Kód: Vybrat vše
ComboFix 10-02-12.01 - Martas 12.02.2010 23:12:34.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3071.2419 [GMT 1:00]
Spuštěný z: c:\documents and settings\Martas\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Martas\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100212-2] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
file zipped: c:\windows\system32\DRIVERS\8977187.sys
file zipped: c:\windows\system32\DRIVERS\89771871.sys
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\DRIVERS\8977187.sys
c:\windows\system32\DRIVERS\89771871.sys
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_89771871
-------\Legacy_89771872
-------\Legacy_UIJOTEIX
-------\Service_89771871
-------\Service_89771872
-------\Legacy_setup_9.0.0.722_11.02.2010_21-26drv
-------\Service_setup_9.0.0.722_11.02.2010_21-26drv
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-12 do 2010-02-12 )))))))))))))))))))))))))))))))
.
2010-02-12 15:05 . 2010-02-12 15:05 -------- d-----w- c:\program files\CleanUp!
2010-02-11 20:31 . 2009-10-22 11:54 37392 ----a-w- c:\windows\system32\drivers\89771872.sys
2010-02-10 18:38 . 2010-02-10 18:38 -------- d-----w- C:\rsit
2010-02-10 18:38 . 2010-02-10 18:38 -------- d-----w- c:\program files\trend micro
2010-02-10 17:31 . 2010-02-10 17:31 -------- d-----w- c:\program files\Lavalys
2010-02-10 16:19 . 2010-02-10 16:19 -------- d-----w- c:\windows\system32\wbem\Repository
2010-01-26 15:45 . 2006-11-22 09:01 693760 ----a-w- c:\windows\system32\drivers\hardlock.sys
2010-01-26 15:45 . 2010-01-26 15:45 6656 ----a-w- c:\windows\system32\haspvdd.dll
2010-01-26 15:45 . 2010-01-26 15:45 47616 ----a-w- c:\windows\system32\drivers\Haspnt.sys
2010-01-26 15:45 . 2010-01-26 15:45 383 ----a-w- c:\windows\system32\haspdos.sys
2010-01-26 15:45 . 2006-11-30 10:06 69632 ----a-w- c:\windows\system32\hasp_inst_help1.dll
2010-01-26 15:45 . 2005-09-06 16:07 24576 ----a-w- c:\windows\system32\hdduinst.exe
2010-01-26 15:45 . 2006-12-20 10:55 3066968 ----a-w- c:\windows\system32\hinstd.dll
2010-01-26 15:45 . 2006-12-20 09:00 671112 ----a-w- c:\windows\system32\hdinst_windows.dll
2010-01-26 15:45 . 2006-12-20 09:00 2511360 ----a-w- c:\windows\system32\haspds_windows.dll
2010-01-26 15:45 . 2002-07-26 16:02 153088 ----a-w- c:\windows\system32\UNWISE.EXE
2010-01-22 01:33 . 2010-01-22 01:33 41872 ----a-w- c:\windows\system32\xfcodec.dll
2010-01-19 17:54 . 2010-01-19 18:22 -------- d-----w- c:\program files\Total Video Converter
2010-01-19 17:40 . 2010-01-19 17:40 -------- d-----w- c:\documents and settings\All Users\Data aplikacĂ
2010-01-16 15:49 . 2010-01-16 15:51 -------- d-----w- c:\program files\SignSIS-GUI
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-12 21:13 . 2008-08-14 16:51 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-02-12 21:13 . 2008-08-14 16:51 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-02-11 16:29 . 2008-08-14 14:08 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-01-20 18:04 . 2009-12-25 16:26 -------- d-----w- c:\program files\Nokia
2010-01-20 14:56 . 2008-08-19 09:29 113720 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-01-10 21:33 . 2010-01-10 21:32 -------- d-----w- c:\program files\Common Files\ChaosGroup
2010-01-10 21:31 . 2010-01-10 21:31 -------- d-----w- c:\program files\Chaos Group
2010-01-10 18:18 . 2010-01-10 18:14 -------- d-----w- c:\program files\Autodesk
2010-01-10 18:18 . 2010-01-10 18:14 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2010-01-03 20:30 . 2009-12-25 16:26 -------- d-----w- c:\program files\DIFX
2010-01-03 20:30 . 2010-01-03 20:30 -------- d-----w- c:\program files\Garmin
2009-12-27 12:29 . 2009-12-27 12:29 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2009-12-27 12:29 . 2009-12-27 12:29 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2009-12-25 16:53 . 2001-10-25 12:00 85556 ----a-w- c:\windows\system32\perfc005.dat
2009-12-25 16:53 . 2001-10-25 12:00 446580 ----a-w- c:\windows\system32\perfh005.dat
2009-12-25 16:32 . 2009-12-25 16:32 -------- d-----w- c:\program files\Common Files\PCSuite
2009-12-25 16:32 . 2009-12-25 16:27 -------- d-----w- c:\program files\Common Files\Nokia
2009-12-25 16:30 . 2009-12-25 16:30 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-12-25 16:30 . 2009-12-25 16:30 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-12-25 16:26 . 2009-12-25 16:26 -------- d-----w- c:\program files\PC Connectivity Solution
2009-12-09 20:51 . 2008-08-25 18:20 445016 ----a-w- c:\windows\system32\wrap_oal.dll
2009-12-09 20:51 . 2008-08-25 18:20 109144 ----a-w- c:\windows\system32\OpenAL32.dll
2009-11-24 23:54 . 2010-01-01 12:53 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2010-01-01 12:53 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:49 . 2010-01-01 12:53 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2010-01-01 12:53 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2010-01-01 12:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2010-01-01 12:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-04-15 20:24 . 2009-04-15 20:24 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-04-15 20:24 . 2009-04-15 20:24 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53DB1AFE-3A95-4e75-9F11-E7F7337E0DE4}]
