Log z RSIT kontrola PC

[Blein]

Kurňa, jsu k*kot, po přihlášení ve večerních hodinách jsem se musel dostat na jiné téma a nevšimnout si toho. Kopíroval jsem do txt souboru scripty a dával to do combofixu, všiml jsem si toho teď, že nic o combofixu zde není psané, jak se dostanu z práce domů, přiložím zde log z combofixu, který jsem ráno uložil, co jsem poku****.

[Blein]

ComboFix 14-01-16.03 - Chiko 01.01.2004 1:29.29.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.511.251 [GMT 1:00]
Spuštěný z: c:\documents and settings\Chiko\Plocha\combofix.exe
Použité ovládací přepínače :: c:\documents and settings\Chiko\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Nakažená kopie c:\windows\system32\msgsvc.dll byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ERDNT\cache\msgsvc.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2003-12-01 do 2004-01-01 )))))))))))))))))))))))))))))))
.
.
2013-02-24 15:42 . 2013-02-24 15:42 -------- d-----w- C:\Microgaming
2013-02-19 15:28 . 2013-02-19 15:28 -------- d-----w- C:\Downloads
2012-12-29 22:40 . 2012-12-29 22:40 -------- d-----w- C:\rsit
2011-11-16 18:50 . 2011-11-16 18:50 -------- d-----r- C:\MSOCache
2009-03-17 22:03 . 2010-02-06 18:57 -------- d-----w- C:\f476242afb5ead956495f10a89
2008-05-08 14:01 . 2003-12-31 23:15 -------- d-----w- C:\Program Files
2008-05-08 14:00 . 2011-01-03 11:39 -------- d-----w- C:\Documents and Settings
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-27 16:37 . 2012-07-27 16:37 20 ----a-w- c:\documents and settings\Chiko\Data aplikací\D9293FD.tmp
2012-04-22 21:18 . 2012-07-03 15:09 17920 ----a-w- c:\documents and settings\Chiko\Data aplikací\OpenCL.dll
2012-04-15 07:55 . 2012-07-03 15:09 262144 ----a-w- c:\documents and settings\Chiko\Data aplikací\wingpu64.exe
2012-02-23 20:06 . 2012-07-03 15:09 68096 ----a-w- c:\documents and settings\Chiko\Data aplikací\pthreadGC2.dll
2012-02-23 20:06 . 2012-07-03 15:09 87054 ----a-w- c:\documents and settings\Chiko\Data aplikací\libpdcurses.dll
2012-02-23 20:06 . 2012-07-03 15:09 249344 ----a-w- c:\documents and settings\Chiko\Data aplikací\libcurl-4.dll
2011-11-30 15:50 . 2010-09-24 19:33 138056 ----a-w- c:\documents and settings\Chiko\Data aplikací\PnkBstrK.sys
2010-03-18 08:15 . 2010-03-18 08:15 36176 ----a-w- c:\windows\system32\mfc100cht.dll
2010-03-18 08:15 . 2010-03-18 08:15 36176 ----a-w- c:\windows\system32\mfc100chs.dll
2008-05-09 13:58 . 2008-05-09 09:15 87608 -c--a-w- c:\documents and settings\Chiko\Data aplikací\inst.exe
2008-05-09 13:58 . 2008-05-09 09:15 47360 -c--a-w- c:\documents and settings\Chiko\Data aplikací\pcouffin.sys
2008-04-14 03:22 . 2008-05-08 12:07 150528 -c--a-w- c:\windows\pchealth\UploadLB\Binaries\uploadm.exe
2008-04-14 03:22 . 2004-08-18 12:00 14336 ----a-w- c:\windows\system32\svchost.exe
2008-04-14 03:22 . 2008-05-08 12:07 171008 -c--a-w- c:\windows\pchealth\helpctr\binaries\msconfig.exe
2008-04-14 03:22 . 2008-05-08 12:07 18432 -c--a-w- c:\windows\pchealth\helpctr\binaries\hscupd.exe
