tak tu je to z combofixu
ComboFix 10-11-16.05 - AMD . 11. 2010 15:06:08.16.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1029.18.511.247 [GMT 1:00]
Running from: c:\documents and settings\AMD\Plocha\ComboFix.exe
Command switches used :: c:\documents and settings\AMD\Plocha\CFScript.txt
AV: Eset NOD32 Antivirus 2.70 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active
.
The following files were disabled during the run:
c:\program files\iolo\Common\Lib\sguard.dll
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
Infected copy of c:\windows\system32\drivers\atapi.sys was found and disinfected
Restored copy from - c:\windows\system32\dllcache\atapi.sys
.
((((((((((((((((((((((((( Files Created from 2010-10-18 to 2010-11-18 )))))))))))))))))))))))))))))))
.
2010-11-17 14:23 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-11-17 14:11 . 2010-11-17 14:53 -------- d-----w- c:\documents and settings\AMD\Local Settings\Data aplikací\ConduitEngine
2010-11-17 14:11 . 2010-11-17 14:11 -------- d-----w- c:\program files\ConduitEngine
2010-11-17 14:11 . 2010-11-17 14:11 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2010-11-14 09:59 . 2010-11-14 09:59 -------- d-----w- c:\documents and settings\AMD\Data aplikací\GanymedeNet
2010-11-14 09:58 . 2010-09-21 15:30 120296 ----a-w- c:\program files\Mozilla Firefox\plugins\npganymedenet.dll
2010-11-14 09:57 . 2010-11-14 09:58 -------- d-----w- c:\program files\Ganymede
2010-11-06 18:57 . 2010-11-06 18:57 -------- d-----w- c:\program files\Governor of Poker
2010-11-06 18:49 . 2010-11-06 18:49 -------- d-----w- c:\program files\bfgclient
2010-11-06 18:43 . 2010-11-06 18:50 -------- d-----w- c:\documents and settings\All Users\Data aplikací\BigFishGamesCache
2010-11-05 14:10 . 2010-11-14 14:56 -------- d-----w- c:\program files\Valve
2010-11-02 19:47 . 2010-11-02 19:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\hps
2010-11-02 19:25 . 2010-11-02 19:25 -------- d-----w- c:\program files\Fotolab
2010-10-30 11:05 . 2006-06-07 20:43 5050368 ----a-w- c:\windows\system32\Kopie - atioglxx.dll
2010-10-25 18:24 . 2010-10-25 18:24 -------- d-----w- c:\documents and settings\AMD\Data aplikací\PlayFirst
2010-10-25 18:23 . 2010-10-25 18:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\PlayFirst
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
[7] CDFE4411A69C224BD1D11B2DA92DAC51 95360 c:\windows\system32\dllcache\atapi.sys
[7] CDFE4411A69C224BD1D11B2DA92DAC51 95360 \RP857\A1294337.sys
[7] CDFE4411A69C224BD1D11B2DA92DAC51 95360 \RP859\A1300062.sys
[-] !HASH: COULD NOT OPEN FILE !!!!! 95360 c:\windows\system32\drivers\atapi.sys
[7] CDFE4411A69C224BD1D11B2DA92DAC51 95360 \RP857\A1294333.sys
[7] CDFE4411A69C224BD1D11B2DA92DAC51 95360 \RP859\A1300058.sys
.
------- Sigcheck -------
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\atapi.sys
[-] 2004-08-03 20:59 . !HASH: COULD NOT OPEN FILE !!!!! . 95360 . . [------] . . c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{da21bd13-ca22-42e3-a071-98f08f1ca1e7}"= "c:\program files\Peer2Peer-EN\tbPee2.dll" [2010-10-18 3908192]
"{9565115d-c7d6-46d3-bd63-b67b481a4368}"= "c:\program files\PageRage\tbPag2.dll" [2010-10-18 3908192]
"{ce10bf86-da68-441e-91fa-38336363e3cd}"= "c:\program files\Movier-media\tbMov0.dll" [2010-09-26 2735200]
[HKEY_CLASSES_ROOT\clsid\{da21bd13-ca22-42e3-a071-98f08f1ca1e7}]
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
[HKEY_CLASSES_ROOT\clsid\{ce10bf86-da68-441e-91fa-38336363e3cd}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\PageRage\tbPag2.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ce10bf86-da68-441e-91fa-38336363e3cd}]
2010-09-26 17:56 2735200 ----a-w- c:\program files\Movier-media\tbMov0.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{da21bd13-ca22-42e3-a071-98f08f1ca1e7}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\Peer2Peer-EN\tbPee2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{da21bd13-ca22-42e3-a071-98f08f1ca1e7}"= "c:\program files\Peer2Peer-EN\tbPee2.dll" [2010-10-18 3908192]
"{9565115d-c7d6-46d3-bd63-b67b481a4368}"= "c:\program files\PageRage\tbPag2.dll" [2010-10-18 3908192]
"{ce10bf86-da68-441e-91fa-38336363e3cd}"= "c:\program files\Movier-media\tbMov0.dll" [2010-09-26 2735200]
[HKEY_CLASSES_ROOT\clsid\{da21bd13-ca22-42e3-a071-98f08f1ca1e7}]
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
[HKEY_CLASSES_ROOT\clsid\{ce10bf86-da68-441e-91fa-38336363e3cd}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{DA21BD13-CA22-42E3-A071-98F08F1CA1E7}"= "c:\program files\Peer2Peer-EN\tbPee2.dll" [2010-10-18 3908192]
"{9565115D-C7D6-46D3-BD63-B67B481A4368}"= "c:\program files\PageRage\tbPag2.dll" [2010-10-18 3908192]
"{CE10BF86-DA68-441E-91FA-38336363E3CD}"= "c:\program files\Movier-media\tbMov0.dll" [2010-09-26 2735200]
[HKEY_CLASSES_ROOT\clsid\{da21bd13-ca22-42e3-a071-98f08f1ca1e7}]
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
[HKEY_CLASSES_ROOT\clsid\{ce10bf86-da68-441e-91fa-38336363e3cd}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-10-12 949376]
"Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2005-10-27 139264]
