IE5 \ MSHist012008052420080 525 \ Index.dat . ((((((((((((((((((((((((((((((((((((( Reg Načítavam Body )))))))))) )))))))))))))))))))))))))))))))))))))))) . . * Poznámka * prázdné záznamy & dôveryhodne východiskové údaje nie sú zobrazené REGEDIT4 [HKEY_LOCAL_MACHINE \ ~ \ Browser Helper Objects \ (D6EEB0C3-825E-4FBC-BE0F-38CD08E932FE)] 2004-08-04 15:00 105984 - a ------ C: \ windows \ system32 \ digestp.dll [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ Curr entversion \ Explorer \ shelliconoverlayidentifiers \ OV erlayExcluded] @ = "(4433A54A-1AC8-432F-90FC-85F045CF383C)" [HKEY_CLASSES_ROOT \ CLSID \ (4433A54A-1AC8-432F-90FC-85F045CF383C)] 2008-02-26 04:34 576352 - a ------ C: \ Program Files \ Common Files \ Symantec Shared \ Záloha \ buShell.dll [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ Curr entversion \ Explorer \ shelliconoverlayidentifiers \ OV erlayPending] @ = "(F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225)" [HKEY_CLASSES_ROOT \ CLSID \ (F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225)] 2008-02-26 04:34 576352 - a ------ C: \ Program Files \ Common Files \ Symantec Shared \ Záloha \ buShell.dll [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ Curr entversion \ Explorer \ shelliconoverlayidentifiers \ OV erlayProtected] @ = "(476D0EA3-80F9-48B5-B70B-05E677C9C148)" [HKEY_CLASSES_ROOT \ CLSID \ (476D0EA3-80F9-48B5-B70B-05E677C9C148)] 2008-02-26 04:34 576352 - a ------ C: \ Program Files \ Common Files \ Symantec Shared \ Záloha \ buShell.dll [HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curr ntVersion \ Run] "Ctfmon.exe" = "C: \ WINDOWS \ system32 \ Ctfmon.exe" [2008-04-13 15360] "SuperAntiSpyware" = "C: \ Program Files \ SuperAntiSpyware \ SUPERAntiSpyware.exe" [2008-05-28 1506544] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run] "QuickTime Úloha" = "C: \ Program Files \ QuickTime \ qttask.exe" [2005-01-28 98304] "Adobe Foto Downloader" = "C: \ Program Files \ Adobe \ Photoshop Album Odľahčenú Edition \ 3.0 \ Apps \ apdproxy.exe" [2005-06-06 57344] "Adobe Reader Speed Launcher" = "C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ reader_sl.exe" [2008-01-11 39792] "TkBellExe" = "C: \ Program Files \ Common Files \ Real \ Update_OB \ realsched.exe" [2008-04-19 185896] "ccApp" = "C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe" [2008-02-18 51048] "osCheck" = "C: \ Program Files \ Norton 360 \ osCheck.exe" [2008-02-26 988512] C: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Startup \ Zariadenia detektor 3.lnk - C: \ Program Files \ Olympus \ DeviceDetector \ DevDtct2.exe [2007-06-27 114688] Google Updater.lnk - C: \ Program Files \ Google \ Google Updater \ GoogleUpdater.exe [2007-06-04 125624] Microsoft Office.lnk - C: \ Program Files \ Microsoft Office \ Office \ OSA9.EXE [2000-01-21 65588] WinZip Quick Pick.lnk - C: \ Program Files \ WinZip \ WZQKPICK.EXE [2008-09-11 525664] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entversion \ Explorer \ ShellExecuteHooks] "(5AE067D3-9AFB-48E0-853A-EBB7F4A000DA)" = "C: \ Program Files \ SuperAntiSpyware \ SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ oznámiť \! SASWinLogon] 2007-04-19 13:41 294912 C: \ Program Files \ SuperAntiSpyware \ SASWINLO.dll [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ oznámiť \ paubftzz] 2004-08-04 15:00 105984 C: \ WINDOWS \ system32 \ digestp.dll [HKLM \ ~ \ startupfolder \ C: ^ Documents and Settings ^ All Users ^ Ponuka Štart ^ Programy ^ Po spuštění ^ BigFix.lnk] path = C: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Startup \ BigFix.lnk backup = C: \ WINDOWS \ PSS \ BigFix.lnkCommon Spustenie [HKLM \ ~ \ startupfolder \ C: ^ Documents and Settings ^ All Users ^ Ponuka Štart ^ Programy ^ Po spuštění ^ Microsoft Office.lnk] path = C: \ Documents and Settings \ All Users \ Ponuka Štart \ Programy \ Po spuštění \ Microsoft Office.lnk backup = C: \ WINDOWS \ PSS \ Microsoft Office.lnkCommon Spustenie [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ ATIPTA] - A - c --- 2004-11-12 01:10 344064 C: \ Program Files \ ATI Technologies \ ATI Control Panel \ atiptaxx.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ ccApp] - A ------ 2008-02-18 15:37 51048 C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ Ctfmon.exe] - A ------ 2008-04-13 20:12 15360 C: \ WINDOWS \ system32 \ Ctfmon.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ InCD] - A ------ 2003-09-01 09:32 1200178 C: \ Program Files \ Ahead \ InCD \ InCD.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ NeroCheck] - A ------ 2001-07-09 15:50 155648 C: \ WINDOWS \ system32 \ NeroCheck.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ NeroFilterCheck] - A ------ 2001-07-09 15:50 155648 C: \ WINDOWS \ system32 \ NeroCheck.