Re: Prosím o kontrolu a pomoc při odstranění havěti
Napsal: 23 srp 2012 16:51
Combo Fix log
ComboFix 12-08-22.03 - Zárubová 23.08.2012 18:35:35.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1789.1056 [GMT 2:00]
Spuštěný z: c:\documents and settings\Zßrubovß\Dokumenty\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\msmqinst.log
c:\windows\system32\SET5B.tmp
c:\windows\system32\SET5D.tmp
c:\windows\system32\SET61.tmp
c:\windows\system32\SET62.tmp
c:\windows\system32\SET69.tmp
c:\windows\system32\SET6B.tmp
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
C:\zip.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-07-23 do 2012-08-23 )))))))))))))))))))))))))))))))
.
.
2012-08-23 15:52 . 2012-08-23 15:52 29904 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{DBFDC487-D548-414F-9F33-CABFA3A42185}\MpKsl78b09a25.sys
2012-08-23 04:11 . 2012-08-01 22:51 7023536 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{DBFDC487-D548-414F-9F33-CABFA3A42185}\mpengine.dll
2012-08-22 00:16 . 2012-08-01 22:51 7023536 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-08-21 15:37 . 2012-08-23 15:48 574 ----a-w- C:\cleanup.bat
2012-08-21 15:37 . 2012-08-23 15:48 19286 ----a-w- C:\cleanup.exe
2012-08-20 12:51 . 2012-08-20 12:51 -------- d-----w- C:\rsit
2012-08-20 12:51 . 2012-08-20 12:51 -------- d-----w- c:\program files\trend micro
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-20 13:51 . 2012-08-20 13:51 2658 ----a-w- C:\RK_Quarantine.zip
2012-07-06 13:58 . 2007-08-07 14:14 78336 ----a-w- c:\windows\system32\browser.dll
2012-07-04 14:05 . 2007-08-07 14:28 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 18:22 . 2007-08-07 14:15 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-07-02 17:38 . 2007-08-07 14:15 916992 ----a-w- c:\windows\system32\wininet.dll
2012-07-02 17:38 . 2007-08-07 14:14 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:38 . 2007-08-07 14:14 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2007-08-07 14:14 385024 ----a-w- c:\windows\system32\html.iec
2012-06-06 18:59 . 2012-06-06 18:59 1070152 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2012-06-05 15:49 . 2008-04-14 03:21 1372672 ----a-w- c:\windows\system32\msxml6.dll
2012-06-05 15:49 . 2007-08-07 14:14 1172480 ----a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2007-08-07 14:14 152576 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 13:19 . 2008-10-16 12:07 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2008-10-16 12:08 22552 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2007-08-07 14:30 329240 ----a-w- c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2007-08-07 14:30 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2007-08-07 14:30 210968 ----a-w- c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2008-10-16 12:09 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 13:19 . 2008-10-16 12:07 15384 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2008-10-16 12:07 18456 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2007-08-07 14:30 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2007-08-07 14:30 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 13:19 . 2007-08-07 14:14 97304 ----a-w- c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2007-08-07 14:30 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2007-08-07 14:30 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 13:19 . 2011-10-01 03:41 17648 ----a-w- c:\windows\system32\mucltui.dll.mui
2012-06-02 13:18 . 2011-10-01 03:41 275696 ----a-w- c:\windows\system32\mucltui.dll
2012-06-02 13:18 . 2011-10-01 03:41 214256 ----a-w- c:\windows\system32\muweb.dll
2012-05-31 13:22 . 2007-08-07 14:14 602112 ----a-w- c:\windows\system32\crypt32.dll
2012-07-19 23:49 . 2012-07-15 05:51 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaSuite.exe"="c:\program files\Nokia\Nokia Suite\NokiaSuite.exe" [2012-05-16 1084840]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-10 16384000]
"SiSPower"="SiSPower.dll" [2007-08-03 53248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-10 864256]
"TouchPadHotKey"="c:\program files\FSC\TouchPad HotKey Utility\TouchPad_HotKey.exe" [2007-08-13 364544]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-07-10 188416]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2009-01-16 1473536]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"BtTray"="c:\program files\IVT Corporation\BlueSoleil\BtTray.exe" [2008-07-09 229888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
c:\documents and settings\Zárubová\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-1-15 393216]
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Rychlý začátek s aplikací HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
WirelessSelector.lnk - c:\program files\FSC\Wireless Utility\WirelessSelector.exe [2009-7-15 650752]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
.
