..dřív když sem měl 512Kbit od Volný tak to bylo v pohodě..je možný že by mi to zpomalovali?Nestabilita připojení!
Moderátor: Don
- orbion
- Začátečník
-
- Registrován: 22. dub 2007
Nestabilita připojení!
Čau mám problém s připojením k netu, je hrozně nestabilní mám standartně 2Mbit ADSL od Volnýho...občas to jede hezky rychle ale většinou mi pingy lítaj až někam k 1000ms(nemám spuštěnej žadnej torrent a traffic mám ohlídanej) a všechno se načítá i stahuje děsně pomalu, sice mám na routeru 3 PC ale dějě se to i když jsou ostatní PC vypnutý...prosim poraďte už sem z toho zoufalej ..dřív když sem měl 512Kbit od Volný tak to bylo v pohodě..je možný že by mi to zpomalovali?
..dřív když sem měl 512Kbit od Volný tak to bylo v pohodě..je možný že by mi to zpomalovali?- BUBINO
- Začátečník
-
- Registrován: 12. čer 2007
- Bydliště: Mám
Re: Nestabilita připojení!
O tom silne pochybujem, nakolko problem moze byt v smejdovi .
Dajte sem log z HJT.
http://www.trendsecure.com/portal/en-US ... hijackthis
Stiahnite , nainstaljte , spustite --> "DO A SYSTEM SCAN AND SAVE A LOGFILE" .Po skenovani vam vyhodi log v poznamkovom bloku . Jeho obsah skopirujte sem .
Dajte sem log z HJT.
http://www.trendsecure.com/portal/en-US ... hijackthis
Stiahnite , nainstaljte , spustite --> "DO A SYSTEM SCAN AND SAVE A LOGFILE" .Po skenovani vam vyhodi log v poznamkovom bloku . Jeho obsah skopirujte sem .
- orbion
- Začátečník
-
- Registrován: 22. dub 2007
Jo znám a mám, ještě sem HJT nezkoušel, ale system je proskenovaný
dvěma antiviry, antispywarem a vším možným, když sem se snažil najít příčinu toho zpomalování..ale to HJT sem hodim
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:56:34, on 11.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\Explorer.EXE
C:\WINXP\system32\RUNDLL32.EXE
C:\Programs\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\WINXP\system32\ctfmon.exe
C:\Programs\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programs\Bonjour\mDNSResponder.exe
C:\Programs\Common Files\LightScribe\LSSrvc.exe
C:\WINXP\system32\lkcitdl.exe
C:\WINXP\SYSTEM32\CTXFISPI.EXE
C:\WINXP\system32\lkads.exe
C:\WINXP\system32\lktsrv.exe
C:\Programs\National Instruments\Shared\Security\nidmsrv.exe
C:\WINXP\system32\nisvcloc.exe
C:\WINXP\system32\nvsvc32.exe
C:\WINXP\system32\svchost.exe
D:\software\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programs\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programs\Java\jre1.6.0\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINXP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINXP\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VolPanel] "C:\Programs\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\Programs\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programs\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programs\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programs\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programs\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programs\ICQ6\ICQ.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINXP\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINXP\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programs\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programs\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programs\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Programs\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programs\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINXP\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\WINXP\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\WINXP\system32\lktsrv.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\Programs\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINXP\system32\nisvcloc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINXP\system32\HPZipm12.exe
--
End of file - 6193 bytes
Jinak windowsXP mam osekaný programem nLite a je to zatim jen provizorní verze..tenhle vejkend chci udělat novou tak dám vědět jak funguje
Ale budu rád když v tom něco najdeš a poradíš sám už tam vidim pár nesrovnalostí
//zrovna teď sem odpojil všechny PC a nechal připojený jen jedno snížil trafic jak jenom to šlo a můj ping na jeden anglický server, kde mám normálně 75ms, je 850ms!!!
dvěma antiviry, antispywarem a vším možným, když sem se snažil najít příčinu toho zpomalování..ale to HJT sem hodim
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:56:34, on 11.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\Explorer.EXE
C:\WINXP\system32\RUNDLL32.EXE
C:\Programs\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\WINXP\system32\ctfmon.exe
C:\Programs\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programs\Bonjour\mDNSResponder.exe
C:\Programs\Common Files\LightScribe\LSSrvc.exe
C:\WINXP\system32\lkcitdl.exe
C:\WINXP\SYSTEM32\CTXFISPI.EXE
C:\WINXP\system32\lkads.exe
C:\WINXP\system32\lktsrv.exe
C:\Programs\National Instruments\Shared\Security\nidmsrv.exe
C:\WINXP\system32\nisvcloc.exe
C:\WINXP\system32\nvsvc32.exe
C:\WINXP\system32\svchost.exe
D:\software\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programs\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programs\Java\jre1.6.0\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINXP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINXP\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VolPanel] "C:\Programs\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\Programs\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programs\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programs\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programs\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programs\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programs\ICQ6\ICQ.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINXP\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINXP\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programs\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programs\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programs\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Programs\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programs\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINXP\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\WINXP\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\WINXP\system32\lktsrv.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\Programs\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINXP\system32\nisvcloc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINXP\system32\HPZipm12.exe
--
End of file - 6193 bytes
Jinak windowsXP mam osekaný programem nLite a je to zatim jen provizorní verze..tenhle vejkend chci udělat novou tak dám vědět jak funguje
Ale budu rád když v tom něco najdeš a poradíš sám už tam vidim pár nesrovnalostí
//zrovna teď sem odpojil všechny PC a nechal připojený jen jedno snížil trafic jak jenom to šlo a můj ping na jeden anglický server, kde mám normálně 75ms, je 850ms!!!
