Ето от Комбо фиксерът
ComboFix 09-10-03.01 - Фодор 10.2009 г. 14:34.1.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1251.359.2070.18.1977.834 [GMT 1:00]
Running from: c:\users\Фодор\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-1891059771-1908516478-2069820796-1001
c:\$recycle.bin\S-1-5-21-1891059771-1908516478-2069820796-1002
c:\$recycle.bin\S-1-5-21-1891059771-1908516478-2069820796-1004
c:\$recycle.bin\S-1-5-21-1891059771-1908516478-2069820796-500
c:\$recycle.bin\S-1-5-21-300333245-3506868601-414586884-500
c:\users\Фодор\AppData\Roaming\.#
c:\users\Фодор\AppData\Roaming\.#\MBX@94C@26D1F50.###
c:\users\Фодор\AppData\Roaming\.#\MBX@94C@26D1F60.###
c:\users\Фодор\AppData\Roaming\.#\MBX@94C@26D1F70.###
c:\users\Фодор\AppData\Roaming\.#\MBX@CB4@21B1F50.###
c:\users\Фодор\AppData\Roaming\.#\MBX@CB4@21B1F60.###
c:\users\Фодор\AppData\Roaming\.#\MBX@CB4@21B1F70.###
c:\users\”®¤®а\Documents\ॣЁбв а1.reg
c:\windows\system32\Trial The Santa Claus 3D.dll
.
((((((((((((((((((((((((( Files Created from 2009-09-04 to 2009-10-04 )))))))))))))))))))))))))))))))
.
2009-10-04 14:04 . 2009-10-04 14:05 -------- d-----w- c:\users\Фодор\AppData\Local\temp
2009-10-04 14:04 . 2009-10-04 14:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-04 00:08 . 2009-10-04 00:08 -------- d-----w- c:\program files\Trend Micro
2009-10-03 20:32 . 2005-10-15 13:42 1552384 ----a-w- c:\windows\system32\myodbc3.dll
2009-10-03 20:32 . 2005-10-15 13:42 28672 ----a-w- c:\windows\system32\myodbc3i.exe
2009-10-03 20:32 . 2005-10-15 13:42 2183168 ----a-w- c:\windows\system32\myodbc3S.dll
2009-10-03 20:32 . 2005-10-15 13:42 11776 ----a-w- c:\windows\system32\myodbc3m.exe
2009-10-03 20:32 . 2005-10-15 13:42 2056192 ----a-w- c:\windows\system32\myodbc3c.exe
2009-10-03 20:32 . 2004-02-23 00:00 78848 ----a-w- c:\windows\system32\MSBIND.DLL
2009-10-03 20:32 . 2003-07-04 06:42 731 ----a-w- c:\windows\system32\xpstylelib.dll
2009-10-03 20:32 . 2003-01-26 12:41 40960 ----a-w- c:\windows\system32\SSubTmr6.dll
2009-10-03 12:53 . 2009-10-03 12:53 -------- d-----w- c:\users\Фодор\AppData\Roaming\Malwarebytes
2009-10-03 12:53 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-03 12:53 . 2009-10-03 12:53 -------- d-----w- c:\programdata\Malwarebytes
2009-10-03 12:53 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-03 12:53 . 2009-10-03 12:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-30 17:17 . 2009-10-02 21:27 -------- d-----w- c:\users\Фодор\AppData\Roaming\VMware
2009-09-30 17:10 . 2009-08-14 12:40 55856 ----a-w- c:\windows\system32\vnetinst.dll
2009-09-30 17:10 . 2009-08-14 12:40 16560 ----a-w- c:\windows\system32\drivers\vmnetadapter.sys
2009-09-30 17:10 . 2009-08-14 19:19 326192 ----a-w- c:\windows\system32\vmnetdhcp.exe
2009-09-30 17:10 . 2009-08-14 19:19 399920 ----a-w- c:\windows\system32\vmnat.exe
2009-09-30 17:10 . 2009-08-14 19:20 26288 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys
2009-09-30 17:10 . 2009-08-14 12:40 50736 ----a-r- c:\windows\system32\vmnetbridge.dll
2009-09-30 17:10 . 2009-08-14 12:40 31280 ----a-r- c:\windows\system32\drivers\vmnetbridge.sys
2009-09-30 17:10 . 2009-08-14 12:40 18736 ----a-r- c:\windows\system32\drivers\vmnet.sys
2009-09-30 17:10 . 2009-08-14 19:19 723504 ----a-w- c:\windows\system32\vnetlib.dll
