CF mal zase falosnu detekciu - deamon.dll je potrebny pre Deamon TOOLS.
Tu je LOG:
ComboFix 10-07-14.04 - Andy 15.07.2010 16:07:47.1.1 - FAT32x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.767.557 [GMT 2:00]
Spuštěný z: c:\documents and settings\Andy\Dokumenty\Stažené soubory\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\daemon.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-06-15 do 2010-07-15 )))))))))))))))))))))))))))))))
.
2010-07-15 10:57 . 2010-07-15 10:57 -------- d-----w- C:\Temp
2010-07-15 10:57 . 2001-10-19 12:40 438608 ----a-w- c:\windows\system32\wmv8dmod.dll
2010-07-15 10:57 . 2001-10-19 12:40 665424 ----a-w- c:\windows\system32\wmv8dmoe.dll
2010-07-15 10:57 . 2001-10-19 12:39 572752 ----a-w- c:\windows\system32\wmvdmoe.dll
2010-07-15 10:57 . 2001-10-19 12:40 1683792 ----a-w- c:\windows\system32\wmvcore2.dll
2010-07-15 07:50 . 2010-07-15 07:50 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-07-15 07:48 . 2010-07-15 07:48 -------- d-----w- c:\program files\Common Files\Skype
2010-07-15 07:47 . 2010-07-15 07:48 -------- d-----r- c:\program files\Skype
2010-06-20 19:17 . 2001-10-24 09:54 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2010-06-20 19:17 . 2001-10-24 09:54 12160 ----a-w- c:\windows\system32\dllcache\mouhid.sys
2010-06-20 19:17 . 2008-04-13 18:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2010-06-20 18:43 . 2010-06-20 18:43 -------- d-----w- c:\windows\ServicePackFiles
2010-06-20 18:32 . 2008-06-14 17:35 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-06-20 18:32 . 2008-06-14 17:35 272128 ------w- c:\windows\system32\dllcache\bthport.sys
2010-06-20 18:32 . 2009-12-31 16:50 353792 ------w- c:\windows\system32\dllcache\srv.sys
2010-06-20 18:31 . 2010-02-24 13:11 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-06-20 18:31 . 2009-11-21 16:03 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2010-06-20 18:27 . 2008-05-08 14:02 203136 ------w- c:\windows\system32\dllcache\rmcast.sys
2010-06-20 18:27 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-06-20 18:24 . 2008-10-15 16:38 337408 ------w- c:\windows\system32\dllcache\netapi32.dll
2010-06-20 18:23 . 2008-04-21 21:15 216576 ------w- c:\windows\system32\dllcache\wordpad.exe
2010-06-20 18:12 . 2007-07-27 21:11 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2010-06-20 17:56 . 2006-07-13 10:33 674560 ----a-r- c:\windows\system32\drivers\w70n51.sys
2010-06-20 17:56 . 2005-02-25 09:34 995328 ----a-r- c:\windows\system32\W20MLRes.dll
2010-06-20 17:56 . 2005-02-25 09:33 430147 ----a-r- c:\windows\system32\W20NCPA.dll
2010-06-20 17:56 . 2003-11-03 05:55 32768 ----a-r- c:\windows\system32\w70n5msg.dll
2010-06-20 17:25 . 2010-06-20 17:25 -------- d--h--w- c:\documents and settings\Andy\WLANProfiles
2010-06-20 17:25 . 2010-06-20 17:25 14037 ----a-w- c:\windows\system32\drivers\mdc8021x.sys
2010-06-20 17:25 . 2010-06-20 17:25 -------- d-----w- c:\windows\system32\LogFiles
2010-06-20 17:17 . 2010-06-20 17:17 -------- d-----w- c:\windows\nview
2010-06-20 17:17 . 2010-06-20 17:17 -------- d-----w- c:\program files\Common Files\InstallShield
2010-06-20 17:16 . 2009-03-16 21:19 58208 ----a-w- c:\windows\system32\wsimd.sys
2010-06-20 17:16 . 2009-03-16 21:19 58208 ----a-w- c:\windows\system32\drivers\wsimd.sys
2010-06-20 17:16 . 2010-06-20 17:16 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-20 17:16 . 2010-06-20 17:16 -------- d-----w- c:\program files\Atheros
2010-06-20 16:54 . 2010-06-20 16:54 -------- d-----w- c:\windows\system32\DRVSTORE
2010-06-20 16:04 . 2010-06-20 16:04 -------- d-s---w- c:\windows\system32\Microsoft
2010-06-20 16:04 . 2010-06-20 16:04 -------- d-sh--w- c:\documents and settings\LocalService
2010-06-20 16:04 . 2010-06-20 16:04 -------- d-----w- c:\documents and settings\LocalService\Data aplikací
2010-06-20 16:04 . 2010-06-20 16:04 -------- d-----w- c:\documents and settings\NetworkService\Data aplikací
2010-06-20 16:04 . 2010-06-20 16:04 -------- d-sh--w- c:\documents and settings\NetworkService
2010-06-20 16:02 . 2001-10-24 10:25 12288 ----a-w- c:\windows\system32\dllcache\EXCH_smtpctrs.dll
2010-06-20 16:01 . 2006-03-02 12:00 92416 ----a-w- c:\windows\system32\dllcache\mga.sys