- orbion
- Začátečník
-
- Registrován: 22. dub 2007
Na tom logu sem našel pár věcí který dělaj zbytečnej trafic ale jinak žádnej svinec tam neni 
Jinak pokud myslíš FUP jako omezení stahování tak to je 14GB + každej další GB=50Kč...takže žádný snižování rychlosti
..napadlo mě co když to dělaj ostatní PC- na těch nepracuju- nejsou moje ....hodim sem log i z těch ostatních dvou
Jinak pokud myslíš FUP jako omezení stahování tak to je 14GB + každej další GB=50Kč...takže žádný snižování rychlosti
..napadlo mě co když to dělaj ostatní PC- na těch nepracuju- nejsou moje
....hodim sem log i z těch ostatních dvou - orbion
- Začátečník
-
- Registrován: 22. dub 2007
Tak zde jsou ostatní dva logy, děkuji 
LOG 1:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:36:50, on 12.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\AOL\Active Virus Shield\avp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AOL\Active Virus Shield\avp.exe
C:\Program Files\NetLimiter 2 Monitor\nlsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\NetLimiter 2 Monitor\NLClient.exe
C:\Program Files\iPod\bin\iPodService.exe
H:\HiJackThis_v2.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: XBTP06568 - {311F9DE8-6126-4EEE-B15F-65CBB3B4F9F6} - C:\Program Files\AOL Security Toolbar\AOL_security_toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: AOL Security Toolbar - {3BB63FD4-3C00-44D7-94A9-5DE211900DEF} - C:\Program Files\AOL Security Toolbar\AOL_security_toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [aol] "C:\Program Files\AOL\Active Virus Shield\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Active Virus Shield (AVP) - AOL - C:\Program Files\AOL\Active Virus Shield\avp.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Monitor\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4735 bytes
LOG 2:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:45:02, on 12.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eset\nod32krn.exe
E:\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1229272821-1383384898-1060284298-500\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-1229272821-1383384898-1060284298-500 Startup: Reboot.exe (User '?')
O4 - Startup: Reboot.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
--
End of file - 3100 bytes
[/b]
LOG 1:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:36:50, on 12.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\AOL\Active Virus Shield\avp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AOL\Active Virus Shield\avp.exe
C:\Program Files\NetLimiter 2 Monitor\nlsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\NetLimiter 2 Monitor\NLClient.exe
C:\Program Files\iPod\bin\iPodService.exe
H:\HiJackThis_v2.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: XBTP06568 - {311F9DE8-6126-4EEE-B15F-65CBB3B4F9F6} - C:\Program Files\AOL Security Toolbar\AOL_security_toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: AOL Security Toolbar - {3BB63FD4-3C00-44D7-94A9-5DE211900DEF} - C:\Program Files\AOL Security Toolbar\AOL_security_toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [aol] "C:\Program Files\AOL\Active Virus Shield\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Active Virus Shield (AVP) - AOL - C:\Program Files\AOL\Active Virus Shield\avp.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Monitor\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4735 bytes
LOG 2:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:45:02, on 12.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eset\nod32krn.exe
E:\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1229272821-1383384898-1060284298-500\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-1229272821-1383384898-1060284298-500 Startup: Reboot.exe (User '?')
O4 - Startup: Reboot.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
--
End of file - 3100 bytes
[/b]
- BUBINO
- Začátečník
-
- Registrován: 12. čer 2007
- Bydliště: Mám
V tom prvom logu fixnete :
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
v tom druhom fixnite :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O4 - S-1-5-21-1229272821-1383384898-1060284298-500 Startup: Reboot.exe (User '?')
O4 - Startup: Reboot.exe
Chyba firewall!
Bolo by ok , keby ste tu dal log zo vsetkych pocitacov no tento krat pre istotu z ComboFixu :
Stiahnite si ComboFix
Restartuje pocitac do nudzoveho rezimu.
Behom skenu bude vas pocitac restartovany.
Po restartu vytvori log, uložený v C:/Combofix.txt .
Jeho obsah vlozte sem.
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
v tom druhom fixnite :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O4 - S-1-5-21-1229272821-1383384898-1060284298-500 Startup: Reboot.exe (User '?')
O4 - Startup: Reboot.exe
Chyba firewall!
Bolo by ok , keby ste tu dal log zo vsetkych pocitacov no tento krat pre istotu z ComboFixu :
Stiahnite si ComboFix
Restartuje pocitac do nudzoveho rezimu.
Behom skenu bude vas pocitac restartovany.
Po restartu vytvori log, uložený v C:/Combofix.txt .
Jeho obsah vlozte sem.
- orbion
- Začátečník
-
- Registrován: 22. dub 2007
- orbion
- Začátečník
-
- Registrován: 22. dub 2007
Tak zde je prvni log (provedeny v nouzovem rezimu)
ComboFix 07-11-08.1 - David Rozmahel 2007-11-13 13:48:14.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.762 [GMT 1:00]
Running from: C:\Documents and Settings\David Rozmahel\Plocha\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2007-10-13 to 2007-11-13 )))))))))))))))))))))))))))))))
.