2009-09-30 17:09 . 2009-08-14 19:20 23216 ----a-w- c:\windows\system32\drivers\VMkbd.sys
2009-09-30 17:04 . 2009-10-03 16:52 -------- d-----w- c:\programdata\VMware
2009-09-30 17:02 . 2009-09-30 17:08 -------- d-----w- c:\program files\VMware
2009-09-29 13:55 . 2009-09-09 19:15 115856 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2009-09-29 13:54 . 2009-09-09 19:15 41424 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2009-09-29 13:54 . 2009-09-29 13:54 -------- d-----w- c:\program files\Sun
2009-09-26 21:44 . 2009-09-26 21:44 -------- d-----w- c:\windows\system32\Adobe
2009-09-26 20:43 . 2009-09-26 20:47 -------- d-----w- c:\users\Фодор\.VirtualBox
2009-09-26 20:34 . 2009-09-26 20:38 71653904 ----a-w- C:\VirtualBox-3.0.6-52128-Win.exe
2009-09-26 12:13 . 2009-09-26 12:13 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2009-09-25 19:25 . 2009-09-25 19:26 -------- d-----w- c:\program files\Valve Hammer Editor
2009-09-24 12:30 . 2009-09-26 12:18 -------- d-----w- c:\program files\Google
2009-09-23 20:11 . 2009-09-24 23:22 -------- d-----w- C:\Patevoditel
2009-09-22 17:19 . 2009-09-22 17:19 -------- d-----w- C:\Rarlab.WinRAR.v3.90.Bulgarian.Incl.Regfile-Zamunda
2009-09-21 09:40 . 2009-09-21 09:40 -------- d-----w- c:\program files\12Voip.com
2009-09-20 23:00 . 2009-09-21 09:42 -------- d-----w- c:\users\Фодор\AppData\Roaming\12Voip
2009-09-19 20:54 . 2009-09-19 20:54 -------- d-----w- c:\programdata\Astar Games
2009-09-18 16:56 . 2009-09-18 16:56 -------- d-----w- c:\users\Фодор\AppData\Local\id Software
2009-09-18 16:45 . 2009-09-18 16:45 139152 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-09-18 16:45 . 2009-09-18 16:45 139152 ----a-w- c:\users\Фодор\AppData\Roaming\PnkBstrK.sys
2009-09-18 16:45 . 2009-09-18 16:45 111928 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-09-18 16:45 . 2009-09-18 16:45 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-09-18 16:45 . 2009-09-18 16:45 794408 ----a-w- c:\windows\system32\pbsvc.exe
2009-09-18 16:03 . 2009-09-18 16:03 -------- d-----w- c:\program files\Activision
2009-09-15 18:08 . 2009-09-15 18:08 -------- d-----w- c:\programdata\NOS
2009-09-15 18:08 . 2009-09-15 18:08 -------- d-----w- c:\program files\NOS
2009-09-15 18:08 . 2009-09-03 10:53 30912 ----a-w- c:\users\Фодор\AppData\Roaming\Mozilla\Firefox\Profiles\43gtkcr2.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2009-09-15 18:08 . 2009-09-03 10:53 22848 ----a-w- c:\users\Фодор\AppData\Roaming\Mozilla\Firefox\Profiles\43gtkcr2.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg_bootstrap.exe
2009-09-15 18:08 . 2009-09-03 10:53 19792 ----a-w- c:\users\Фодор\AppData\Roaming\Mozilla\Firefox\Profiles\43gtkcr2.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2009-09-14 16:05 . 2009-09-14 16:05 -------- d-----w- c:\users\Фодор\.borland
2009-09-14 15:30 . 2009-09-14 15:30 -------- d-----w- C:\Inprise
2009-09-14 15:29 . 1999-10-23 13:41 55808 ------w- c:\windows\system32\ActPanel.dll
2009-09-14 15:29 . 2009-09-14 15:29 -------- d-----w- c:\program files\JavaSoft
2009-09-14 15:27 . 2001-11-28 23:50 177152 ----a-w- c:\windows\system32\ibinstall.dll
2009-09-14 15:26 . 2001-11-28 23:50 28672 ----a-w- c:\windows\system32\ibxml.dll
2009-09-14 15:26 . 2001-11-28 23:50 376832 ----a-w- c:\windows\system32\gds32.dll
