Kontrola logu z Combofixu

[JerryMX]

Prosím o kontrolu z Combofixu. Kamarádovo PC se chová nestandartně. Děkuji

ComboFix 10-04-06.05 - Sylvík 07.04.2010 18:44:22.1.1 - x86 MINIMAL
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1250.420.1029.18.1014.452 [GMT 2:00]
Spuštěný z: c:\users\Sylvík\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! Antivirus *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\setup.exe
c:\windows\system32\win32extension.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-03-07 do 2010-04-07 )))))))))))))))))))))))))))))))
.

2010-04-07 16:54 . 2010-04-07 16:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-07 16:41 . 2010-04-07 16:42 -------- d-----w- C:\!KillBox
2010-04-07 16:24 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-07 16:24 . 2010-04-07 16:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-07 16:24 . 2010-04-07 16:24 -------- d-----w- c:\programdata\Malwarebytes
2010-04-07 16:24 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-07 16:14 . 2007-01-31 07:43 176128 ----a-w- c:\windows\system32\igfxres.dll
2010-04-05 10:37 . 2010-02-11 17:42 162512 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-05 10:37 . 2010-02-11 17:38 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-05 10:34 . 2010-04-05 10:34 -------- d-----w- c:\programdata\Alwil Software
2010-04-04 16:58 . 2010-04-04 16:58 -------- d-----w- c:\program files\Common Files\PersonSecurityUninstall
2010-04-04 16:58 . 2010-04-07 16:42 -------- d-----w- c:\program files\PersonSecurity
2010-03-31 16:16 . 2010-03-09 16:54 832512 ----a-w- c:\windows\system32\wininet.dll
2010-03-31 09:45 . 2010-02-12 10:49 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-03-29 18:28 . 2010-03-29 18:30 -------- d-----w- c:\program files\ICQ7.1
2010-03-09 21:22 . 2010-02-20 23:54 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-03-09 21:21 . 2010-02-20 21:30 396800 ----a-w- c:\windows\system32\drivers\http.sys
2010-03-09 21:21 . 2010-02-20 23:51 31232 ----a-w- c:\windows\system32\httpapi.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-07 16:42 . 2007-01-08 21:09 85414 ----a-w- c:\windows\system32\perfc005.dat
2010-04-07 16:42 . 2007-01-08 21:09 485790 ----a-w- c:\windows\system32\perfh005.dat
2010-04-07 16:11 . 2007-11-19 16:37 -------- d-----w- c:\program files\Yahoo!
2010-04-07 16:09 . 2010-01-20 17:01 -------- d-----w- c:\program files\Norton Security Scan
2010-04-07 16:09 . 2009-11-21 14:46 -------- d-----w- c:\programdata\Norton
2010-04-05 10:40 . 2007-11-20 18:00 -------- d-----w- c:\program files\Alwil Software
2010-03-29 18:29 . 2009-10-25 10:49 -------- d-----w- c:\program files\ICQ6Toolbar
2010-03-29 18:29 . 2007-09-05 10:27 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-29 18:29 . 2009-10-25 10:48 -------- d-----w- c:\programdata\ICQ
2010-03-15 13:06 . 2009-01-18 19:29 -------- d-----w- c:\programdata\Google Updater
2010-03-10 10:26 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-03-09 16:50 . 2010-03-31 16:15 56320 ----a-w- c:\windows\system32\iesetup.dll
2010-03-09 16:50 . 2010-03-31 16:15 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-09 16:50 . 2010-03-31 16:15 52736 ----a-w- c:\windows\AppPatch\iebrshim.dll
2010-03-09 16:48 . 2010-03-31 16:15 72704 ----a-w- c:\windows\system32\admparse.dll
2010-03-09 14:17 . 2010-03-31 16:15 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2010-03-09 12:43 . 2010-03-31 16:15 48128 ----a-w- c:\windows\system32\mshtmler.dll
2010-03-07 11:23 . 2009-12-17 20:09 -------- d-----w- c:\program files\Full Tilt Poker
2010-03-03 19:52 . 2010-03-03 19:45 -------- d-----w- c:\programdata\FarmFrenzy2
2010-03-03 19:45 . 2010-03-03 19:45 -------- d-----w- c:\programdata\AlawarWrapper
2010-03-03 19:45 . 2010-03-03 19:45 -------- d-----w- c:\program files\Hry.cz
2010-02-24 09:16 . 2009-10-03 15:15 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-11 17:53 . 2007-11-20 18:00 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-02-11 17:53 . 2007-11-20 18:00 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-02-11 17:42 . 2007-11-20 18:00 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-11 17:39 . 2007-11-20 18:00 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-11 17:38 . 2007-11-20 18:00 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-02-09 19:11 . 2009-01-18 19:29 -------- d-----w- c:\program files\Google
2010-01-25 12:58 . 2010-02-24 17:39 473088 ----a-w- c:\windows\system32\secproc_isv.dll
2010-01-25 12:58 . 2010-02-24 17:39 154112 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-01-25 12:58 . 2010-02-24 17:39 154624 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-25 12:58 . 2010-02-24 17:39 472576 ----a-w- c:\windows\system32\secproc.dll
2010-01-25 12:56 . 2010-02-24 17:39 312320 ----a-w- c:\windows\system32\msdrm.dll
2010-01-25 08:36 . 2010-02-24 17:39 435712 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-25 08:36 . 2010-02-24 17:39 515584 ----a-w- c:\windows\system32\RMActivate.exe
2010-01-25 08:36 . 2010-02-24 17:39 431104 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-25 08:35 . 2010-02-24 17:39 523776 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-23 08:05 . 2010-02-24 17:43 2048 ----a-w- c:\windows\system32\tzres.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}]
2009-11-29 11:51 498688 ----a-w- c:\program files\iMesh Applications\MediaBar\DataMngr\IEBHO.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}]
2009-11-20 17:34 87472 ----a-w- c:\program files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}"= "c:\program files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll" [2009-11-20 87472]