2007-11-13 13:25 51,200 --a------ C:\WINXP\NirCmd.exe
2007-11-10 02:33 <DIR> d-------- C:\Programs\Common Files\Bcgsoft
2007-11-10 02:32 <DIR> d-------- C:\WINXP\system32\cvirte
2007-11-10 02:32 <DIR> d-------- C:\Programs\National Instruments
2007-11-10 02:30 <DIR> d-------- C:\Programs\Electronics Workbench
2007-11-09 02:17 <DIR> d-------- C:\Programs\UDPixel
2007-11-05 19:36 <DIR> d-------- C:\Programs\mp3Tag 5
2007-11-05 19:36 335,872 --a------ C:\WINXP\system32\m4atag.dll
2007-11-05 19:15 <DIR> d-------- C:\Programs\MP3 EZlib
2007-11-05 19:09 <DIR> d-------- C:\Documents and Settings\David Rozmahel\Data aplikací\Mp3tag
2007-11-05 19:00 <DIR> d-------- C:\Programs\Mp3tag
2007-11-05 18:59 <DIR> d-------- C:\Programs\TagScanner
2007-11-02 20:48 <DIR> d-------- C:\Programs\Sierra On-Line
2007-11-02 20:48 1,022,976 --a------ C:\WINXP\system32\SierraNW.dll
2007-11-02 20:48 231,936 --a------ C:\WINXP\system32\SNWValid.dll
2007-11-02 20:45 <DIR> d-------- C:\Documents and Settings\David Rozmahel\WINDOWS
2007-10-22 23:36 <DIR> d-------- C:\Programs\Java
2007-10-22 23:36 <DIR> d-------- C:\Programs\Common Files\Java
2007-10-21 18:03 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\FLEXnet
2007-10-20 17:21 <DIR> d-------- C:\Programs\Windows Updates Downloader
2007-10-15 21:12 <DIR> d-------- C:\Programs\CCleaner
2007-10-15 19:00 <DIR> d-------- C:\Programs\nLite
2007-10-14 13:52 <DIR> d-------- C:\Programs\Common Files\Vbox
2007-10-14 13:14 <DIR> d-------- C:\Programs\Bonjour
2007-10-14 13:10 <DIR> d-------- C:\Programs\Common Files\Macrovision Shared
2007-10-14 11:02 <DIR> d-------- C:\Documents and Settings\David Rozmahel\Data aplikací\DVDXStudio
2007-10-14 11:00 <DIR> d-------- C:\Documents and Settings\David Rozmahel\Data aplikací\Vso
2007-10-14 11:00 81,920 --a------ C:\Documents and Settings\David Rozmahel\Data aplikací\ezpinst.exe
2007-10-14 11:00 47,360 --a------ C:\WINXP\system32\drivers\pcouffin.sys
2007-10-14 11:00 47,360 --a------ C:\Documents and Settings\David Rozmahel\Data aplikací\pcouffin.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-12 21:20 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\uTorrent
2007-11-12 14:21 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\Xfire
2007-11-10 15:56 --------- d-----w C:\Programs\ICQ6
2007-11-10 01:30 --------- d--h--w C:\Programs\InstallShield Installation Information
2007-11-08 19:10 --------- d-s---w C:\Programs\Xfire
2007-10-15 20:08 --------- d-----w C:\Programs\HP
2007-10-15 20:07 --------- d-----w C:\Programs\Common Files\Adobe
2007-10-12 20:43 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\Creative
2007-10-12 19:21 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\ICQ
2007-10-11 16:57 --------- d-----w C:\Programs\Microsoft.NET
2007-10-11 11:23 --------- d-----w C:\Programs\Sony Setup
2007-10-11 11:23 --------- d-----w C:\Programs\Sony
2007-10-11 11:23 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\Sony
2007-10-11 11:22 --------- d-----w C:\Programs\NuGardt Software
2007-10-10 19:59 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\FastStone
2007-10-10 19:31 --------- d-----w C:\Programs\FastStone Capture
2007-10-10 11:35 --------- d-----w C:\Programs\uTorrent
2007-10-09 20:01 --------- d-----w C:\Programs\Hewlett-Packard
2007-10-09 20:01 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Hewlett-Packard
2007-10-09 19:59 --------- d-----w C:\Programs\Common Files\Hewlett-Packard
2007-10-08 14:04 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\CyberLink
2007-10-07 20:22 --------- d-----w C:\Programs\Teamspeak2_RC2
2007-10-07 20:22 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\teamspeak2
2007-10-07 19:55 --------- d-----w C:\Programs\Common Files\InstallShield
2007-10-07 19:54 --------- d-----w C:\Programs\DAEMON Tools
2007-10-07 19:53 685,816 ----a-w C:\WINXP\system32\drivers\sptd.sys
2007-10-07 19:40 --------- d-----w C:\Documents and Settings\NetworkService\Data aplikací\Xfire
2007-10-07 19:40 --------- d-----w C:\Documents and Settings\NetworkService\Data aplikací\Xfire
2007-10-07 19:40 --------- d-----w C:\Documents and Settings\NetworkService\Data aplikací\Xfire
2007-10-07 19:34 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\Thunderbird
2007-10-07 19:34 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\Talkback
2007-10-07 19:33 --------- d-----w C:\Programs\Mozilla Thunderbird
2007-10-07 19:30 --------- d-----w C:\Programs\Creative
2007-10-07 19:26 --------- d-----w C:\Programs\CyberLink