2009-09-14 15:09 . 2009-09-14 15:26 -------- d-----w- c:\program files\Borland
2009-09-14 15:09 . 2009-09-14 15:14 -------- d-----w- c:\program files\Common Files\Borland Shared
2009-09-14 13:38 . 2009-09-14 13:38 -------- d-----w- c:\users\Фодор\AppData\Roaming\JGsoft
2009-09-14 13:38 . 2009-09-14 13:38 -------- d-----w- c:\program files\JGsoft
2009-09-14 13:38 . 2009-06-19 02:20 68232 ----a-w- c:\windows\UnDeployV.exe
2009-09-14 13:34 . 2009-09-14 13:34 0 ----a-w- c:\windows\nsreg.dat
2009-09-14 13:34 . 2009-09-14 13:34 -------- d-----w- c:\users\Фодор\AppData\Local\Mozilla
2009-09-12 18:58 . 2009-09-12 18:58 -------- d-----w- c:\users\Фодор\AppData\Local\Macromedia
2009-09-12 18:50 . 2009-09-12 18:50 -------- d-----w- c:\windows\system32\QuickTime
2009-09-10 08:21 . 2009-09-10 08:21 -------- d-----w- c:\users\Фодор\AppData\Roaming\Microsoft Games
2009-09-10 08:21 . 2009-09-10 08:21 -------- d-----w- c:\programdata\Microsoft Games
2009-09-09 19:42 . 2009-09-09 19:42 -------- d-----w- c:\program files\Common Files\NSV
2009-09-09 19:15 . 2009-09-09 19:15 91856 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2009-09-09 19:15 . 2009-09-09 19:15 133648 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll
2009-09-09 19:15 . 2009-09-09 19:15 100368 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys
2009-09-09 15:23 . 2009-09-17 18:32 -------- d-----w- C:\ESET NOD32 Antivirus 4.0.435 Bulgarian
2009-09-08 17:37 . 2009-09-08 17:39 -------- d-----w- c:\program files\Е107
2009-09-08 17:32 . 2009-09-09 21:04 -------- d-----w- c:\program files\VVSN
2009-09-08 17:31 . 2009-09-08 17:31 -------- d-----w- c:\program files\Crystal Player
2009-09-08 16:56 . 2009-09-26 12:17 -------- d-----w- c:\windows\uninstall
2009-09-08 16:29 . 2009-09-08 16:30 -------- d-----w- c:\program files\Spring
2009-09-08 16:21 . 2009-09-08 16:21 -------- d-----w- c:\program files\VISUALROUTE
2009-09-08 16:18 . 2009-09-08 16:18 7840 ----a-w- c:\windows\system32\mcdmsg5.dll
2009-09-08 16:18 . 2009-09-08 16:27 -------- d-----w- c:\program files\Common Files\Stardock
2009-09-08 16:17 . 2009-09-08 16:17 -------- d-----w- c:\program files\AutoCRYPT7
2009-09-08 16:07 . 2006-11-16 10:54 1470464 ----a-w- c:\windows\The Santa Claus 3D Trial.scr
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-04 14:05 . 2009-05-24 12:14 3932160 --sha-w- c:\users\Фодор\ntuser.dat
2009-10-04 14:04 . 2009-05-24 15:16 -------- d-----w- c:\users\Фодор\AppData\Roaming\uTorrent
2009-10-04 13:52 . 2009-06-14 16:17 -------- d-----w- c:\users\Фодор\AppData\Roaming\Skype
2009-10-04 12:18 . 2009-08-18 17:11 -------- d-----w- c:\users\Фодор\AppData\Roaming\FileZilla
2009-10-04 09:01 . 2009-05-27 15:28 -------- d-----w- c:\users\Фодор\AppData\Roaming\WinRAR
2009-10-04 08:45 . 2008-08-14 17:05 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-04 07:08 . 2008-01-21 06:20 656224 ----a-w- c:\windows\system32\prfh0816.dat
2009-10-04 07:08 . 2008-01-21 06:20 130052 ----a-w- c:\windows\system32\prfc0816.dat
2009-10-04 07:03 . 2009-06-13 20:15 -------- d-----w- c:\users\Фодор\AppData\Roaming\skypePM
2009-10-04 06:54 . 2009-07-10 14:50 -------- d-----w- c:\users\Фодор\AppData\Roaming\Mozilla
2009-10-03 12:53 . 2009-10-03 12:53 -------- d-----w- c:\users\Фодор\AppData\Roaming\Malwarebytes
