Při načtení logu se mi objevila chybová hláška "Soubor nebo ardesář \WINDOWS\inf\rootau.PNF je poskozeny a je necitelny. Spustte pomucku Chkdsk" a pak jeste asi 20 podobnejch souborů. Nicméně log mi ty vyplivlo...
ComboFix 11-01-05.01 - Hana 05.01.2011 23:26:10.2.1 - FAT32x86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.447.266 [GMT 1:00]
Spuštěný z: c:\documents and settings\Hana\Plocha\stell.com.exe
FW: Sunbelt Kerio Personal Firewall *Enabled* {E659E0EE-10E6-49B7-8696-60F38D0EB174}
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Hana\Data aplikací\NetPumper
c:\documents and settings\Hana\Data aplikací\NetPumper\Hana.ini
c:\documents and settings\Hana\Dokumenty\cc_20110105_165511.reg
c:\program files\myglobalsearch
c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR
c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR
c:\program files\myglobalsearch\bar\Cache\00034F27
c:\program files\myglobalsearch\bar\Cache\01559165.bin
c:\program files\myglobalsearch\bar\Cache\01559487.bin
c:\program files\myglobalsearch\bar\Cache\015596D5.bin
c:\program files\myglobalsearch\bar\Cache\files.ini
c:\program files\myglobalsearch\bar\History\search
c:\program files\myglobalsearch\bar\Settings\prevcfg.htm
c:\program files\MySearch
c:\program files\MySearch\bar\History\search2
c:\program files\MySearch\bar\Settings\prevcfg2.htm
c:\windows\regedit.com
c:\windows\system32\pfxzmtsmtspm.dll
c:\windows\system32\pfxzmtwbmail.dll
c:\windows\system32\sfxzmtsmtspm.dll
c:\windows\system32\taskmgr.com
c:\windows\system32\UNWISE.EXE
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-12-05 do 2011-01-05 )))))))))))))))))))))))))))))))
.
2011-01-05 20:27 . 2011-01-05 20:27 -------- d-----w- C:\ComboFix
2011-01-05 17:54 . 2011-01-05 17:54 -------- d-----w- c:\program files\Windows Resource Kits
2011-01-05 16:24 . 2011-01-05 16:24 -------- d-----w- c:\program files\trend micro
2011-01-05 16:23 . 2011-01-05 16:24 -------- d-----w- C:\rsit
2011-01-05 15:56 . 2007-07-14 11:48 253952 ----a-w- c:\program files\Uninstall My Search Bar.dll
2011-01-05 15:51 . 2011-01-05 15:51 -------- d-----w- c:\program files\CCleaner
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2004-10-01 14:00 . 2006-12-26 13:38 40960 ----a-w- c:\program files\Uninstall_CDS.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"RaidTool"="c:\program files\VIA\RAID\raid_tool.exe" [2005-04-28 589824]
"VTTimer"="VTTimer.exe" [2005-03-09 53248]
"VTTrayp"="VTtrayp.exe" [2005-03-12 147456]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Search Uninstall]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerBar]
2004-04-21 09:26 86016 ------w- c:\program files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 19:24 32768 ------w- c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
2004-03-26 13:40 794624 ----a-w- c:\program files\Analog Devices\SoundMAX\SMax4.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2004-04-01 09:52 1368064 ----a-w- c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\System32\\dplaysvr.exe"=
"c:\\Documents and Settings\\Hana\\Plocha\\BULANCI.EXE"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"d:\\Programy\\µtorrent\\utorrent.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"d:\programy\µtorrent\utorrent.exe"=
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12.1.2008 9:19 639224]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [20.2.2007 13:34 302000]
S1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [20.2.2007 13:34 71088]
S3 NtApm;Ovladač rozhraní služby NT Apm/Legacy;c:\windows\system32\drivers\NtApm.sys [26.12.2005 14:51 9472]
S3 SUSCOM;Susteen Serial port driver;c:\windows\system32\drivers\SUSCOM.SYS [26.5.2006 18:34 40448]
S3 trid3d;trid3d;c:\windows\system32\drivers\trid3dm.sys [26.12.2005 14:50 222336]
S3 WLAN; Wireless LAN Driver;c:\windows\system32\DRIVERS\wlanNDS.sys --> c:\windows\system32\DRIVERS\wlanNDS.sys [?]
.
Obsah adresáře 'Naplánované úlohy'
2011-01-05 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-01 21:18]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {C494B592-0B69-4976-A7CA-FE4C986E5946} = 213.226.240.126,194.213.224.1
TCP: {F81AE142-88F2-4CE5-9CE4-A960A824566A} = 213.226.240.126,194.213.224.1
FF - ProfilePath - c:\documents and settings\Hana\Data aplikací\Mozilla\Firefox\Profiles\j92wt4vp.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage -
www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - c:\program files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
HKLM-Run-pdfSaver3 - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2011-01-05 23:31
Windows 5.1.2600 Service Pack 2 FAT NTAPI
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
c:\docume~1\Hana\LOCALS~1\Temp\WASBAC0.tmp\c:\docume~1\Hana\LOCALS~1\Temp\WASBAC0.tmp\ä}
c:\docume~1\Hana\LOCALS~1\Temp\WASBAC0.tmp\
c:\docume~1\Hana\LOCALS~1\Temp\WASBAC0.tmp\ jh4¬0.
sken byl úspešně dokončen
skryté soubory: 4
**************************************************************************
.
Celkový čas: 2011-01-05 23:32:41
ComboFix-quarantined-files.txt 2011-01-05 22:32
Před spuštěním: 1 542 324 224
Po spuštění: 1 503 666 176
- - End Of File - - 6ECFF1EEB914383E3C374C7F7F8FEE6A
nemas zaco.