2007-10-07 19:26 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\CyberLink
2007-10-07 19:24 --------- d-----w C:\Programs\Common Files\Nero
2007-10-07 19:24 --------- d-----w C:\Programs\Common Files\LightScribe
2007-10-07 19:23 --------- d-----w C:\Programs\Common Files\Ahead
2007-10-07 19:23 --------- d-----w C:\Programs\Ahead
2007-10-07 19:19 86,016 ----a-w C:\WINXP\system32\OpenAL32.dll
2007-10-07 19:19 409,600 ----a-w C:\WINXP\system32\wrap_oal.dll
2007-10-07 19:19 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Creative
2007-10-07 19:14 --------- d-----w C:\Programs\QuickTime
2007-10-07 19:14 --------- d-----w C:\Programs\iTunes
2007-10-07 19:14 --------- d-----w C:\Programs\iPod
2007-10-07 19:14 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\Apple Computer
2007-10-07 19:14 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Apple Computer
2007-10-07 19:13 --------- d-----w C:\Programs\Common Files\Apple
2007-10-07 19:13 --------- d-----w C:\Programs\Apple Software Update
2007-10-07 19:13 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Apple
2007-10-07 19:11 --------- d-----w C:\Programs\Opera
2007-10-07 19:11 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\InstallShield
2007-10-07 19:10 --------- d-----w C:\Programs\IrfanView
2007-10-07 19:09 --------- d-----w C:\Programs\ffdshow
2007-10-07 19:04 --------- d-----w C:\Programs\MSXML 6.0
2007-10-07 19:04 --------- d-----w C:\Programs\MSXML 4.0
2007-10-02 19:58 80,000 ----a-w C:\WINXP\system32\drivers\parport.sys
2007-10-02 19:58 8,192 ----a-w C:\WINXP\system32\tsbyuv.dll
2007-10-02 19:58 8,192 ----a-w C:\WINXP\system32\streamci.dll
2007-10-02 19:58 63,744 ----a-w C:\WINXP\system32\drivers\mf.sys
2007-10-02 19:58 56,320 ----a-w C:\WINXP\system32\dvdplay.exe
2007-10-02 19:58 51,712 ----a-w C:\WINXP\system32\wzcsapi.dll
2007-10-02 19:58 51,200 ----a-w C:\WINXP\system32\dmutil.dll
2007-10-02 19:58 47,616 ----a-w C:\WINXP\system32\iyuv_32.dll
2007-10-02 19:58 46,336 ----a-w C:\WINXP\system32\drivers\p3.sys
2007-10-02 19:58 41,216 ----a-w C:\WINXP\system32\drivers\amdk7.sys
2007-10-02 19:58 40,832 ----a-w C:\WINXP\system32\drivers\amdk6.sys
2007-10-02 19:58 40,320 ----a-w C:\WINXP\system32\drivers\crusoe.sys
2007-10-02 19:58 4,352 ----a-w C:\WINXP\system32\drivers\swenum.sys
2007-10-02 19:58 39,168 ----a-w C:\WINXP\system32\drivers\processr.sys
2007-10-02 19:58 359,936 ----a-w C:\WINXP\system32\wzcsvc.dll
2007-10-02 19:58 35,328 ----a-w C:\WINXP\system32\pid.dll
2007-10-02 19:58 25,472 ----a-w C:\WINXP\system32\drivers\sonydcam.sys
2007-10-02 19:58 23,936 ----a-w C:\WINXP\system32\drivers\usbcamd2.sys
2007-10-02 19:58 23,808 ----a-w C:\WINXP\system32\drivers\usbcamd.sys
2007-10-02 19:58 23,040 ----a-w C:\WINXP\system32\drivers\mouclass.sys
2007-10-02 19:58 21,376 ----a-w C:\WINXP\system32\drivers\tsbvcap.sys
2007-10-02 19:58 20,992 ----a-w C:\WINXP\system32\hid.dll
2007-10-02 19:58 2,019,328 ----a-w C:\WINXP\system32\ntkrnlpa.exe
2007-10-02 19:58 18,688 ----a-w C:\WINXP\system32\drivers\cdaudio.sys
2007-10-02 19:58 17,408 ----a-w C:\WINXP\system32\msyuv.dll
2007-10-02 19:58 16,000 ----a-w C:\WINXP\system32\drivers\usbintel.sys
2007-10-02 19:58 15,488 ----a-w C:\WINXP\system32\drivers\mssmbios.sys
2007-10-02 19:58 12,928 ----a-w C:\WINXP\system32\drivers\ndisuio.sys
2007-10-02 19:58 12,416 ----a-w C:\WINXP\system32\drivers\tunmp.sys
2007-10-02 19:58 12,160 ----a-w C:\WINXP\system32\drivers\mouhid.sys
2007-10-02 19:58 12,160 ----a-w C:\WINXP\system32\drivers\fsvga.sys
2007-10-02 19:56 219,648 ----a-w C:\WINXP\system32\uxtheme.dll
2007-10-02 19:55 989,184 ----a-w C:\WINXP\system32\syssetup.dll
2007-10-02 19:55 364,160 ----a-w C:\WINXP\system32\drivers\update.sys
2007-10-02 19:54 96,792 ----a-w C:\WINXP\system32\basecsp.dll
2007-10-02 19:54 884,736 ----a-w C:\WINXP\system32\msimsg.dll
2007-10-02 19:54 84,992 ----a-w C:\WINXP\system32\pintool.exe
2007-10-02 19:54 78,848 ----a-w C:\WINXP\system32\msiexec.exe
2007-10-02 19:54 600,576 ----a-w C:\WINXP\system32\mstsc.exe
2007-10-02 19:54 58,880 ----a-w C:\WINXP\system32\pnrpnsp.dll
2007-10-02 19:54 553,984 ----a-w C:\WINXP\system32\p2psvc.dll
2007-10-02 19:54 36,352 ----a-w C:\WINXP\system32\tsgqec.dll
2007-10-02 19:54 313,344 ----a-w C:\WINXP\system32\p2pgraph.dll
2007-10-02 19:54 288,768 ----a-w C:\WINXP\system32\rhttpaa.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINXP\system32\NvCpl.dll" [2007-06-28 23:43]
"nwiz"="nwiz.exe" [2007-06-28 23:43 C:\WINXP\system32\nwiz.exe]