2009-10-02 21:27 . 2009-09-30 17:17 -------- d-----w- c:\users\Фодор\AppData\Roaming\VMware
2009-09-26 08:40 . 2009-08-18 17:11 -------- d-----w- c:\program files\FileZilla FTP Client
2009-09-25 16:47 . 2009-05-24 12:15 86472 ----a-w- c:\users\Фодор\AppData\Local\GDIPFONTCACHEV1.DAT
2009-09-21 09:42 . 2009-09-20 23:00 -------- d-----w- c:\users\Фодор\AppData\Roaming\12Voip
2009-09-18 16:53 . 2009-05-24 12:14 -------- d-s---w- c:\users\Фодор\AppData\Roaming\Microsoft
2009-09-18 16:45 . 2009-09-18 16:45 139152 ----a-w- c:\users\Фодор\AppData\Roaming\PnkBstrK.sys
2009-09-18 16:45 . 2009-09-18 16:45 139152 ----a-w- c:\users\Фодор\AppData\Roaming\PnkBstrK.sys
2009-09-18 16:45 . 2008-08-14 16:44 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-14 13:38 . 2009-09-14 13:38 -------- d-----w- c:\users\Фодор\AppData\Roaming\JGsoft
2009-09-12 18:58 . 2009-05-24 12:16 -------- d-----w- c:\users\Фодор\AppData\Roaming\Macromedia
2009-09-12 18:54 . 2009-05-24 21:40 -------- d-----w- c:\program files\Macromedia
2009-09-10 08:21 . 2009-09-10 08:21 -------- d-----w- c:\users\Фодор\AppData\Roaming\Microsoft Games
2009-09-10 08:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Microsoft Games
2009-09-09 19:44 . 2009-06-22 08:51 -------- d-----w- c:\program files\Winamp
2009-09-08 16:33 . 2009-09-08 16:33 60083 ----a-w- c:\users\Фодор\ia_remove.sh9032.tmp
2009-09-08 15:06 . 2009-05-24 19:40 40 ----a-w- c:\windows\RSoftInfo.dat
2009-09-08 14:51 . 2009-06-02 08:48 -------- d-----w- c:\program files\ReflexiveArcade
2009-09-07 19:32 . 2009-06-24 16:45 -------- d-----w- c:\programdata\Rosetta Stone
2009-08-28 19:15 . 2009-08-28 19:15 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-08-28 10:05 . 2009-08-28 10:05 -------- d-----w- c:\program files\Lavalys
2009-08-27 21:28 . 2009-05-30 19:21 -------- d-----w- c:\programdata\Bimesoft
2009-08-27 21:27 . 2008-08-14 17:06 -------- d-----w- c:\programdata\Microsoft Help
2009-08-27 21:19 . 2009-07-01 16:25 -------- d-----w- c:\program files\Invadazoid
2009-08-17 15:29 . 2009-08-17 15:29 -------- d-----w- c:\users\Фодор\AppData\Roaming\InterVideo
2009-08-14 19:20 . 2009-08-14 19:20 32304 ----a-w- c:\windows\system32\drivers\hcmon.sys
2009-08-14 19:20 . 2009-08-14 19:20 54960 ----a-w- c:\windows\system32\drivers\vmci.sys
2009-08-14 19:20 . 2009-08-14 19:20 857520 ----a-w- c:\windows\system32\drivers\vmx86.sys
2009-08-14 14:17 . 2009-08-14 14:17 252464 ----a-w- c:\windows\system32\vmnc.dll
2009-08-12 14:56 . 2009-08-12 14:56 -------- d-----w- c:\users\Фодор\AppData\Roaming\Sahmon Games
2009-08-09 12:12 . 2009-08-09 12:12 680 ----a-w- c:\users\Фодор\AppData\Local\d3d9caps.dat
2009-08-07 11:37 . 2009-08-07 11:37 -------- d-----w- c:\users\Фодор\AppData\Roaming\Island
2009-08-05 15:23 . 2009-08-05 15:23 -------- d-----w- c:\users\Фодор\AppData\Roaming\PlayFirst
2009-08-05 15:23 . 2009-08-05 15:23 -------- d-----w- c:\programdata\PlayFirst
2009-08-05 15:21 . 2009-08-05 15:21 -------- d-----w- c:\program files\FreeGamePick.com
2009-08-03 21:30 . 2009-08-03 21:30 549 ----a-w- c:\windows\eReg.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-05-26 24264488]
