ComboFix 10-02-23.04 - Antontonotonik 24.02.2010 7:21.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.511.316 [GMT 1:00]
Spuštěný z: c:\documents and settings\Antontonotonik\Dokumenty\Stažené soubory\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\ieuinit.inf
c:\windows\system32\vbzlib1.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-24 do 2010-02-24 )))))))))))))))))))))))))))))))
.
2010-02-22 17:06 . 2004-02-17 02:51 1458176 ----a-r- c:\windows\system\SmWizard.exe
2010-02-22 17:06 . 2001-11-23 04:08 712704 ----a-r- c:\windows\system32\Audio3D.dll
2010-02-22 17:06 . 2005-05-12 06:21 1332544 ----a-r- c:\windows\system32\drivers\cmuda.sys
2010-02-22 17:06 . 2005-05-12 03:23 167936 ----a-r- c:\windows\system32\cmuda.dll
2010-02-22 17:06 . 2003-04-24 05:29 32768 ----a-r- c:\windows\system32\udaprop.dll
2010-02-22 17:06 . 2002-04-29 07:04 917504 ----a-r- c:\windows\system\cmids3d.dll
2010-02-22 17:05 . 2010-02-22 17:05 -------- d-----w- c:\program files\C-Media 3D Audio
2010-02-22 17:05 . 2003-07-22 10:15 225280 ----a-w- c:\windows\CmiRmRedundDir.exe
2010-02-22 13:12 . 2010-02-22 13:12 -------- d-----w- c:\windows\system32\languages
2010-02-21 02:35 . 2010-02-23 17:41 -------- d-----w- c:\windows\system32\Adobe
2010-02-19 09:54 . 2010-02-19 09:54 -------- d-----w- c:\program files\CCleaner
2010-02-19 09:21 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-19 09:21 . 2010-02-19 09:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-19 09:21 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-19 09:14 . 2010-02-19 09:14 -------- d-----w- C:\_OTM
2010-02-19 05:50 . 2010-02-19 09:34 -------- d-----w- c:\program files\trend micro
2010-02-19 05:50 . 2010-02-19 05:50 -------- d-----w- C:\rsit
2010-02-04 07:24 . 2010-02-04 07:24 -------- d-----w- c:\program files\DsNET Corp
2010-02-02 19:59 . 2010-02-02 19:59 0 ----a-w- c:\windows\nsreg.dat
2010-01-27 20:08 . 2010-01-27 20:48 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-01-27 20:08 . 2010-02-19 17:23 -------- d-----w- c:\program files\DivX
2010-01-27 07:41 . 2010-01-27 07:41 -------- d-----w- C:\Sierra
2010-01-27 07:27 . 1999-12-17 08:13 86016 ----a-w- c:\windows\unvise32.exe
2010-01-27 07:23 . 2010-02-03 12:25 -------- d-----w- c:\program files\Valve
2010-01-27 05:17 . 2010-01-27 05:17 -------- d-----w- c:\program files\VideoLAN
2010-01-27 05:07 . 2010-01-28 08:53 -------- d-----w- c:\program files\ICQ6.5
2010-01-27 05:05 . 2010-02-22 13:11 737280 ----a-w- c:\windows\iun6002.exe
2010-01-27 05:05 . 2010-02-22 13:12 -------- d-----w- c:\program files\Codec Pack - All In 1
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-27 11:06 . 2010-01-27 04:11 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-27 11:06 . 2010-01-27 04:11 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-01-27 11:03 . 2010-01-27 04:11 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-01-27 07:23 . 2010-01-27 04:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-27 04:58 . 2010-01-27 04:58 -------- d-----w- c:\program files\Alwil Software
2010-01-27 04:41 . 2010-01-27 04:41 -------- d-----w- c:\program files\My Company Name
2010-01-27 04:34 . 2010-01-27 04:33 -------- d-----w- c:\program files\ATI Technologies
2010-01-27 04:32 . 2010-01-27 04:23 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-27 04:32 . 2001-10-25 14:00 68088 ----a-w- c:\windows\system32\perfc005.dat
2010-01-27 04:32 . 2001-10-25 14:00 430212 ----a-w- c:\windows\system32\perfh005.dat
2010-01-27 04:22 . 2010-01-27 04:22 -------- d-----w- c:\program files\Intel
2010-01-27 04:12 . 2010-01-27 04:12 -------- d-----w- c:\program files\microsoft frontpage
2010-01-27 04:07 . 2010-01-27 04:07 21812 ----a-w- c:\windows\system32\emptyregdb.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
.
.
------- Doplňkový sken -------
.
FF - ProfilePath - c:\documents and settings\Antontonotonik\Data aplikací\Mozilla\Firefox\Profiles\9gz07mtq.default\
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "
http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
HKLM-Run-Cmaudio - cmicnfg.cpl
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-02-24 07:28
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
c:\docume~1\ANTONT~1\LOCALS~1\Temp\Perflib_Perfdata_a50.dat 16384 bytes
sken byl úspešně dokončen
skryté soubory: 1
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(524)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-02-24 07:31:12
ComboFix-quarantined-files.txt 2010-02-24 06:31
Před spuštěním: Volných bajtů: 64 687 796 224
Po spuštění: Volných bajtů: 65 532 661 760
- - End Of File - - 1E2DDD2105BA80F364122CABFA5ED5FC