"NvMediaCenter"="C:\WINXP\system32\NvMcTray.dll" [2007-06-28 23:43]
"VolPanel"="C:\Programs\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-13 13:11]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINXP\system32\ctfmon.exe" [2004-08-17 14:49]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide_2"=regsvr32 /s /n /i:U shell32
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideRunAsVerb"=1 (0x1)
"NoDesktopCleanupWizard"=1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"=1 (0x1)
"NoSMMyPictures"=1 (0x1)
"NoSMConfigurePrograms"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)
"NoRecentDocsHistory"=1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"=1 (0x1)
"NoSMMyPictures"=1 (0x1)
"NoSMConfigurePrograms"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)
"NoRecentDocsHistory"=1 (0x1)
R2 cvintdrv;cvintdrv;C:\WINXP\system32\drivers\cvintdrv.sys
R3 ha20x2k;Creative 20X HAL Driver;C:\WINXP\system32\drivers\ha20x2k.sys
R3 PSched;Plánovač paketů technologie QoS;C:\WINXP\system32\DRIVERS\psched.sys
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService upnphost SSDPSRV
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-13 13:48:57
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-13 13:49:11
.
--- E O F ---
Připojuji druhy log :
ComboFix 07-11-08.1 - Administrator 2007-11-13 20:45:24.1 - NTFSx86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.384 [GMT 1:00]
Running from: H:\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2007-10-13 to 2007-11-13 )))))))))))))))))))))))))))))))
.
2007-11-13 20:45 51,200 --a------ C:\WINDOWS\NirCmd.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 19:47 935,968 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2007-11-13 19:47 23,684,896 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-11-13 19:43 90,884 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2007-11-13 19:43 324,524 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-11-12 12:57 --------- d-----w C:\Program Files\HLSW
2007-11-10 17:42 --------- d-----w C:\Program Files\BSplayer Pro
2007-11-02 22:58 --------- d-s---w C:\Program Files\Xfire
2007-10-30 12:18 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2007-10-30 12:18 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2007-10-30 12:18 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2007-10-16 14:38 --------- d-----w C:\Program Files\Azureus
2007-10-05 22:10 --------- d-----w C:\Program Files\nLite
2007-10-01 11:32 --------- d-----w C:\Program Files\rajce
2007-09-29 09:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-09-22 12:48 --------- d-----w C:\Program Files\DVD Decrypter
2007-09-21 21:39 --------- d-----w C:\Program Files\Java
2007-09-21 21:37 --------- d-----w C:\Program Files\Common Files\Java
2007-09-17 16:46 --------- d-----w C:\Program Files\AOL Security Toolbar
2007-09-16 09:28 --------- d-----w C:\Program Files\Blender Foundation
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-20 16:06]
"nwiz"="nwiz.exe" [2006-06-20 16:06 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-06-20 16:06]
"Cmaudio"="cmicnfg.cpl" []
"aol"="C:\Program Files\AOL\Active Virus Shield\avp.exe" [2006-05-30 10:13]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"ICQ Lite"="C:\Program Files\ICQLite\ICQLite.exe" [2006-07-11 11:06]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 14:49]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-17 14:58]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"ICQ Lite"=C:\Program Files\ICQLite\ICQLite.exe -trayboot
R0 xmasbus;xmasbus;C:\WINDOWS\system32\DRIVERS\xmasbus.sys
R0 xmasscsi;xmasscsi;C:\WINDOWS\system32\Drivers\xmasscsi.sys
R1 nltdi;nltdi;\??\C:\WINDOWS\system32\drivers\nltdi.sys
R1 oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\oreans32.sys
R2 SetupNT;SetupNT;C:\WINDOWS\system32\SetupNT.sys
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys
S3 kvpndev;Kerio VPN adapter;C:\WINDOWS\system32\DRIVERS\kvpndrv.sys
.
Contents of the 'Scheduled Tasks' folder
"2007-10-30 17:30:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-13 20:47:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-13 20:48:11 - machine was rebooted
.
--- E O F ---
ComboFix 07-11-08.1 - David Rozmahel 2007-11-13 13:48:14.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.762 [GMT 1:00]
Running from: C:\Documents and Settings\David Rozmahel\Plocha\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2007-10-13 to 2007-11-13 )))))))))))))))))))))))))))))))
.