"uTorrent"="c:\program files\uTorrent2\uTorrent.exe" [2009-07-07 288048]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-16 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-16 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-16 145944]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-07-25 768520]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-12 2029640]
"VVSN"="c:\program files\VVSN\VVSN.exe" [2004-12-22 107520]
"vmware-tray"="c:\program files\VMware\vmware-tray.exe" [2009-08-14 96816]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-06-27 6244896]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-5-24 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Users^Фодор^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Iniciacao Rapida do Microsoft Office OneNote 2007.lnk]
path=c:\users\Фодор\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Iniciacao Rapida do Microsoft Office OneNote 2007.lnk
backup=c:\windows\pss\Iniciacao Rapida do Microsoft Office OneNote 2007.lnk.Startup
backupExtension=.Startup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7D5666CB-C594-44AF-BDB8-52458DBAC7E7}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{C685938C-CCA7-41F9-9BB8-6454E7AD10A6}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{C875A510-F25E-4B27-B0A5-E1C91810A082}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{56F55DD5-00DA-4A2E-BC2F-69F121FCC3DC}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{19342910-52C8-4DD5-99A7-8548993AF6AF}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{BBD375BB-F746-45BF-A331-AF47588FF6C5}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{48207832-7FF9-42F9-BB45-524D779A45DC}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7FFF791A-9F2E-4C0F-AF01-061DE300C1F8}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{A19A784F-C78C-4E1A-87C9-A1C42F1E9A40}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{0FC3B06D-2E90-418B-853F-5DB233B26285}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{20321BE1-8471-4F36-B861-B4BD2148D882}e:\\keygen.folder.guard.8.1.exe"= UDP:E:\keygen.folder.guard.8.1.exe:Keygen.Folder.Guard.8.1
"UDP Query User{39CB941F-5C98-421C-8BE5-25DFEA202E17}e:\\keygen.folder.guard.8.1.exe"= TCP:E:\keygen.folder.guard.8.1.exe:Keygen.Folder.Guard.8.1
"TCP Query User{E9E726D5-F1B1-458D-B914-438BF1A592B2}e:\\crack.folder.guard.8.1.exe"= UDP:E:\crack.folder.guard.8.1.exe:Crack.Folder.Guard.8.1
"UDP Query User{D5C96EEC-4B18-4000-A0DD-6365EB4A9B35}e:\\crack.folder.guard.8.1.exe"= TCP:E:\crack.folder.guard.8.1.exe:Crack.Folder.Guard.8.1
"TCP Query User{FCBA0388-196D-469A-BC06-86B50C1B8BE1}c:\\игри\\return to castle wolfenstein\\wolfmp.exe"= UDP:c:\игри\return to castle wolfenstein\wolfmp.exe:WolfMP
"UDP Query User{5D025BF5-744A-4425-AB72-D862AE4543B1}c:\\игри\\return to castle wolfenstein\\wolfmp.exe"= TCP:c:\игри\return to castle wolfenstein\wolfmp.exe:WolfMP
"{8F45116A-DAC1-41A1-BC6D-75CF35F8D2FC}"= UDP:c:\program files\uTorrent2\uTorrent.exe:µTorrent (TCP-In)
"{349ACBF8-A49A-4173-9AE1-9FF7C3075B01}"= TCP:c:\program files\uTorrent2\uTorrent.exe:µTorrent (UDP-In)
"{09E9397B-9340-4218-A559-D910AE0E1C4E}"= UDP:c:\program files\BitComet\BitComet.exe:BitComet.exe
"{60EB8B6E-41B6-46FA-BB60-75CB8F7801E4}"= TCP:c:\program files\BitComet\BitComet.exe:BitComet.exe
