Re: Restartovani Pc
Napsal: 08 črc 2011 15:07
ComboFix 11-07-07.06 - Martin 08.07.2011 15:52:53.21.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.1023.718 [GMT 2:00]
Running from: c:\documents and settings\Martin\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Martin\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
ADS - TEMP: deleted 100 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_FUDXLS
.
.
((((((((((((((((((((((((( Files Created from 2011-06-08 to 2011-07-08 )))))))))))))))))))))))))))))))
.
.
2011-07-02 07:09 . 2011-07-02 07:10 -------- d-----w- c:\program files\Common Files\Adobe
2011-07-02 03:56 . 2011-07-02 03:56 -------- d-----w- c:\windows\Sun
2011-06-30 08:06 . 2011-06-30 08:06 -------- d-----w- c:\documents and settings\Martin\Application Data\Garena
2011-06-21 14:21 . 2011-06-23 06:39 -------- d-----w- c:\program files\DotAlicious Gaming Client
2011-06-20 17:01 . 2011-06-20 17:01 -------- d-----w- c:\program files\Common Files\Adobe AIR
2011-06-18 16:34 . 2011-06-18 16:34 -------- d-----w- c:\documents and settings\Martin\Application Data\LolClient
2011-06-18 15:38 . 2011-06-23 07:55 -------- d-----w- c:\documents and settings\Martin\Local Settings\Application Data\PMB Files
2011-06-18 15:38 . 2011-06-23 07:55 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files
2011-06-15 20:28 . 2011-06-15 20:28 -------- d-----w- c:\windows\Internet Logs
2011-06-15 20:06 . 2011-06-15 20:06 26624 ----a-w- c:\windows\system32\drivers\fsbts.sys
2011-06-15 20:05 . 2011-06-15 20:05 -------- d-----w- c:\documents and settings\Martin\Application Data\BitDefender Deployment Tool
2011-06-15 17:27 . 2011-07-06 07:52 -------- d-----w- c:\windows\system32\NtmsData
2011-06-15 17:26 . 2011-06-15 17:26 -------- d-----w- c:\documents and settings\Martin\Application Data\Avira
2011-06-15 17:21 . 2011-07-01 07:22 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-06-15 17:21 . 2011-07-01 07:22 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-06-15 17:21 . 2010-06-17 13:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2011-06-15 17:21 . 2010-06-17 13:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2011-06-15 17:21 . 2011-06-15 17:21 -------- d-----w- c:\program files\Avira
2011-06-15 17:21 . 2011-06-15 17:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2011-06-15 08:14 . 2011-06-15 08:14 -------- d-----w- c:\program files\Common Files\Java
2011-06-15 08:14 . 2011-06-15 08:13 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-15 08:14 . 2011-06-15 08:13 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-15 08:13 . 2011-06-15 08:13 -------- d-----w- c:\program files\Java
2011-06-14 16:29 . 2011-06-15 07:26 -------- d-----w- c:\documents and settings\Martin\Application Data\Darer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-15 18:27 . 2011-05-25 14:22 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-15 08:52 . 2011-05-29 12:29 1800 ----a-w- C:\UsbFix_Upload_Me_HELL-T2X5CI1VMH.zip
2011-05-28 14:04 . 2010-11-16 14:55 443448 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-05-27 20:23 . 2011-05-27 12:59 17480 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-05-04 11:54 . 2011-05-18 09:05 302080 ----a-w- C:\gmer.exe
2011-04-26 16:49 . 2011-04-08 19:46 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-04-26 16:49 . 2011-04-08 19:51 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-04-26 16:49 . 2011-04-08 19:45 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-04-26 15:55 . 2011-04-08 19:45 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2011-04-21 18:59 . 2011-04-08 19:46 22328 ----a-w- c:\documents and settings\Martin\Application Data\PnkBstrK.sys
2011-04-18 12:42 . 2011-04-18 12:39 2829 ----a-w- c:\windows\War3Unin.pif
2011-04-18 12:42 . 2011-04-18 12:39 139264 ----a-w- c:\windows\War3Unin.exe
.
.
((((((((((((((((((((((((((((( SnapShot_2011-07-06_06.31.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-08 14:01 . 2011-07-08 14:01 16384 c:\windows\temp\Perflib_Perfdata_4c0.dat
+ 2011-07-06 20:42 . 2011-07-06 20:42 5120 c:\windows\Installer\{789289CA-F73A-4A16-A331-54D498CE069F}\Icon789289CA.exe
- 2011-07-03 17:35 . 2011-07-03 17:35 5120 c:\windows\Installer\{789289CA-F73A-4A16-A331-54D498CE069F}\Icon789289CA.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-01-07 13880424]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows\system32\dumprep 0 -u [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 10:55 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-06 10:55 35736 ----a-w- c:\programy\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:42 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2011-01-07 17:56 13880424 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2011-01-07 17:56 111208 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2010-11-04 06:51 1753192 ----a-w- c:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-05-17 10:48 77824 ----a-r- c:\windows\SOUNDMAN.EXE
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programy\\Skype\\Phone\\Skype.exe"=
"c:\\Programy\\QIP\\qip.exe"=
"c:\\Programy\\Garena\\Garena.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57840:TCP"= 57840:TCP:Pando Media Booster
"57840:UDP"= 57840:UDP:Pando Media Booster
.
R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [15.6.2011 22:06 26624]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [15.6.2011 19:21 136360]
S3 cpuz134;cpuz134;\??\c:\docume~1\Martin\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys --> c:\docume~1\Martin\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [?]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\programy\Garena\safedrv.sys --> c:\programy\Garena\safedrv.sys [?]