R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [21.1.2008 20:28 21512]
R1 MpKsl78b09a25;MpKsl78b09a25;c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{DBFDC487-D548-414F-9F33-CABFA3A42185}\MpKsl78b09a25.sys [23.8.2012 17:52 29904]
R2 BsMobileCS;BsMobileCS;c:\program files\IVT Corporation\BlueSoleil\BsMobileCS.exe [4.6.2008 19:26 143467]
R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [21.1.2008 20:28 26248]
S3 djhf.sys;djhf.sys;\??\c:\windows\system32\drivers\djhf.sys --> c:\windows\system32\drivers\djhf.sys [?]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [11.7.2012 17:20 113120]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MPKSL78B09A25
.
Obsah adresáře 'Naplánované úlohy'
.
2012-08-23 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-03-26 15:03]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.idnes.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\Office\Office12\EXCEL.EXE/3000
IE: Send by Bluetooth - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
IE: Send via &Message... - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\documents and settings\Zárubová\Data aplikací\Mozilla\Firefox\Profiles\0js5c2on.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - seznam.cz
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-TkBellExe - c:\program files\K-Lite Codec Pack\Real\Update_OB\realsched.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-23 18:40
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Celkový čas: 2012-08-23 18:41:46
ComboFix-quarantined-files.txt 2012-08-23 16:41
.
Před spuštěním: Volných bajtů: 121 352 671 232
Po spuštění: Volných bajtů: 122 298 531 840
.
- - End Of File - - 78BDF4FF4FA35B9175B357AB476BBBAC
ComboFix 12-08-22.03 - Zárubová 23.08.2012 18:35:35.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1789.1056 [GMT 2:00]
Spuštěný z: c:\documents and settings\Zßrubovß\Dokumenty\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\msmqinst.log
c:\windows\system32\SET5B.tmp
c:\windows\system32\SET5D.tmp
c:\windows\system32\SET61.tmp
c:\windows\system32\SET62.tmp
c:\windows\system32\SET69.tmp
c:\windows\system32\SET6B.tmp
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
C:\zip.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-07-23 do 2012-08-23 )))))))))))))))))))))))))))))))
.
.
2012-08-23 15:52 . 2012-08-23 15:52 29904 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{DBFDC487-D548-414F-9F33-CABFA3A42185}\MpKsl78b09a25.sys
2012-08-23 04:11 . 2012-08-01 22:51 7023536 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{DBFDC487-D548-414F-9F33-CABFA3A42185}\mpengine.dll
2012-08-22 00:16 . 2012-08-01 22:51 7023536 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-08-21 15:37 . 2012-08-23 15:48 574 ----a-w- C:\cleanup.bat
2012-08-21 15:37 . 2012-08-23 15:48 19286 ----a-w- C:\cleanup.exe
2012-08-20 12:51 . 2012-08-20 12:51 -------- d-----w- C:\rsit
2012-08-20 12:51 . 2012-08-20 12:51 -------- d-----w- c:\program files\trend micro
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-20 13:51 . 2012-08-20 13:51 2658 ----a-w- C:\RK_Quarantine.zip
2012-07-06 13:58 . 2007-08-07 14:14 78336 ----a-w- c:\windows\system32\browser.dll
2012-07-04 14:05 . 2007-08-07 14:28 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 18:22 . 2007-08-07 14:15 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-07-02 17:38 . 2007-08-07 14:15 916992 ----a-w- c:\windows\system32\wininet.dll
2012-07-02 17:38 . 2007-08-07 14:14 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:38 . 2007-08-07 14:14 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2007-08-07 14:14 385024 ----a-w- c:\windows\system32\html.iec
2012-06-06 18:59 . 2012-06-06 18:59 1070152 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2012-06-05 15:49 . 2008-04-14 03:21 1372672 ----a-w- c:\windows\system32\msxml6.dll