"{03F3AEDE-D4BF-4111-9FC5-CE32B70EE722}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{9A7B9219-669D-4A55-ABA8-3A414479C455}"= c:\users\Фодор\Desktop\Rosetta Stone Version 3\RosettaStoneVersion3.exe:Rosetta Stone Version 3 Application
"{0FF68BA2-949D-4110-8428-9A27F2A860D5}"= c:\users\Фодор\Desktop\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe:Rosetta Stone Ltd Services
"{8EDC3033-914D-4503-9455-EF84EDE315FF}"= UDP:c:\program files\Autodesk\Backburner\monitor.exe:backburner 2.3 monitor
"{568B7966-5A03-4909-A439-580F02D36200}"= TCP:c:\program files\Autodesk\Backburner\monitor.exe:backburner 2.3 monitor
"{0041F388-C5BE-4575-B7D8-73B5215BD29F}"= UDP:c:\program files\Autodesk\Backburner\manager.exe:backburner 2.3 manager
"{45C0D36E-8BFA-4E74-AD49-BFC8F0864BC9}"= TCP:c:\program files\Autodesk\Backburner\manager.exe:backburner 2.3 manager
"{F91CF435-F6B1-45EF-BE33-701F33025371}"= UDP:c:\program files\Autodesk\Backburner\server.exe:backburner 2.3 server
"{1C4FDB1E-9FEE-4222-A440-7E6CE5CF7626}"= TCP:c:\program files\Autodesk\Backburner\server.exe:backburner 2.3 server
"{FF26CB61-7243-4CD5-B689-966ACB739E01}"= UDP:c:\program files\Autodesk\3ds Max 2009\3dsmax.exe:Autodesk 3ds Max 2009 32-bit
"{DC0DC9CA-1759-468B-98F7-13ADF76BEEDE}"= TCP:c:\program files\Autodesk\3ds Max 2009\3dsmax.exe:Autodesk 3ds Max 2009 32-bit
"{D26B45CC-D23B-4442-A423-7D01D7F35FAE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{2ADC8625-0912-4EAA-B625-C5D5A15B078C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6F5B0A23-0D26-409E-BD5E-5040429A23A3}"= UDP:c:\program files\Microsoft Games\Zoo Tycoon 2\zt.exe:Zoo Tycoon 2 Executable
"{ABD76CA1-E82C-4168-8C64-61DE5CF1867C}"= TCP:c:\program files\Microsoft Games\Zoo Tycoon 2\zt.exe:Zoo Tycoon 2 Executable
"{48FAB255-BD9E-4A3E-A1D9-BDD6A9B26F9E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{358AD328-9CE6-44AD-891F-14D7346859FE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{051DEC9B-C854-417C-9FA5-C409A948568B}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{E42FE16C-A2D1-4196-BCEB-896E755D58DA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{76FBBEAB-4636-440C-80BF-FD4E91E7FEDB}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8698FD52-B037-456A-AF9E-5DBB9CC95240}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CF3C0ADC-0A30-4559-AD86-8CC360B0B2BE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{DF141448-B8C7-43B7-9F6E-01EAD27AA498}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B244C546-E448-4689-93A7-EE81BACB0BC9}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F685F817-6B79-4A16-873B-D293F94749BA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{DD615C39-0FD8-4832-A4FA-A9F332583CD4}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{DD7B21F0-ECE0-4EA9-802B-331214E280CD}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{57D02B04-FC48-4602-A267-A4FB0EBA4003}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C7F451A1-7026-43F3-8B99-69C0A763C708}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{DA71F7FF-18AA-4409-9272-DE3E12FD60A5}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{35F6836F-C0CC-464D-B0D4-66049E0EC9AC}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{9BB63CD0-2410-490D-9EA0-FCA436ABA43F}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{3EDD0031-D214-4F5F-AC9F-6633742F8EC9}"= UDP:c:\program files\Activision\Wolfenstein\MP\Wolf2MP.exe:Wolfenstein
