ComboFix 13-04-06.02 - Jakub . 04. 2013 14:44:12.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1029.18.3582.3001 [GMT 2:00]
Spuštěný z: c:\documents and settings\Jakub\Plocha\ComboFix.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-03-07 do 2013-04-07 )))))))))))))))))))))))))))))))
.
.
2013-04-07 11:47 . 2013-04-07 11:47 -------- d-----w- c:\program files\Java
2013-04-07 11:26 . 2013-04-07 11:26 -------- d-----w- c:\windows\ERUNT
2013-04-07 11:26 . 2013-04-07 11:26 -------- d-----w- C:\JRT
2013-04-07 10:14 . 2013-04-07 10:14 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2013-04-07 08:23 . 2013-04-07 08:23 -------- d-sh--w- c:\documents and settings\Jakub\IECompatCache
2013-04-06 22:20 . 2013-04-06 22:20 -------- d-----w- c:\windows\Sun
2013-04-06 22:20 . 2013-04-06 22:20 -------- d-----w- c:\documents and settings\Jakub\Local Settings\Data aplikací\Sun
2013-04-06 22:07 . 2013-04-06 22:07 -------- d-----w- c:\program files\Common Files\Java
2013-04-03 10:47 . 2013-04-03 10:47 -------- d-----w- c:\windows\syste
2013-03-23 09:50 . 2013-03-23 09:50 -------- d-----w- c:\documents and settings\Jakub\Data aplikací\Doublefine
2013-03-23 09:50 . 2013-03-23 09:50 -------- d-----w- c:\documents and settings\All Users\Data aplikací\RELOADED
2013-03-23 09:40 . 2013-03-23 09:49 -------- d-----w- c:\program files\The Cave
2013-03-08 17:52 . 2013-03-08 17:52 -------- d-----w- c:\program files\2K Games
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-07 08:18 . 2013-01-19 11:45 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-07 08:18 . 2013-01-19 11:45 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-02-06 22:50 . 2013-02-06 22:50 69632 ----a-r- c:\documents and settings\Jakub\Data aplikací\Microsoft\Installer\{D041EB9E-890A-4098-8F94-51DA194AC72A}\Studio.exe
2013-02-06 22:50 . 2013-02-06 22:50 69632 ----a-r- c:\documents and settings\Jakub\Data aplikací\Microsoft\Installer\{D041EB9E-890A-4098-8F94-51DA194AC72A}\SC_ContentTransfer.exe
2013-02-06 22:50 . 2013-02-06 22:50 65536 ----a-r- c:\documents and settings\Jakub\Data aplikací\Microsoft\Installer\{D041EB9E-890A-4098-8F94-51DA194AC72A}\SC_ReadMe.exe
2013-02-06 22:50 . 2013-02-06 22:50 49152 ----a-r- c:\documents and settings\Jakub\Data aplikací\Microsoft\Installer\{D041EB9E-890A-4098-8F94-51DA194AC72A}\SC_Check3D.exe
2013-02-06 22:50 . 2013-02-06 22:50 45056 ----a-r- c:\documents and settings\Jakub\Data aplikací\Microsoft\Installer\{D041EB9E-890A-4098-8F94-51DA194AC72A}\SC_Help_HH.exe
2013-02-06 22:50 . 2013-02-06 22:50 434176 ----a-r- c:\documents and settings\Jakub\Data aplikací\Microsoft\Installer\{D041EB9E-890A-4098-8F94-51DA194AC72A}\SC_GuidedTour.exe
2013-02-06 22:50 . 2013-02-06 22:50 40960 ----a-r- c:\documents and settings\Jakub\Data aplikací\Microsoft\Installer\{D041EB9E-890A-4098-8F94-51DA194AC72A}\SC_AMCap.exe
2013-01-30 14:56 . 2013-01-30 14:56 86016 ----a-w- c:\windows\system32\OpenAL32.dll
2013-01-30 14:56 . 2013-01-30 14:56 409600 ----a-w- c:\windows\system32\wrap_oal.dll
2013-01-19 10:52 . 2013-01-19 10:52 142 ----a-w- c:\documents and settings\All Users\Data aplikací\LaunchURL.bat
2013-01-19 10:38 . 2013-01-19 09:50 15600 ----a-w- c:\windows\gdrv.sys
2013-01-19 09:52 . 2013-01-19 09:52 315392 ----a-w- c:\windows\HideWin.exe
2013-04-07 12:39 . 2013-04-07 12:38 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-05-25 1953792]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-11-29 98304]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2006-11-21 35328]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-07-27 180224]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Veetle\\Player\\VeetleNet.exe"=
"c:\\Program Files\\TrackMania United\\TmUnited.exe"=
"c:\\Program Files\\TmUnitedForever\\TmForever.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"=
"c:\\Program Files\\PANDORA.TV\\PanService\\PanProcess.exe"=
"c:\\Program Files\\PANDORA.TV\\PanService\\PandoraService.exe"=
.
R2 PanService;PandoraService;c:\program files\PANDORA.TV\PanService\PandoraService.exe [20. 1. 2013 17:37 625304]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [8. 1. 2013 13:55 161536]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - JAVAQUICKSTARTERSERVICE
.
Obsah adresáře 'Naplánované úlohy'
.
2013-04-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-19 08:18]
.
2013-04-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-01-19 10:19]
.
2013-04-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-01-19 10:19]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://
www.google.com
TCP: DhcpNameServer = 100.100.100.1
FF - ProfilePath - c:\documents and settings\Jakub\Data aplikací\Mozilla\Firefox\Profiles\w0ytyc81.default-1365327077250\
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2013-04-07 14:47
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(820)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(3536)
c:\windows\system32\webcheck.dll
.
Celkový čas: 2013-04-07 14:49:16
ComboFix-quarantined-files.txt 2013-04-07 12:49
.
Před spuštěním: Volných bajtů: 151 301 017 600
Po spuštění: Volných bajtů: 151 366 066 176
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 66F5979B859E3AB719304157F5175D38