2007-11-13 13:25 51,200 --a------ C:\WINXP\NirCmd.exe
2007-11-10 02:33 <DIR> d-------- C:\Programs\Common Files\Bcgsoft
2007-11-10 02:32 <DIR> d-------- C:\WINXP\system32\cvirte
2007-11-10 02:32 <DIR> d-------- C:\Programs\National Instruments
2007-11-10 02:30 <DIR> d-------- C:\Programs\Electronics Workbench
2007-11-09 02:17 <DIR> d-------- C:\Programs\UDPixel
2007-11-05 19:36 <DIR> d-------- C:\Programs\mp3Tag 5
2007-11-05 19:36 335,872 --a------ C:\WINXP\system32\m4atag.dll
2007-11-05 19:15 <DIR> d-------- C:\Programs\MP3 EZlib
2007-11-05 19:09 <DIR> d-------- C:\Documents and Settings\David Rozmahel\Data aplikací\Mp3tag
2007-11-05 19:00 <DIR> d-------- C:\Programs\Mp3tag
2007-11-05 18:59 <DIR> d-------- C:\Programs\TagScanner
2007-11-02 20:48 <DIR> d-------- C:\Programs\Sierra On-Line
2007-11-02 20:48 1,022,976 --a------ C:\WINXP\system32\SierraNW.dll
2007-11-02 20:48 231,936 --a------ C:\WINXP\system32\SNWValid.dll
2007-11-02 20:45 <DIR> d-------- C:\Documents and Settings\David Rozmahel\WINDOWS
2007-10-22 23:36 <DIR> d-------- C:\Programs\Java
2007-10-22 23:36 <DIR> d-------- C:\Programs\Common Files\Java
2007-10-21 18:03 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\FLEXnet
2007-10-20 17:21 <DIR> d-------- C:\Programs\Windows Updates Downloader
2007-10-15 21:12 <DIR> d-------- C:\Programs\CCleaner
2007-10-15 19:00 <DIR> d-------- C:\Programs\nLite
2007-10-14 13:52 <DIR> d-------- C:\Programs\Common Files\Vbox
2007-10-14 13:14 <DIR> d-------- C:\Programs\Bonjour
2007-10-14 13:10 <DIR> d-------- C:\Programs\Common Files\Macrovision Shared
2007-10-14 11:02 <DIR> d-------- C:\Documents and Settings\David Rozmahel\Data aplikací\DVDXStudio
2007-10-14 11:00 <DIR> d-------- C:\Documents and Settings\David Rozmahel\Data aplikací\Vso
2007-10-14 11:00 81,920 --a------ C:\Documents and Settings\David Rozmahel\Data aplikací\ezpinst.exe
2007-10-14 11:00 47,360 --a------ C:\WINXP\system32\drivers\pcouffin.sys
2007-10-14 11:00 47,360 --a------ C:\Documents and Settings\David Rozmahel\Data aplikací\pcouffin.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-12 21:20 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\uTorrent
2007-11-12 14:21 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\Xfire
2007-11-10 15:56 --------- d-----w C:\Programs\ICQ6
2007-11-10 01:30 --------- d--h--w C:\Programs\InstallShield Installation Information
2007-11-08 19:10 --------- d-s---w C:\Programs\Xfire
2007-10-15 20:08 --------- d-----w C:\Programs\HP
2007-10-15 20:07 --------- d-----w C:\Programs\Common Files\Adobe
2007-10-12 20:43 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\Creative
2007-10-12 19:21 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\ICQ
2007-10-11 16:57 --------- d-----w C:\Programs\Microsoft.NET
2007-10-11 11:23 --------- d-----w C:\Programs\Sony Setup
2007-10-11 11:23 --------- d-----w C:\Programs\Sony
2007-10-11 11:23 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\Sony
2007-10-11 11:22 --------- d-----w C:\Programs\NuGardt Software
2007-10-10 19:59 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\FastStone
2007-10-10 19:31 --------- d-----w C:\Programs\FastStone Capture
2007-10-10 11:35 --------- d-----w C:\Programs\uTorrent
2007-10-09 20:01 --------- d-----w C:\Programs\Hewlett-Packard
2007-10-09 20:01 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Hewlett-Packard
2007-10-09 19:59 --------- d-----w C:\Programs\Common Files\Hewlett-Packard
2007-10-08 14:04 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\CyberLink
2007-10-07 20:22 --------- d-----w C:\Programs\Teamspeak2_RC2
2007-10-07 20:22 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\teamspeak2
2007-10-07 19:55 --------- d-----w C:\Programs\Common Files\InstallShield
2007-10-07 19:54 --------- d-----w C:\Programs\DAEMON Tools
2007-10-07 19:53 685,816 ----a-w C:\WINXP\system32\drivers\sptd.sys
2007-10-07 19:40 --------- d-----w C:\Documents and Settings\NetworkService\Data aplikací\Xfire
2007-10-07 19:40 --------- d-----w C:\Documents and Settings\NetworkService\Data aplikací\Xfire
2007-10-07 19:40 --------- d-----w C:\Documents and Settings\NetworkService\Data aplikací\Xfire
2007-10-07 19:34 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\Thunderbird
2007-10-07 19:34 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\Talkback
2007-10-07 19:33 --------- d-----w C:\Programs\Mozilla Thunderbird