"{E5C0057B-242D-41E4-9AC0-19A9186F604F}"= TCP:c:\program files\Activision\Wolfenstein\MP\Wolf2MP.exe:Wolfenstein
"{5654769F-BB7D-4E4D-A8F5-F99BDB6E6B3B}"= UDP:c:\program files\Activision\Wolfenstein\MP\Wolf2MPLite.exe:Wolfenstein
"{A02CBC88-0F1A-4DF2-963D-68F7950F1D61}"= TCP:c:\program files\Activision\Wolfenstein\MP\Wolf2MPLite.exe:Wolfenstein
"{770C4600-6434-453D-97DE-8323DDC33835}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F9BCACAE-C528-498C-9EC0-6F822C73D91F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{AE121979-6701-4205-A74F-39549CAF1C11}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6DE09D3C-0599-42C2-8C80-4A9205941735}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C820021B-9B04-48AA-A4DB-478E4D1BEEE3}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1DDCE5F9-4C2D-4D1B-BB32-786DE6F999E8}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{7AC7FD73-B9B3-47AD-91C2-DAEC4A8B4A6B}"= UDP:c:\program files\12Voip.com\12Voip\12Voip.exe:12Voip
"{83D33930-4CF3-427F-B58E-C1123952AFB2}"= TCP:c:\program files\12Voip.com\12Voip\12Voip.exe:12Voip
"{0DD6F045-3B17-45CF-8C95-5199DDB37989}"= UDP:c:\program files\12Voip.com\12Voip\12Voip.exe:12Voip
"{21A99428-EF30-4A50-B3B0-66835C677C2B}"= TCP:c:\program files\12Voip.com\12Voip\12Voip.exe:12Voip
"{9B77CC5A-7C2E-42D3-B1C2-D5EE077A6813}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{159AF293-4473-475C-B0F1-2EB45C15A7A0}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{01A96246-907B-4535-B3D3-60A373AE5B73}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{60EE3C92-899F-41CA-BF9A-DE7CD16E7672}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{5742B8DD-3167-4070-AA72-85B0D18ED49C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{71622089-F0DD-49E1-A81D-04105C6BF081}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{FB31E84D-6E46-4704-B787-74A426CAA7C6}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{869538C6-97A0-4D16-91C7-098C83090363}"= UDP:c:\program files\VMware\vmware-authd.exe:VMware Authd
"{4E0A059E-71A7-4C69-B13F-33727E481C11}"= TCP:c:\program files\VMware\vmware-authd.exe:VMware Authd
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R1 ehdrv;ehdrv;c:\windows\System32\drivers\ehdrv.sys [12.5.2009 г. 06:33 107256]
R1 VBoxDrv;VirtualBox Service;c:\windows\System32\drivers\VBoxDrv.sys [29.9.2009 г. 14:55 115856]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\System32\drivers\VBoxUSBMon.sys [29.9.2009 г. 14:54 41424]
R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [3.3.2008 г. 13:11 16384]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [12.5.2009 г. 06:33 731840]
R2 epfwwfp;epfwwfp;c:\windows\System32\drivers\epfwwfp.sys [12.5.2009 г. 06:34 38240]
R2 ETService;Empowering Technology Service;c:\program files\EMACHINES\eMachines Recovery Management\Service\ETService.exe [26.12.2008 г. 10:38 24576]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [6.4.2008 г. 22:42 50424]
R2 regi;regi;c:\windows\System32\drivers\regi.sys [17.4.2007 г. 21:09 11032]
R2 vmci;VMware vmci;c:\windows\System32\drivers\vmci.sys [14.8.2009 г. 20:20 54960]
R2 WinFLdrv;WinFLdrv;c:\windows\System32\WinFLdrv.sys [11.6.2009 г. 18:15 10752]
