ComboFix 10-06-05.02 - Jirka 07.06.2010 20:56:42.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.2047.1374 [GMT 2:00]
Spuštěný z: c:\users\Jirka\Desktop\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
SP: ESET Smart Security 3.0 *disabled* (Updated) {E5E70D32-0101-4B98-A4D6-D1D15C3BB448}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-05-07 do 2010-06-07 )))))))))))))))))))))))))))))))
.
2010-06-07 19:05 . 2010-06-07 19:05 -------- d-----w- c:\users\Jirka\AppData\Local\temp
2010-06-07 19:05 . 2010-06-07 19:05 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-06-07 19:05 . 2010-06-07 19:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-06-06 20:49 . 2010-05-31 08:41 998736 ----a-w- c:\windows\system32\drivers\TDSSKiller.exe
2010-06-06 14:02 . 2010-06-06 14:01 318976 ----a-w- c:\windows\system32\CF13246.exe
2010-05-27 21:12 . 2010-04-23 14:13 2048 ----a-w- c:\windows\system32\tzres.dll
2010-05-12 11:17 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-05-10 21:02 . 2010-05-10 21:02 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-05-10 21:01 . 2010-05-10 21:02 -------- d-----w- c:\program files\DAEMON Tools Lite
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-07 19:01 . 2007-01-08 21:09 607294 ----a-w- c:\windows\system32\perfh005.dat
2010-06-07 19:01 . 2007-01-08 21:09 119760 ----a-w- c:\windows\system32\perfc005.dat
2010-06-07 18:34 . 2009-11-13 03:43 34901 ----a-w- c:\programdata\nvModes.dat
2010-06-07 07:40 . 2009-03-26 10:26 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-06-06 23:12 . 2009-06-06 20:54 -------- d-----w- c:\program files\Trend Micro
2010-06-06 14:08 . 2009-04-28 08:35 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-06 13:37 . 2009-03-25 16:51 -------- d-----w- c:\users\Jirka\AppData\Roaming\Media Player Classic
2010-06-06 13:36 . 2009-03-22 10:29 -------- d-----w- c:\program files\CCleaner
2010-06-04 15:33 . 2009-07-28 18:47 -------- d-----w- c:\users\Jirka\AppData\Roaming\Skype
2010-06-04 14:09 . 2009-07-28 18:53 -------- d-----w- c:\users\Jirka\AppData\Roaming\skypePM
2010-05-27 21:05 . 2009-10-03 12:24 -------- d-----w- c:\users\Jirka\AppData\Roaming\HpUpdate
2010-05-27 21:00 . 2009-09-26 12:25 -------- d-----w- c:\programdata\HP Product Assistant
2010-05-27 21:00 . 2009-09-30 17:41 -------- d-----w- c:\program files\Internet Download Manager
2010-05-21 12:14 . 2009-10-02 23:45 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-17 14:15 . 2010-06-06 20:49 2258 ----a-w- c:\windows\system32\drivers\eula.txt
2010-05-16 11:22 . 2009-03-27 00:21 -------- d-----w- c:\users\Jirka\AppData\Roaming\Vso
2010-05-12 20:15 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-05-10 21:02 . 2009-06-24 13:51 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-05-10 20:58 . 2009-06-25 09:16 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-05-10 20:29 . 2010-04-03 12:31 -------- d-----w- c:\program files\Uloz.to Uploader
2010-05-01 06:45 . 2010-03-25 10:23 -------- d-----w- c:\program files\Opera
2010-04-27 12:45 . 2010-04-27 12:45 72856 ----a-w- c:\windows\system32\xliveinstallhost.exe
2010-04-27 12:45 . 2010-04-27 12:45 187544 ----a-w- c:\windows\system32\xliveinstall.dll
2010-04-25 21:56 . 2010-04-25 21:56 -------- d-----w- c:\program files\Ligos
2010-04-25 20:36 . 2010-04-25 20:36 -------- d-----w- c:\users\Jirka\AppData\Roaming\2K Sports
2010-04-25 20:20 . 2010-04-25 20:20 -------- d-----w- c:\program files\2K Sports
2010-04-25 11:25 . 2009-03-22 00:13 -------- d-----w- c:\programdata\NVIDIA
2010-04-25 11:25 . 2010-03-11 03:11 -------- d-----w- c:\program files\NVIDIA Corporation
2010-04-24 19:38 . 2010-04-24 19:36 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-04-24 19:38 . 2010-04-24 19:36 38784 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-04-24 19:37 . 2009-06-05 09:37 -------- d-----w- c:\programdata\Electronic Arts
2010-04-21 13:34 . 2009-07-18 13:37 -------- d-----w- c:\program files\Sony Ericsson
2010-04-21 13:34 . 2009-03-22 20:42 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-21 13:33 . 2010-04-21 13:33 -------- d-----w- c:\program files\Avanquest update
2010-04-18 11:59 . 2010-04-18 12:00 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-16 14:49 . 2010-04-16 13:27 325177 ----a-w- c:\windows\hpoins12.dat
2010-04-16 14:47 . 2009-04-06 21:56 -------- d-----w- c:\users\Jirka\AppData\Roaming\Image Zone Express
2010-04-16 14:43 . 2010-04-16 14:43 -------- d-----w- c:\program files\Hewlett-Packard
2010-04-11 14:59 . 2009-10-19 16:38 181096 ----a-w- c:\users\Jirka\AppData\Roaming\Mozilla\Firefox\Profiles\vuhsvq3u.default\FlashGot.exe
2010-04-10 10:41 . 2009-06-23 08:23 -------- d-----w- c:\users\Jirka\AppData\Roaming\ICQ
2010-04-03 16:27 . 2010-04-03 16:27 985704 ----a-w- c:\windows\system32\nvsvc.dll
2010-04-03 16:27 . 2010-04-03 16:27 13683816 ----a-w- c:\windows\system32\nvcpl.dll
2010-04-03 16:27 . 2010-04-03 16:27 129640 ----a-w- c:\windows\system32\nvvsvc.exe