2009-03-08 14:40 491520 ----a-w- c:\program files\2004 Mahjongg Toolbar\v2.0.0.2\2004_Mahjongg_Toolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{AF737D86-3458-4d97-B37E-1CDA2E4D6CEE}"= "c:\program files\2004 Mahjongg Toolbar\v2.0.0.2\2004_Mahjongg_Toolbar.dll" [2009-03-08 491520]
[HKEY_CLASSES_ROOT\clsid\{af737d86-3458-4d97-b37e-1cda2e4d6cee}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{117B8BA5-89E3-4750-9F0C-130F866493A0}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{AF737D86-3458-4D97-B37E-1CDA2E4D6CEE}"= "c:\program files\2004 Mahjongg Toolbar\v2.0.0.2\2004_Mahjongg_Toolbar.dll" [2009-03-08 491520]
[HKEY_CLASSES_ROOT\clsid\{af737d86-3458-4d97-b37e-1cda2e4d6cee}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{117B8BA5-89E3-4750-9F0C-130F866493A0}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"RGSC"="d:\hry\GTA iV\Rockstar Games Social Club\RGSCLauncher.exe" [2008-12-28 306088]
"NokiaOviSuite2"="c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2009-12-10 401728]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]
"FlashGet"="d:\program files\FLASHGET\FlashGet universal\FlashGet.exe" [2008-08-19 1795656]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Mamka\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-5-30 393216]
c:\documents and settings\Tata\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-5-30 393216]
c:\documents and settings\Martas\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
setup_9.0.0.722_11.02.2010_21-26.lnk - c:\documents and settings\Martas\Plocha\Virus Removal Tool\setup_9.0.0.722_11.02.2010_21-26\startup.exe [2010-2-11 72208]
Stardock ObjectDock.lnk - f:\program files\ObjectDock\ObjectDock.exe [2007-12-3 3450608]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]
Logitech SetPoint.lnk - d:\program files\Logitech\SetPoint\SetPoint.exe [2008-10-21 805392]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 00:42 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"wave"=DrvTrNTm.dll
"mixer"=DrvTrNTm.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools Lite"="d:\program files\DAEMON Tools Lite\daemon.exe" -autorun
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe"
"RGSC"=d:\hry\GTA iV\Rockstar Games Social Club\RGSCLauncher.exe /silent
"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"mmtask"="c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
"BearShare"="f:\program files\BearShare\BearShare.exe" /pause
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
"RemoteControl9"="c:\program files\CyberLink\PowerDVD9\PDVD9Serv.exe"
"PDVD9LanguageShortcut"="c:\program files\CyberLink\PowerDVD9\Language\Language.exe"
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" -atboottime
"TotalRecorderScheduler"="f:\totalrecorder\TotRecSched.exe"
"WinampAgent"=f:\winamp\winampa.exe
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"f:\\BLUETOOTH\\BlueSoleil.exe"=
"d:\\Program Files\\QIP\\qip.exe"=
"d:\\Hry\\TmNationsForever\\TmForever.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\FLASHGET\\FlashGet universal\\FlashGet.exe"=
"d:\\Hry\\GTA iV\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"d:\\Hry\\Rockstar veci\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"d:\\Program Files\\ICQ6.5\\ICQ.exe"=
"d:\\Hry\\G R I D\\GRID.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Hry\\KALICKO 4\\iw3mp.exe"=
"c:\\Documents and Settings\\Martas\\Local Settings\\Data aplikací\\Dyyno Receiver\\DPPM.exe"=
"f:\\Program Files\\SKYPE\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Hry\\DIRT2\\dirt2_game.exe"=
"d:\\Program Files\\3Ds Max\\3dsmax.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"f:\\teaaaamviewer\\TeamViewer3\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"24001:TCP"= 24001:TCP:BitComet 24001 TCP
"24001:UDP"= 24001:UDP:BitComet 24001 UDP
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30.8.2008 21:06 717296]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [1.1.2010 13:53 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1.1.2010 13:53 20560]
R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [10.4.2009 10:13 3032360]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [30.10.2009 15:05 1021256]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14.10.2009 7:24 10064]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [10.4.2009 10:13 15144]
S2 gupdate1c9c42576781eac;Služba Google Update (gupdate1c9c42576781eac);c:\program files\Google\Update\GoogleUpdate.exe [23.4.2009 16:09 133104]
S3 cimo;cimo;c:\windows\system32\cimo.sys [14.8.2009 14:13 51200]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [25.12.2009 17:26 136704]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'
2010-01-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2010-02-12 c:\windows\Tasks\Automatic troubleshooting.job
- c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-10-30 14:12]
2010-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-23 15:09]
2010-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-23 15:09]
2010-02-10 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe [2008-01-09 02:08]
.