2008-04-14 03:22 . 2008-05-08 12:07 769024 -c--a-w- c:\windows\pchealth\helpctr\binaries\helpctr.exe
2008-04-14 03:22 . 2008-05-08 12:07 744448 -c--a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2008-04-14 03:22 . 2004-08-18 12:00 601088 -c--a-w- c:\windows\system32\autochk.exe
2008-04-14 03:22 . 2004-08-18 12:00 278528 ------w- c:\windows\system32\webcheck.dll
2008-04-14 03:22 . 2008-04-14 03:22 11325 -c----w- c:\windows\system32\drivers\vchnt5.dll
2008-04-14 03:22 . 2004-08-18 12:00 279040 -c--a-w- c:\windows\help\tshoot.dll
2008-04-14 03:22 . 2008-05-08 12:07 726590 -c--a-w- c:\windows\srchasst\srchui.dll
2008-04-14 03:22 . 2008-05-08 12:07 58434 -c--a-w- c:\windows\srchasst\srchctls.dll
2008-04-14 03:22 . 2004-08-18 12:00 33280 -c--a-w- c:\windows\help\sstub.dll
2008-04-14 03:21 . 2004-08-18 12:00 34816 -c--a-w- c:\windows\help\sniffpol.dll
2008-04-14 03:21 . 2004-08-18 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2008-04-14 03:21 . 2008-05-08 12:07 38400 -c--a-w- c:\windows\pchealth\helpctr\binaries\pchsvc.dll
2008-04-14 03:21 . 2008-05-08 12:07 102912 -c--a-w- c:\windows\pchealth\helpctr\binaries\pchshell.dll
2008-04-14 03:21 . 2008-05-08 12:07 3166208 -c--a-w- c:\windows\srchasst\msgr3en.dll
2008-04-14 03:21 . 2008-05-08 12:07 378880 -c--a-w- c:\windows\pchealth\helpctr\binaries\msinfo.dll
2008-04-14 03:21 . 2004-08-18 12:00 451072 -c--a-w- c:\windows\apppatch\aclayers.dll
2008-04-14 03:21 . 2004-08-18 12:00 245248 -c--a-w- c:\windows\apppatch\acspecfc.dll
2008-04-14 03:21 . 2004-08-18 12:00 1852928 ----a-w- c:\windows\apppatch\acgenral.dll
2008-04-14 03:21 . 2004-08-18 12:00 141312 -c--a-w- c:\windows\apppatch\aclua.dll
2008-04-14 03:21 . 2004-08-18 12:00 116224 -c--a-w- c:\windows\apppatch\acxtrnal.dll
2008-04-14 03:21 . 2008-04-14 03:21 39424 ------w- c:\windows\apppatch\acadproc.dll
2008-04-13 18:45 . 2001-08-17 22:03 25728 -c--a-w- c:\windows\system32\drivers\usbcamd2.sys
2008-04-13 18:45 . 2001-08-17 22:03 25600 -c--a-w- c:\windows\system32\drivers\usbcamd.sys
2008-03-25 04:50 . 2004-08-18 12:00 518944 -c--a-w- c:\windows\system32\msexch40.dll
2004-08-18 12:00 . 2008-05-08 12:08 99840 -c--a-w- c:\windows\pchealth\helpctr\binaries\HelpHost.exe
2004-08-18 12:00 . 2008-05-08 12:08 7168 -c--a-w- c:\windows\pchealth\helpctr\binaries\HCAppRes.dll
2004-08-18 12:00 . 2008-05-08 12:08 35328 -c--a-w- c:\windows\pchealth\helpctr\binaries\notiflag.exe
2004-08-18 12:00 . 2008-05-08 12:08 21504 -c--a-w- c:\windows\pchealth\helpctr\binaries\brpinfo.dll
2004-08-18 12:00 . 2008-05-08 12:06 35328 -c--a-w- c:\windows\system32\winchat.exe
2004-08-18 12:00 . 2004-08-18 12:00 3374640 -c--a-w- c:\windows\help\Tours\mmTour\tour.exe
2004-08-18 12:00 . 2004-08-18 12:00 152576 -c--a-w- c:\windows\help\bnts.dll
2004-08-18 12:00 . 2001-10-24 12:25 77891 -c--a-w- c:\windows\system32\usrmlnka.exe
2004-08-18 12:00 . 2001-10-24 12:25 69700 -c--a-w- c:\windows\system32\usrshuta.exe
2004-08-18 12:00 . 2001-10-24 12:25 56320 -c--a-w- c:\windows\system32\dvdplay.exe