2010-04-03 16:27 . 2010-04-03 16:27 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-04-02 15:17 . 2010-04-02 15:17 15426200 ----a-w- c:\windows\system32\xlive.dll
2010-04-02 15:17 . 2010-04-02 15:17 13642904 ----a-w- c:\windows\system32\xlivefnt.dll
2010-04-01 20:04 . 2010-04-01 19:58 69 ----a-w- c:\users\Jirka\jagex_runescape_preferences2.dat
2010-04-01 19:58 . 2010-04-01 19:56 41 ----a-w- c:\users\Jirka\jagex_runescape_preferences.dat
2010-03-25 09:27 . 2010-03-25 09:27 1107264 ----a-w- c:\users\Jirka\AppData\Roaming\Mozilla\Firefox\Profiles\vuhsvq3u.default\extensions\
DTToolbar@toolbarnet.com\components\DTToolbarFF.dll
2010-03-23 23:31 . 2010-03-23 23:31 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-03-23 23:31 . 2010-03-23 23:31 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-03-23 23:31 . 2010-03-23 23:31 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-03-23 23:31 . 2010-03-23 23:31 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-03-23 23:31 . 2010-03-23 23:31 49152 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-03-23 23:31 . 2010-03-23 23:31 40960 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-03-23 23:31 . 2010-03-23 23:31 341600 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-03-23 23:31 . 2010-03-23 23:31 308808 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-03-23 23:31 . 2010-03-23 23:31 14848 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-03-16 22:09 . 2009-03-21 21:37 49168 ----a-w- c:\users\Jirka\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UIWatcher"="c:\program files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe" [2009-02-23 3508568]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-03-12 6965792]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-23 202256]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"VistaSp2"=hex(b):f0,e7,89,9f,2d,fb,c9,01
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-05-10 691696]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2009-07-25 13224]
R3 se3ebus;Sony Ericsson Device 062 (WDM);c:\windows\system32\DRIVERS\se3ebus.sys [2007-04-10 83080]
R3 se3emdfl;Sony Ericsson Device 062 USB WMC Modem Filter;c:\windows\system32\DRIVERS\se3emdfl.sys [2007-04-10 15112]
R3 se3emdm;Sony Ericsson Device 062 USB WMC Modem Driver;c:\windows\system32\DRIVERS\se3emdm.sys [2007-04-10 108552]
R3 se3emgmt;Sony Ericsson Device 062 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\se3emgmt.sys [2007-04-10 100360]
R3 se3eobex;Sony Ericsson Device 062 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\se3eobex.sys [2007-04-10 98568]
R3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys [x]
S2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 3xHybrid;3xHybrid service;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-04-20 674048]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://
www.daemon-search.com/startpage
IE: Download all by FlashGet3 - c:\users\Jirka\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
IE: Download by FlashGet3 - c:\users\Jirka\AppData\Roaming\FlashGetBHO\GetUrl.htm
Trusted Zone: kuaiche.com\software
FF - ProfilePath - c:\users\Jirka\AppData\Roaming\Mozilla\Firefox\Profiles\vuhsvq3u.default\
FF - prefs.js: browser.startup.homepage - hxxp://
www.centrum.cz/
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - component: c:\users\Jirka\AppData\Roaming\Mozilla\Firefox\Profiles\vuhsvq3u.default\extensions\{7378B8C2-FC38-41b8-A8C9-875D1F5B0A24}\components\NativeComponent.dll
FF - component: c:\users\Jirka\AppData\Roaming\Mozilla\Firefox\Profiles\vuhsvq3u.default\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}\components\FlashgetXpi.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Opera\program\plugins\Npindeo.dll
FF - plugin: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- NASTAVENÍ FIREFOXU ----
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-06-07 21:05
Windows 6.0.6002 Service Pack 2 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-3770246164-1455068142-2756262975-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:30,be,7a,e3,a2,2b,71,63,2d,48,b5,27,7a,1d,af,64,a1,23,24,83,a3,d3,95,
82,4b,d4,64,78,a7,7f,28,e2,bf,0c,96,fb,0a,cd,e7,d7,93,4d,42,9d,15,ed,1b,3b,\
"??"=hex:6c,cb,1b,99,c2,8a,d9,a1,1a,70,a0,28,38,3f,f5,29
[HKEY_USERS\S-1-5-21-3770246164-1455068142-2756262975-1000\Software\SecuROM\License information*]
"datasecu"=hex:37,82,9b,f1,8c,01,f5,93,9a,fc,fa,db,31,35,42,e3,32,35,0a,89,50,
6d,5d,88,ca,a9,4f,af,60,65,ce,31,5d,22,9c,cd,8c,83,aa,61,a9,ee,75,ee,86,2a,\
"rkeysecu"=hex:e2,34,26,8b,df,c8,0d,33,12,f3,82,33,39,4b,54,6b
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2010-06-07 21:08:10
ComboFix-quarantined-files.txt 2010-06-07 19:08
ComboFix2.txt 2010-06-06 14:32
Před spuštěním: Volných bajtů: 29 301 153 792
Po spuštění: Volných bajtů: 29 268 140 032
- - End Of File - - ABBD9CAED2FD782AB035D768B1D3FBB8