2012-06-05 15:49 . 2007-08-07 14:14 1172480 ----a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2007-08-07 14:14 152576 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 13:19 . 2008-10-16 12:07 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2008-10-16 12:08 22552 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2007-08-07 14:30 329240 ----a-w- c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2007-08-07 14:30 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2007-08-07 14:30 210968 ----a-w- c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2008-10-16 12:09 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 13:19 . 2008-10-16 12:07 15384 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2008-10-16 12:07 18456 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2007-08-07 14:30 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2007-08-07 14:30 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 13:19 . 2007-08-07 14:14 97304 ----a-w- c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2007-08-07 14:30 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2007-08-07 14:30 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 13:19 . 2011-10-01 03:41 17648 ----a-w- c:\windows\system32\mucltui.dll.mui
2012-06-02 13:18 . 2011-10-01 03:41 275696 ----a-w- c:\windows\system32\mucltui.dll
2012-06-02 13:18 . 2011-10-01 03:41 214256 ----a-w- c:\windows\system32\muweb.dll
2012-05-31 13:22 . 2007-08-07 14:14 602112 ----a-w- c:\windows\system32\crypt32.dll
2012-07-19 23:49 . 2012-07-15 05:51 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaSuite.exe"="c:\program files\Nokia\Nokia Suite\NokiaSuite.exe" [2012-05-16 1084840]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-10 16384000]
"SiSPower"="SiSPower.dll" [2007-08-03 53248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-10 864256]
"TouchPadHotKey"="c:\program files\FSC\TouchPad HotKey Utility\TouchPad_HotKey.exe" [2007-08-13 364544]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-07-10 188416]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2009-01-16 1473536]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"BtTray"="c:\program files\IVT Corporation\BlueSoleil\BtTray.exe" [2008-07-09 229888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
c:\documents and settings\Zárubová\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-1-15 393216]
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Rychlý začátek s aplikací HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
WirelessSelector.lnk - c:\program files\FSC\Wireless Utility\WirelessSelector.exe [2009-7-15 650752]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
.
R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [21.1.2008 20:28 21512]
R1 MpKsl78b09a25;MpKsl78b09a25;c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{DBFDC487-D548-414F-9F33-CABFA3A42185}\MpKsl78b09a25.sys [23.8.2012 17:52 29904]
R2 BsMobileCS;BsMobileCS;c:\program files\IVT Corporation\BlueSoleil\BsMobileCS.exe [4.6.2008 19:26 143467]
R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [21.1.2008 20:28 26248]
S3 djhf.sys;djhf.sys;\??\c:\windows\system32\drivers\djhf.sys --> c:\windows\system32\drivers\djhf.sys [?]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [11.7.2012 17:20 113120]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MPKSL78B09A25
.
Obsah adresáře 'Naplánované úlohy'
.
2012-08-23 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-03-26 15:03]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.idnes.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\Office\Office12\EXCEL.EXE/3000
IE: Send by Bluetooth - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
IE: Send via &Message... - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\documents and settings\Zárubová\Data aplikací\Mozilla\Firefox\Profiles\0js5c2on.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - seznam.cz
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-TkBellExe - c:\program files\K-Lite Codec Pack\Real\Update_OB\realsched.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-23 18:40
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Celkový čas: 2012-08-23 18:41:46
ComboFix-quarantined-files.txt 2012-08-23 16:41
.
Před spuštěním: Volných bajtů: 121 352 671 232
Po spuštění: Volných bajtů: 122 298 531 840
.
- - End Of File - - 78BDF4FF4FA35B9175B357AB476BBBAC
Pokud bud chtit CF nainstalovat Konyolu pro zotaveni, tak mu to odsouhlaste
Každopádně stažený jede a to měli stejné názvy i velikost