2004-08-18 12:00 . 2001-10-24 12:25 13824 -c--a-w- c:\windows\system32\wowfaxui.dll
2004-08-18 12:00 . 2001-10-24 12:25 86073 -c--a-w- c:\windows\system32\usrfaxa.dll
2004-08-18 12:00 . 2001-10-24 12:25 8192 -c--a-w- c:\windows\system32\streamci.dll
2004-08-18 12:00 . 2001-10-24 12:25 77890 -c--a-w- c:\windows\system32\usrdpa.dll
2004-08-18 12:00 . 2001-10-24 12:25 77883 -c--a-w- c:\windows\system32\usrrtosa.dll
2004-08-18 12:00 . 2001-10-24 12:25 72192 -c--a-w- c:\windows\system32\sprio800.dll
2004-08-18 12:00 . 2001-10-24 12:25 70656 -c--a-w- c:\windows\system32\sprio600.dll
2004-08-18 12:00 . 2001-10-24 12:25 69699 -c--a-w- c:\windows\system32\usrcoina.dll
2004-08-18 12:00 . 2001-10-24 12:25 61500 -c--a-w- c:\windows\system32\usrcntra.dll
2004-08-18 12:00 . 2001-10-24 12:25 53305 -c--a-w- c:\windows\system32\usrlbva.dll
2004-08-18 12:00 . 2001-10-24 12:25 49211 -c--a-w- c:\windows\system32\usrvpa.dll
2004-08-18 12:00 . 2001-10-24 12:25 49211 -c--a-w- c:\windows\system32\usrsdpia.dll
2004-08-18 12:00 . 2001-10-24 12:25 49209 -c--a-w- c:\windows\system32\usrv80a.dll
2004-08-18 12:00 . 2001-10-24 12:25 45116 -c--a-w- c:\windows\system32\usrvoica.dll
2004-08-18 12:00 . 2001-10-24 12:25 41019 -c--a-w- c:\windows\system32\usrsvpia.dll
2004-08-18 12:00 . 2001-10-24 12:25 323641 -c--a-w- c:\windows\system32\usrdtea.dll
2004-08-18 12:00 . 2001-10-24 12:25 102457 -c--a-w- c:\windows\system32\usrv42a.dll
2004-08-18 12:00 . 2001-10-24 12:25 69632 -c--a-w- c:\windows\system32\spnike.dll
2004-08-18 12:00 . 2001-10-24 12:25 157696 -c--a-w- c:\windows\system32\paqsp.dll
2004-08-18 12:00 . 2001-10-24 12:24 147968 -c--a-w- c:\windows\system32\mdwmdmsp.dll
2004-08-18 12:00 . 2001-10-24 12:24 3200 -c--a-w- c:\windows\system32\wowfax.dll
2004-08-18 12:00 . 2001-10-24 11:55 12160 -c--a-w- c:\windows\system32\drivers\fsvga.sys
2004-08-18 12:00 . 2001-10-24 11:53 262528 -c--a-w- c:\windows\system32\drivers\cinemst2.sys
2004-08-18 12:00 . 2001-08-18 06:37 61508 -c--a-w- c:\windows\system32\usrprbda.exe
2004-08-18 12:00 . 2001-08-17 22:06 21376 -c--a-w- c:\windows\system32\drivers\tsbvcap.sys
2004-08-18 12:00 . 2001-08-17 22:02 58112 -c--a-w- c:\windows\system32\drivers\vdmindvd.sys
2004-08-18 12:00 . 2001-08-17 22:01 51712 -c--a-w- c:\windows\system32\drivers\tosdvd.sys
2004-08-18 12:00 . 2001-08-17 21:52 18688 -c--a-w- c:\windows\system32\drivers\cdaudio.sys
2004-08-18 12:00 . 2001-08-17 21:24 12032 -c--a-w- c:\windows\system32\drivers\riodrv.sys
2004-08-18 12:00 . 2001-08-17 21:24 12032 -c--a-w- c:\windows\system32\drivers\rio8drv.sys
2004-08-18 12:00 . 2001-08-17 21:24 12032 -c--a-w- c:\windows\system32\drivers\nikedrv.sys
2004-08-18 12:00 . 2001-08-17 21:24 11776 -c--a-w- c:\windows\system32\drivers\cpqdap01.sys
2003-12-31 23:02 . 2012-08-13 14:47 0 ---ha-w- c:\documents and settings\Chiko\Data aplikací\wincfg32.sys
2003-12-01 15:20 . 2003-12-01 15:20 4832 ----a-w- c:\windows\system32\drivers\sfhlp01.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0autocheck lsdelete\0sremcon.exe
.