.
------- Doplňkový sken -------
.
uStart Page = start.qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: &Download All by FlashGet - d:\program files\FLASHGET\FlashGet universal\ComDlls\Bhoall.htm
IE: &Download by FlashGet - d:\program files\FLASHGET\FlashGet universal\ComDlls\Bholink.htm
IE: Baixar com o Rapidown... - c:\program files\Rapidown\rapidownGet.htm
IE: Baixar tudo com o Rapidown... - c:\program files\Rapidown\rapidownGetAll.htm
IE: Download all links using BitComet - f:\bitcomet\BitComet.exe/AddAllLink.htm
IE: Download all videos using BitComet - f:\bitcomet\BitComet.exe/AddVideo.htm
IE: Download link using &BitComet - f:\bitcomet\BitComet.exe/AddLink.htm
IE: {{57E91B47-F40A-11D1-B792-444553540011} - c:\program files\Rapidown\rapidown.exe
FF - ProfilePath - c:\documents and settings\Martas\Data aplikací\Mozilla\Firefox\Profiles\v5cuk9z6.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - centrum.cz
FF - component: c:\documents and settings\Martas\Data aplikací\Mozilla\Firefox\Profiles\v5cuk9z6.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - component: c:\program files\BS.Player ControlBar\FirefoxDTT\components\BSToolbarFF.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin2.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin3.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin4.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin5.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin6.dll
FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin7.dll
---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-12 23:26
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A4541F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9e67cb8
\Driver\atapi -> atapi.sys @ 0xb9dfcb40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9cd8bb0
PacketIndicateHandler -> NDIS.sys @ 0xb9ce5a21
SendHandler -> NDIS.sys @ 0xb9cc387b
user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-436374069-839522115-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:1d,c1,b0,d9,cb,72,a4,20,3a,e0,38,3e,89,0e,06,98,a4,22,39,31,23,7a,38,
84,17,f5,9a,fd,82,d0,ec,0b,03,90,af,33,09,40,d7,0b,6d,27,d0,16,6f,8b,a6,6f,\
"??"=hex:d3,86,d9,48,b4,77,8c,df,1f,e6,6c,f3,03,17,81,ff
[HKEY_USERS\S-1-5-21-436374069-839522115-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:78,d1,da,a9,7f,14,f2,cc,62,5c,d8,68,1d,98,46,6a,86,1b,34,d4,c1,
22,58,2b,51,c7,8a,70,2b,06,b6,b1,0d,75,30,11,86,24,39,1b,12,c8,04,b6,b6,85,\
"rkeysecu"=hex:61,dd,ac,ab,da,74,23,ce,16,16,7b,4e,43,cb,eb,91
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(756)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
- - - - - - - > 'explorer.exe'(3368)
f:\program files\ObjectDock\DockShellHook.dll
d:\program files\Logitech\SetPoint\GameHook.dll
d:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\program files\Java\jre6\bin\jqs.exe
d:\program files\3Ds Max\mentalray\satellite\raysat_3dsmax9_32server.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\WTablet\Pen_TabletUser.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wscntfy.exe
c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
c:\windows\RTHDCPL.EXE
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
d:\hry\GTA iV\Rockstar Games Social Club\1_1_3_0\RGSC.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\Common Files\Nokia\NoA\nokiaaserver.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
.
**************************************************************************
.
Celkový čas: 2010-02-12 23:33:37 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-02-12 22:33
ComboFix2.txt 2010-02-10 21:27
Před spuštěním: Volných bajtů: 44 700 475 392
Po spuštění: Volných bajtů: 44 573 360 128
- - End Of File - - 2C92DAF0730F6ECCD81D9CBC6F42EC5F