2007-10-07 19:30 --------- d-----w C:\Programs\Creative
2007-10-07 19:26 --------- d-----w C:\Programs\CyberLink
2007-10-07 19:26 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\CyberLink
2007-10-07 19:24 --------- d-----w C:\Programs\Common Files\Nero
2007-10-07 19:24 --------- d-----w C:\Programs\Common Files\LightScribe
2007-10-07 19:23 --------- d-----w C:\Programs\Common Files\Ahead
2007-10-07 19:23 --------- d-----w C:\Programs\Ahead
2007-10-07 19:19 86,016 ----a-w C:\WINXP\system32\OpenAL32.dll
2007-10-07 19:19 409,600 ----a-w C:\WINXP\system32\wrap_oal.dll
2007-10-07 19:19 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Creative
2007-10-07 19:14 --------- d-----w C:\Programs\QuickTime
2007-10-07 19:14 --------- d-----w C:\Programs\iTunes
2007-10-07 19:14 --------- d-----w C:\Programs\iPod
2007-10-07 19:14 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\Apple Computer
2007-10-07 19:14 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Apple Computer
2007-10-07 19:13 --------- d-----w C:\Programs\Common Files\Apple
2007-10-07 19:13 --------- d-----w C:\Programs\Apple Software Update
2007-10-07 19:13 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Apple
2007-10-07 19:11 --------- d-----w C:\Programs\Opera
2007-10-07 19:11 --------- d-----w C:\Documents and Settings\David Rozmahel\Data aplikací\InstallShield
2007-10-07 19:10 --------- d-----w C:\Programs\IrfanView
2007-10-07 19:09 --------- d-----w C:\Programs\ffdshow
2007-10-07 19:04 --------- d-----w C:\Programs\MSXML 6.0
2007-10-07 19:04 --------- d-----w C:\Programs\MSXML 4.0
2007-10-02 19:58 80,000 ----a-w C:\WINXP\system32\drivers\parport.sys
2007-10-02 19:58 8,192 ----a-w C:\WINXP\system32\tsbyuv.dll
2007-10-02 19:58 8,192 ----a-w C:\WINXP\system32\streamci.dll
2007-10-02 19:58 63,744 ----a-w C:\WINXP\system32\drivers\mf.sys
2007-10-02 19:58 56,320 ----a-w C:\WINXP\system32\dvdplay.exe
2007-10-02 19:58 51,712 ----a-w C:\WINXP\system32\wzcsapi.dll
2007-10-02 19:58 51,200 ----a-w C:\WINXP\system32\dmutil.dll
2007-10-02 19:58 47,616 ----a-w C:\WINXP\system32\iyuv_32.dll
2007-10-02 19:58 46,336 ----a-w C:\WINXP\system32\drivers\p3.sys
2007-10-02 19:58 41,216 ----a-w C:\WINXP\system32\drivers\amdk7.sys
2007-10-02 19:58 40,832 ----a-w C:\WINXP\system32\drivers\amdk6.sys
2007-10-02 19:58 40,320 ----a-w C:\WINXP\system32\drivers\crusoe.sys
2007-10-02 19:58 4,352 ----a-w C:\WINXP\system32\drivers\swenum.sys
2007-10-02 19:58 39,168 ----a-w C:\WINXP\system32\drivers\processr.sys
2007-10-02 19:58 359,936 ----a-w C:\WINXP\system32\wzcsvc.dll
2007-10-02 19:58 35,328 ----a-w C:\WINXP\system32\pid.dll
2007-10-02 19:58 25,472 ----a-w C:\WINXP\system32\drivers\sonydcam.sys
2007-10-02 19:58 23,936 ----a-w C:\WINXP\system32\drivers\usbcamd2.sys
2007-10-02 19:58 23,808 ----a-w C:\WINXP\system32\drivers\usbcamd.sys
2007-10-02 19:58 23,040 ----a-w C:\WINXP\system32\drivers\mouclass.sys
2007-10-02 19:58 21,376 ----a-w C:\WINXP\system32\drivers\tsbvcap.sys
2007-10-02 19:58 20,992 ----a-w C:\WINXP\system32\hid.dll
2007-10-02 19:58 2,019,328 ----a-w C:\WINXP\system32\ntkrnlpa.exe
2007-10-02 19:58 18,688 ----a-w C:\WINXP\system32\drivers\cdaudio.sys
2007-10-02 19:58 17,408 ----a-w C:\WINXP\system32\msyuv.dll
2007-10-02 19:58 16,000 ----a-w C:\WINXP\system32\drivers\usbintel.sys
2007-10-02 19:58 15,488 ----a-w C:\WINXP\system32\drivers\mssmbios.sys
2007-10-02 19:58 12,928 ----a-w C:\WINXP\system32\drivers\ndisuio.sys
2007-10-02 19:58 12,416 ----a-w C:\WINXP\system32\drivers\tunmp.sys
2007-10-02 19:58 12,160 ----a-w C:\WINXP\system32\drivers\mouhid.sys
2007-10-02 19:58 12,160 ----a-w C:\WINXP\system32\drivers\fsvga.sys
2007-10-02 19:56 219,648 ----a-w C:\WINXP\system32\uxtheme.dll
2007-10-02 19:55 989,184 ----a-w C:\WINXP\system32\syssetup.dll
2007-10-02 19:55 364,160 ----a-w C:\WINXP\system32\drivers\update.sys
2007-10-02 19:54 96,792 ----a-w C:\WINXP\system32\basecsp.dll
2007-10-02 19:54 884,736 ----a-w C:\WINXP\system32\msimsg.dll
2007-10-02 19:54 84,992 ----a-w C:\WINXP\system32\pintool.exe
2007-10-02 19:54 78,848 ----a-w C:\WINXP\system32\msiexec.exe
2007-10-02 19:54 600,576 ----a-w C:\WINXP\system32\mstsc.exe
2007-10-02 19:54 58,880 ----a-w C:\WINXP\system32\pnrpnsp.dll
2007-10-02 19:54 553,984 ----a-w C:\WINXP\system32\p2psvc.dll
2007-10-02 19:54 36,352 ----a-w C:\WINXP\system32\tsgqec.dll
2007-10-02 19:54 313,344 ----a-w C:\WINXP\system32\p2pgraph.dll