[HKLM\~\startupfolder\C:^Documents and Settings^Chiko^Nabídka Start^Programy^Po spuštění^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
path=c:\documents and settings\Chiko\Nabídka Start\Programy\Po spuštění\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk
backup=c:\windows\pss\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2007-04-16 13:28 577536 ----a-w- c:\windows\soundman.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\uTorrent - portable\\utorrent.exe"=
"c:\\Program Files\\MirandaPack\\miranda32.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\NHL 09\\nhl2009.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\documents and settings\Chiko\P-7-78-8964-9648-3874\windll.exe"=
"c:\documents and settings\Chiko\P-7-78-8964-9648-3874\winpvc.exe"=
"d:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"d:\\Program Files\\SopCast\\SopCast.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"56955:TCP"= 56955:TCP:Pando Media Booster
"56955:UDP"= 56955:UDP:Pando Media Booster
.
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2.1.2013 20:18 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2.1.2013 20:18 361032]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2.1.2013 20:18 21256]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [16.9.2013 11:29 3273088]
R2 WDFME;WD File Management Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [9.3.2011 11:18 1060864]
R2 WDSC;WD File Management Shadow Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [9.3.2011 11:16 484352]
S2 SkypeUpdate;Skype Updater;d:\program files\Skype\Updater\Updater.exe [28.2.2013 19:09 161384]
S3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [18.5.2008 10:55 2679168]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\Chiko\LOCALS~1\Temp\ALSysIO.sys --> c:\docume~1\Chiko\LOCALS~1\Temp\ALSysIO.sys [?]
S3 ATP;Comodo EasyVPN Miniport Driver;c:\windows\system32\DRIVERS\cmdatp.sys --> c:\windows\system32\DRIVERS\cmdatp.sys [?]
S3 cpuz130;cpuz130;\??\c:\docume~1\Chiko\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\Chiko\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [1.1.2004 0:21 40776]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [9.5.2008 10:15 47360]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [1.12.2009 15:49 34384]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [1.1.2004 3:18 11520]
.
Obsah adresáře 'Naplánované úlohy'
.
2004-01-01 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-01-02 22:50]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2004-01-01 07:35
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(776)
c:\windows\system32\Ati2evxx.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
- - - - - - - > 'explorer.exe'(2072)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\Ati2evxx.exe
.
**************************************************************************
.
Celkový čas: 2004-01-01 07:39:44 - počítač byl restartován
ComboFix-quarantined-files.txt 2004-01-01 06:39
ComboFix2.txt 2004-01-01 05:19
ComboFix3.txt 2013-12-25 12:24
ComboFix4.txt 2013-08-28 11:09
ComboFix5.txt 2003-12-31 23:08
.
Před spuštěním: Volných bajtů: 16 065 097 728
Po spuštění: Volných bajtů: 15 812 079 616
.
- - End Of File - - 5D81894EAEFFE517A5CB974C8AE205D8
413FC2A0C716421B3158746D63736515

[vyosek]

Jak se chova nas pacient??