[HKEY_CLASSES_ROOT\clsid\{abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-10 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-18 39408]
"ICQ"="c:\program files\ICQ7.1\ICQ.exe" [2010-03-29 133368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-09-05 1006264]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-23 4435968]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
"eAudio"="c:\acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 1286144]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-31 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-31 151552]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-31 126976]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-11-07 159744]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 206952]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2007-08-31 772616]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-25 136600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-09-10 420176]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ImageMixer HDD Camera Monitor.lnk - c:\program files\PIXELA\ImageMixer3\HDDCameraMonitor.exe [2008-5-1 2117632]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\IMESHA~1\MediaBar\DataMngr\datamngr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R1 aswSP;aswSP; [x]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-02 13560]
R2 aswFsBlk;aswFsBlk; [x]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-02-11 51792]
R2 gupdate1c9863bcd286f06;Google Update Service (gupdate1c9863bcd286f06);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-03 133104]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-02-08 179712]

.
Obsah adresáře 'Naplánované úlohy'

2010-04-05 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-18 07:44]

2010-04-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-03 20:12]

2010-04-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-03 20:12]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://cs.intl.acer.yahoo.com
uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files\ICQ7.1\ICQ.exe
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

BHO-{CDD09383-67FD-4877-A8BF-1EED6367207E} - c:\windows\System32\win32extension.dll
HKLM-Run-SetPanel - c:\acer\APanel\APanel.cmd
HKLM-Run-eRecoveryService - (no file)
HKLM-Run-NWEReboot - (no file)
HKLM-RunOnce-<NO NAME> - (no file)
AddRemove-PersonSecurity - c:\program files\PersonSecurity\psecurity.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-07 18:54
Windows 6.0.6000 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(556)
c:\program files\Aberger\HfAsistent\FotoSync.dll
c:\program files\Aberger\HfAsistent\xerc2701.dll
c:\program files\Aberger\HfAsistent\fotosynr.dll
c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
.
Celkový čas: 2010-04-07 18:56:59
ComboFix-quarantined-files.txt 2010-04-07 16:56

Před spuštěním: 8 240 971 776
Po spuštění: 8 470 704 128

- - End Of File - - 493324147DCCA19DAFA0ED4C2B507D13

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Folder::
c:\progra~1\IMESHA~1\MediaBar

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[JerryMX]

Díkes moc.

[Rudy]

Nemáte zač!