R3 ActivHidSerMini;Promethean Serial Board Driver;c:\windows\System32\drivers\activhidsermini.sys [17.12.2008 г. 10:42 55424]
R3 prmvmouse;Promethean HID Mouse Service;c:\windows\System32\drivers\activmouse.sys [17.12.2008 г. 10:42 4352]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\System32\drivers\VBoxNetAdp.sys [9.9.2009 г. 20:15 91856]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\System32\drivers\VBoxNetFlt.sys [9.9.2009 г. 20:15 100368]
S2 gupdate1c9ed0ba5e15fed;Услуга Google Update (gupdate1c9ed0ba5e15fed);c:\program files\Google\Update\GoogleUpdate.exe [24.9.2009 г. 13:30 133104]
S2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [9.3.2008 г. 23:04 65536]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [4.4.2008 г. 03:03 131072]
S2 VCL MySQL Database Server;VCL MySQL Database Server;c:\музика и програми на фодор\Virtual Chemistry Lab 2.0\mysql\bin\mysqld.exe [3.10.2009 г. 21:32 3956736]
S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\System32\drivers\btnetBus.sys [7.12.2008 г. 12:44 30088]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Corporate Edition\kerneld.wnt [28.8.2009 г. 11:06 23152]
S3 getPlusHelper;getPlus® Helper;c:\windows\System32\svchost.exe -k getPlusHelper [21.1.2008 г. 03:33 21504]
S3 InterServer;InterBase InterClient Server;c:\program files\Borland\InterBase\InterClient\bin\interserver.exe [14.9.2009 г. 16:26 114176]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder
2009-10-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 12:30]
2009-10-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 12:30]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://adventurersbg.info
mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0402&s=2&o=vb32&d=1208&m=e520
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&xportar para o Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\wpclsp.dll
LSP: c:\program files\VMware\vsocklib.dll
FF - ProfilePath - c:\users\Фодор\AppData\Roaming\Mozilla\Firefox\Profiles\43gtkcr2.default\
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-eRecoveryService - (no file)
AddRemove-Counter-Strike 1.6 - c:\музика и програми на фодор\cs\Uninst.exe
AddRemove-D'Accord Drums Player 1.0_is1 - c:\музика и програми на фодор\D_Accord_Drums_Player\unins000.exe
AddRemove-Guitar Pro 5_is1 - c:\музика и програми на фодор\GuitarPro_5.2\GuitarPro 5.2\unins000.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-04 15:05
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\system32\sys_drv.dat 6024 bytes
c:\windows\system32\sys_drv_2.dat 5020 bytes
c:\users\Фодор\AppData\Roaming\systemfl.$dk 990 bytes
scan completed successfully
hidden files: 3
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Corporate Edition\kerneld.wnt"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1891059771-1908516478-2069820796-1000\Software\SecuROM\License information*]
"datasecu"=hex:23,5d,49,12,a0,2a,9d,fb,9a,d8,ac,89,59,3f,fc,27,c7,88,96,7d,a8,
a3,a7,6e,a6,ad,a4,61,c8,6f,01,e5,98,a4,ac,b2,54,f7,e4,e6,36,56,71,42,0f,2d,\
"rkeysecu"=hex:e7,c4,7f,c4,45,c1,81,16,8d,73,11,b5,02,5c,b9,d5
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-10-04 15:08
ComboFix-quarantined-files.txt 2009-10-04 14:08
Pre-Run: 55 278 800 896 bytes livres
Post-Run: 55 189 213 184 bytes livres
367 --- E O F --- 2009-07-16 10:18