2007-10-02 19:54 288,768 ----a-w C:\WINXP\system32\rhttpaa.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINXP\system32\NvCpl.dll" [2007-06-28 23:43]
"nwiz"="nwiz.exe" [2007-06-28 23:43 C:\WINXP\system32\nwiz.exe]
"NvMediaCenter"="C:\WINXP\system32\NvMcTray.dll" [2007-06-28 23:43]
"VolPanel"="C:\Programs\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-13 13:11]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINXP\system32\ctfmon.exe" [2004-08-17 14:49]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide_2"=regsvr32 /s /n /i:U shell32
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideRunAsVerb"=1 (0x1)
"NoDesktopCleanupWizard"=1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"=1 (0x1)
"NoSMMyPictures"=1 (0x1)
"NoSMConfigurePrograms"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)
"NoRecentDocsHistory"=1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"=1 (0x1)
"NoSMMyPictures"=1 (0x1)
"NoSMConfigurePrograms"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)
"NoRecentDocsHistory"=1 (0x1)
R2 cvintdrv;cvintdrv;C:\WINXP\system32\drivers\cvintdrv.sys
R3 ha20x2k;Creative 20X HAL Driver;C:\WINXP\system32\drivers\ha20x2k.sys
R3 PSched;Plánovač paketů technologie QoS;C:\WINXP\system32\DRIVERS\psched.sys
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService upnphost SSDPSRV
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-13 13:48:57
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-13 13:49:11
.
--- E O F ---
Připojuji druhy log
:ComboFix 07-11-08.1 - Administrator 2007-11-13 20:45:24.1 - NTFSx86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.384 [GMT 1:00]
Running from: H:\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2007-10-13 to 2007-11-13 )))))))))))))))))))))))))))))))
.
2007-11-13 20:45 51,200 --a------ C:\WINDOWS\NirCmd.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 19:47 935,968 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2007-11-13 19:47 23,684,896 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-11-13 19:43 90,884 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2007-11-13 19:43 324,524 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-11-12 12:57 --------- d-----w C:\Program Files\HLSW
2007-11-10 17:42 --------- d-----w C:\Program Files\BSplayer Pro
2007-11-02 22:58 --------- d-s---w C:\Program Files\Xfire
2007-10-30 12:18 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2007-10-30 12:18 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2007-10-30 12:18 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2007-10-16 14:38 --------- d-----w C:\Program Files\Azureus
2007-10-05 22:10 --------- d-----w C:\Program Files\nLite
2007-10-01 11:32 --------- d-----w C:\Program Files\rajce
2007-09-29 09:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-09-22 12:48 --------- d-----w C:\Program Files\DVD Decrypter
2007-09-21 21:39 --------- d-----w C:\Program Files\Java
2007-09-21 21:37 --------- d-----w C:\Program Files\Common Files\Java
2007-09-17 16:46 --------- d-----w C:\Program Files\AOL Security Toolbar
2007-09-16 09:28 --------- d-----w C:\Program Files\Blender Foundation
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-20 16:06]
"nwiz"="nwiz.exe" [2006-06-20 16:06 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-06-20 16:06]
"Cmaudio"="cmicnfg.cpl" []
"aol"="C:\Program Files\AOL\Active Virus Shield\avp.exe" [2006-05-30 10:13]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"ICQ Lite"="C:\Program Files\ICQLite\ICQLite.exe" [2006-07-11 11:06]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 14:49]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-17 14:58]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"ICQ Lite"=C:\Program Files\ICQLite\ICQLite.exe -trayboot
R0 xmasbus;xmasbus;C:\WINDOWS\system32\DRIVERS\xmasbus.sys
R0 xmasscsi;xmasscsi;C:\WINDOWS\system32\Drivers\xmasscsi.sys
R1 nltdi;nltdi;\??\C:\WINDOWS\system32\drivers\nltdi.sys
R1 oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\oreans32.sys
R2 SetupNT;SetupNT;C:\WINDOWS\system32\SetupNT.sys
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys
S3 kvpndev;Kerio VPN adapter;C:\WINDOWS\system32\DRIVERS\kvpndrv.sys
.
Contents of the 'Scheduled Tasks' folder
"2007-10-30 17:30:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-13 20:47:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-13 20:48:11 - machine was rebooted
.
--- E O F ---