2010-06-20 16:00 . 2006-03-02 12:00 6656 ----a-w- c:\windows\system32\dllcache\iissync.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-20 18:28 . 2010-06-20 18:28 -------- d-----w- c:\program files\ESET
2010-06-20 15:58 . 2010-06-20 15:58 -------- d-----w- c:\program files\microsoft frontpage
2010-06-20 15:54 . 2010-06-20 15:54 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-06-19 19:33 . 2010-06-19 19:33 -------- d-----w- c:\program files\D-Tools
2010-06-19 19:06 . 2010-06-19 19:06 -------- d-----w- c:\program files\Common Files\Adobe
2010-06-19 17:59 . 2006-03-02 10:00 46394 ----a-w- c:\windows\system32\perfc005.dat
2010-06-19 17:59 . 2006-03-02 10:00 310228 ----a-w- c:\windows\system32\perfh005.dat
2010-06-19 17:25 . 2010-06-20 15:57 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-06-19 17:25 . 2010-06-20 15:57 2740 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-06-19 17:23 . 2010-06-20 15:57 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-06-18 18:24 . 2010-06-18 18:24 0 ----a-w- c:\windows\nsreg.dat
2010-06-18 13:06 . 2010-06-18 13:07 809872 ----a-w- c:\windows\system32\drivers\LTSM.sys
2010-06-18 12:59 . 2010-06-18 13:00 230416 ----a-w- c:\windows\system32\drivers\stac97.sys
2010-06-18 12:58 . 2010-06-18 12:58 35704 ----a-w- c:\windows\system32\NicInst.dll
2010-06-18 12:58 . 2010-06-18 12:58 28536 ----a-w- c:\windows\system32\NicCo.dll
2010-06-18 12:58 . 2010-06-18 12:58 154496 ----a-w- c:\windows\system32\Prounstl.exe
2010-06-18 12:58 . 2010-06-18 12:58 43880 ----a-w- c:\windows\system32\e100bmsg.dll
2010-06-18 12:58 . 2010-06-18 12:58 165760 ----a-w- c:\windows\system32\drivers\e100b325.sys
2010-05-02 08:09 . 2006-03-02 10:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-20 05:32 . 2006-03-02 10:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-16 16:08 . 2006-03-02 10:00 668160 ----a-w- c:\windows\system32\wininet.dll
2010-04-16 16:08 . 2006-03-02 10:00 81920 ----a-w- c:\windows\system32\ieencode.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-04-15 4866048]
"nwiz"="nwiz.exe" [2004-04-15 323584]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2010-06-20 2347008]
"PRONoMgr.exe"="c:\program files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe" [2003-12-10 86016]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-04-09 2029640]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2003-12-16 06:32 110592 ----a-w- c:\windows\system32\LgNotify.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [19.6.2010 21:33 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [19.6.2010 21:33 5248]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [9.4.2009 15:18 107256]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [9.4.2009 15:19 731840]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://
www.google.sk/
FF - ProfilePath - c:\documents and settings\Andy\Data aplikací\Mozilla\Firefox\Profiles\7bseb0j0.default\
FF - prefs.js: browser.startup.homepage - hxxp://
www.jumpstyle.sk/
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-07-15 16:12
Windows 5.1.2600 Service Pack 3 FAT NTAPI
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,
http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x83B57EC0]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7704f28
\Driver\ACPI -> ACPI.sys @ 0xf7631cb8
\Driver\atapi -> 0x83b57ec0
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0615
ParseProcedure -> ntoskrnl.exe @ 0x8056c3ac
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0615
ParseProcedure -> ntoskrnl.exe @ 0x8056c3ac
NDIS: Intel(R) PRO/Wireless LAN 2100 3B Mini PCI Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf7502bb0
PacketIndicateHandler -> NDIS.sys @ 0xf750fa21
SendHandler -> NDIS.sys @ 0xf74ed87b
Warning: possible MBR rootkit infection !
user & kernel MBR OK
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(1736)
c:\windows\system32\LgNotify.dll
.
Celkový čas: 2010-07-15 16:13:28
ComboFix-quarantined-files.txt 2010-07-15 14:13
Před spuštěním: Volných bajtů: 11 186 176 000
Po spuštění: Volných bajtů: 11 181 899 776
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - B8C020F99ACFA4662E0A7DB2812008D7