"NortonOnlineBackupReminder"="c:\program files\Symantec\Norton Online Backup\Activation\NOBuActivation.exe" [2009-11-03 3272552]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Data aplikací\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0smrgdf c:\program files\iolo\System Mechanic Professional 6\
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd
"NeroFilterCheck"=c:\program files\Common Files\Nero\Lib\NeroCheck.exe
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"Monitor"=c:\windows\PixArt\PAC7311\Monitor.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Free Download Manager\\fdm.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\ICQ619_56_29\\ICQ.exe"=
"c:\\Program Files\\ICQ615_08_18\\ICQ.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Graffiti Studio 2.0\\Graffiti Studio.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [17. 8. 2007 8:31 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [17. 8. 2007 8:31 5248]
R0 rttmntr;R-TT Backup Archive Explorer;c:\windows\system32\drivers\rttmntr.sys [19. 11. 2004 15:11 200512]
R0 snaprtt;R-TT Snapshots Manager;c:\windows\system32\drivers\snaprtt.sys [19. 11. 2004 15:11 78624]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30. 6. 2007 11:14 685816]
R1 anf0100.sys;anf0100.sys;c:\windows\system32\drivers\anf0100.sys [8. 12. 2009 14:19 9728]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [12. 10. 2007 19:01 15424]
R2 rttfsfilt;R-TT FS Filter;c:\windows\system32\drivers\rttfsfilt.sys [19. 11. 2004 15:11 27936]
S2 gupdate1ca2e612c1446a;Služba Google Update (gupdate1ca2e612c1446a);c:\program files\Google\Update\GoogleUpdate.exe [5. 9. 2009 20:42 133104]
S3 SE402RefCameraStill;miniSHOT (WDM);c:\windows\system32\drivers\aox402sc.sys [1. 9. 2007 15:02 67332]
--- Other Services/Drivers In Memory ---
*Deregistered* - mchInjDrv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
2010-11-12 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 13:13]
2010-11-18 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-01-08 19:09]
2010-11-18 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1606980848-362288127-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 20:09]
2010-11-18 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1606980848-362288127-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 20:09]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://
www.google.sk/
uDefault_Search_URL = hxxp://
www.google.com/ie
uInternet Settings,ProxyOverride = local
uSearchAssistant = hxxp://
www.google.com/ie
uSearchURL,(Default) = hxxp://
www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Prevziať pomocou FDM - file://c:\program files\Free Download Manager\dllink.htm
IE: Prevziať video pomocou FDM - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Prevziať vybrané pomocou FDM - file://c:\program files\Free Download Manager\dlselected.htm
IE: Prevziať všetko pomocou FDM - file://c:\program files\Free Download Manager\dlall.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} -
LSP: c:\windows\system32\imon.dll
TCP: {3C14DDFA-0C1A-49B7-B680-3FF8FC9E8231} = 10.1.1.2,192.168.202.1
DPF: {3D54FEE0-CE46-11D4-8288-0050BA6A5ABF} - file://c:\program files\NewSoft\Presto! Mr.Photo 3\CardExpr\iepiev20.cab
DPF: {8B0C8CF4-17F3-42D5-8D62-95F2E8339C26} - hxxp://symantec.softmall.com.tw/ftcdm/ftcdm.cab
FF - ProfilePath - c:\documents and settings\AMD\Data aplikací\Mozilla\Firefox\Profiles\aedj9z2a.default\
FF - prefs.js: browser.startup.homepage -
www.google.sk
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\All Users\Data aplikací\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - component: c:\documents and settings\AMD\Data aplikací\Mozilla\Firefox\Profiles\aedj9z2a.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\documents and settings\AMD\Data aplikací\Mozilla\Firefox\Profiles\aedj9z2a.default\extensions\{9565115d-c7d6-46d3-bd63-b67b481a4368}\components\FFExternalAlert.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1698.5652\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npkimi.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: content.max.tokenizing.time - 1500000
FF - user.js: content.notify.interval - 750000
FF - user.js: nglayout.initialpaint.delay - 100
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-11-18 15:16
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1606980848-362288127-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(832)
c:\windows\system32\Ati2evxx.dll
c:\program files\iolo\Common\Lib\sguard.dll
- - - - - - - > 'lsass.exe'(888)
c:\program files\iolo\Common\Lib\sguard.dll
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
- - - - - - - > 'explorer.exe'(3680)
c:\program files\iolo\Common\Lib\sguard.dll
c:\windows\system32\shdoclc.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
- - - - - - - > 'csrss.exe'(804)
c:\program files\iolo\Common\Lib\sguard.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\Eset\nod32krn.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-11-18 15:23:24 - machine was rebooted
ComboFix-quarantined-files.txt 2010-11-18 14:23
ComboFix2.txt 2010-11-18 13:50
ComboFix3.txt 2010-11-17 14:09
Pre-Run: Volných bajtů: 26 642 300 928
Post-Run: Volných bajtů: 26 627 440 640
- - End Of File - - E1D8E321D4927F0868B31F5EF500D27D
Jeste jeden skript pro ComboFix - log opet sem