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ Recguard] - A - c --- 2002-09-13 16:42 212992 C: \ WINDOWS \ SMINST \ Recguard.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ RemoteControl] - A - c --- 2003-10-31 23:42 32768 C: \ Program Files \ Cyberlink \ PowerDVD \ PDVDServ.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ SunKistEM] - A - c --- 2004-11-15 19:04 135168 C: \ Program Files \ Digital Media Reader \ shwiconEM.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ UpdateManager] - A - c --- 2003-08-19 01:01 110592 C: \ Program Files \ Common Files \ Sonic \ Update Manager \ sgtray.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ CHotkey] - A - c --- 2004-05-17 22:30 543232 C: \ WINDOWS \ zHotkey.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ ShowWnd] - A - c --- 2003-09-19 13:09 36864 C: \ WINDOWS \ ShowWnd.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ zdieľané tools \ msconfig \ startupreg \ SoundMan] - A - c --- 2004-11-15 23:20 77824 C: \ WINDOWS \ SOUNDMAN.EXE [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ security center \ Kontrola] "DisableMonitoring" = dword: 00000001 [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ security center \ Monitorovanie \ SymantecAntiVirus] "DisableMonitoring" = dword: 00000001 [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ security center \ Monitorovanie \ SymantecFirewall] "DisableMonitoring" = dword: 00000001 [HKLM \ ~ \ services \ sharedaccess \ Parameters \ firewallpo antonny \ standardprofile] "EnableFirewall" = 0 (0x0) [HKLM \ ~ \ services \ sharedaccess \ Parameters \ firewallpo antonny \ standardprofile \ AuthorizedApplications \ List] "% Windir% \ \ system32 \ \ Sessmgr.exe" = "% Windir% \ \ Network Diagnostické \ \ xpnetdiag.exe" = R0 pavboot; pavboot, C: \ WINDOWS \ system32 \ drivers \ pavboo t.sys [2008-06-19 28544] R0 shsizubv; shsizubv, C: \ WINDOWS \ system32 \ drivers \ shsi zubv.sys [2004-08-04 23424] S3 COH_Mon; COH_Mon, C: \ WINDOWS \ system32 \ Drivers \ COH_Mo n.sys [2008-07-30 23888] S3 VNUSB; VN Series Zariadenia, C: \ WINDOWS \ system32 \ DRIVERS \ VNUSB.sys [2003-12-15 38448] HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Svchost - Netsvcs qfbydciq [HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ curry ntversion \ explorer \ mountpoints2 \ (4f63278d-8557-11d9-be24-806d6172696f)] \ Shell \ AutoRun \ command - C: \ WINDOWS \ system32 \ rundll32.exe Shell32.dll, ShellExec_RunDLL Info.exe Folder.htt 480 480 [HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ curry ntversion \ explorer \ mountpoints2 \ (e1ec6b61-710a-11d9-B301-806d6172696f)] \ Shell \ AutoRun \ command - C: \ WINDOWS \ system32 \ rundll32.exe Shell32.dll, ShellExec_RunDLL Info.exe Folder.htt 480 480 * Novo vytvorené Service * - COMHOST * Novo vytvorené Service * - PROCEXP90 . Obsah tejto 'Naplánované úlohy' priečinku 2008-10-12 C: \ WINDOWS \ Úlohy \ Automatické Úplné Backup.job - C: \ Program Files \ Stomp \ Backup MyPC \ System \ bestart.exe [2003-10-30 04:10] 2008-10-15 C: \ WINDOWS \ Úlohy \ Denný Změnil Files.job - C: \ Program Files \ Stomp \ Backup MyPC \ System \ bestart.exe [2003-10-30 04:10] 2008-10-11 C: \ WINDOWS \ Úlohy \ PEACTREE TÝŽDENNÉ SPÄŤ UP.job - C: \ Program Files \ Stomp \ Backup MyPC \ System \ bestart.exe [2003-10-30 04:10] . - - - - SIROTY ZNEŠKODNENIU - - - -- Toolbar-ID - (ne obrázok) . ------- Doplnkový Scan ------- . R0 -: HKCU-Main, Start Page = hxxp: / / www.emachines.com/ R0 -: HKCU-Main, SearchMigratedDefaultURL = hxxp: / / www.google.com/search?q = (searchTerms) & sourceid = ie7 & RLS = com.micros oft: en-US & tj = utf8 & oe = utf8 R1 -: HKCU-SearchURL, (Default) = hxxp: / / www.google.com/search?q =% s O8 -: E & xportovať do programu Microsoft Excel - C: \ PROGRA ~ 1 \ micros ~ 2 \ Office11 \ EXCEL.EXE/3000 . ************************************************** ************************ catchme 0.3.1361 W2K/XP/Vista - rootkit / stealth malware detektor by Gmer, http://www.gmer.net Rootkit scan 2008-10-16 17:54:24 Windows 5.1.2600 Service Pack 3 NTFS skenování skrytých procesov ... skenování skrytých položiek autostart ... skenování skrytých súborov ... scan úspešne dokončená skryté súbory: 0 ************************************************** ************************ . Dokončenie čas: 2008-10-16 17:56:31 ComboFix-karantény-files.txt 2008-10-16 21:56:27 Pre-Spustiť: +142914838528 bytov zdarma Post-Spustiť: +142911078400 bytov zdarma WindowsXP-KB310994-SP2-Home-BOOTDISK-ENU.exe [boot loader] timeout = 2 default = multi (0) disk (0) rdisk (0) partition (1) \ OKNO S [operating systems] C: \ cmdcons \ bootsect.dat = "Microsoft Windows konzolu na zotavenie" / cmdcons multi (0) disk (0) rdisk (0) partition (1) \ WINDOWS = "Micro soft Windows XP Home Edition" / noexecute = OptIn / fastdetect 208 --- EOF --- 2008-10-16 15:20:49 |