S4 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
.
.
------- Supplementary Scan -------
.
uSearchAssistant =
TCP: DhcpNameServer = 195.12.128.1 195.72.0.3
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Martin\Application Data\Mozilla\Firefox\Profiles\ghya889f.default\
FF - prefs.js: browser.search.selectedEngine - QIP Search
FF - prefs.js: browser.startup.homepage - hxxp://www.azet.sk/
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-08 16:01
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\nvsvc32.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\System32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-07-08 16:04:39 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-08 14:04
ComboFix2.txt 2011-07-06 06:32
ComboFix3.txt 2011-06-15 19:51
ComboFix4.txt 2011-06-04 22:54
ComboFix5.txt 2011-07-08 13:52
.
Pre-Run: 62 504 722 432 bytes free
Post-Run: 12 adresárov, 62 493 474 816 voľných bajtov
.
- - End Of File - - C31D2EEFE87634229E12384A6BE18AB6
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.1023.718 [GMT 2:00]
Running from: c:\documents and settings\Martin\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Martin\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
ADS - TEMP: deleted 100 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_FUDXLS
.
.
((((((((((((((((((((((((( Files Created from 2011-06-08 to 2011-07-08 )))))))))))))))))))))))))))))))
.
.
2011-07-02 07:09 . 2011-07-02 07:10 -------- d-----w- c:\program files\Common Files\Adobe
2011-07-02 03:56 . 2011-07-02 03:56 -------- d-----w- c:\windows\Sun
2011-06-30 08:06 . 2011-06-30 08:06 -------- d-----w- c:\documents and settings\Martin\Application Data\Garena
2011-06-21 14:21 . 2011-06-23 06:39 -------- d-----w- c:\program files\DotAlicious Gaming Client
2011-06-20 17:01 . 2011-06-20 17:01 -------- d-----w- c:\program files\Common Files\Adobe AIR
2011-06-18 16:34 . 2011-06-18 16:34 -------- d-----w- c:\documents and settings\Martin\Application Data\LolClient
2011-06-18 15:38 . 2011-06-23 07:55 -------- d-----w- c:\documents and settings\Martin\Local Settings\Application Data\PMB Files
2011-06-18 15:38 . 2011-06-23 07:55 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files
2011-06-15 20:28 . 2011-06-15 20:28 -------- d-----w- c:\windows\Internet Logs
2011-06-15 20:06 . 2011-06-15 20:06 26624 ----a-w- c:\windows\system32\drivers\fsbts.sys
2011-06-15 20:05 . 2011-06-15 20:05 -------- d-----w- c:\documents and settings\Martin\Application Data\BitDefender Deployment Tool
2011-06-15 17:27 . 2011-07-06 07:52 -------- d-----w- c:\windows\system32\NtmsData
2011-06-15 17:26 . 2011-06-15 17:26 -------- d-----w- c:\documents and settings\Martin\Application Data\Avira
2011-06-15 17:21 . 2011-07-01 07:22 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-06-15 17:21 . 2011-07-01 07:22 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-06-15 17:21 . 2010-06-17 13:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2011-06-15 17:21 . 2010-06-17 13:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2011-06-15 17:21 . 2011-06-15 17:21 -------- d-----w- c:\program files\Avira
2011-06-15 17:21 . 2011-06-15 17:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2011-06-15 08:14 . 2011-06-15 08:14 -------- d-----w- c:\program files\Common Files\Java
2011-06-15 08:14 . 2011-06-15 08:13 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-15 08:14 . 2011-06-15 08:13 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-15 08:13 . 2011-06-15 08:13 -------- d-----w- c:\program files\Java
2011-06-14 16:29 . 2011-06-15 07:26 -------- d-----w- c:\documents and settings\Martin\Application Data\Darer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-15 18:27 . 2011-05-25 14:22 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-15 08:52 . 2011-05-29 12:29 1800 ----a-w- C:\UsbFix_Upload_Me_HELL-T2X5CI1VMH.zip
2011-05-28 14:04 . 2010-11-16 14:55 443448 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-05-27 20:23 . 2011-05-27 12:59 17480 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-05-04 11:54 . 2011-05-18 09:05 302080 ----a-w- C:\gmer.exe
2011-04-26 16:49 . 2011-04-08 19:46 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-04-26 16:49 . 2011-04-08 19:51 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-04-26 16:49 . 2011-04-08 19:45 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-04-26 15:55 . 2011-04-08 19:45 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2011-04-21 18:59 . 2011-04-08 19:46 22328 ----a-w- c:\documents and settings\Martin\Application Data\PnkBstrK.sys
2011-04-18 12:42 . 2011-04-18 12:39 2829 ----a-w- c:\windows\War3Unin.pif
2011-04-18 12:42 . 2011-04-18 12:39 139264 ----a-w- c:\windows\War3Unin.exe
.
.
((((((((((((((((((((((((((((( SnapShot_2011-07-06_06.31.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-08 14:01 . 2011-07-08 14:01 16384 c:\windows\temp\Perflib_Perfdata_4c0.dat
+ 2011-07-06 20:42 . 2011-07-06 20:42 5120 c:\windows\Installer\{789289CA-F73A-4A16-A331-54D498CE069F}\Icon789289CA.exe
- 2011-07-03 17:35 . 2011-07-03 17:35 5120 c:\windows\Installer\{789289CA-F73A-4A16-A331-54D498CE069F}\Icon789289CA.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-01-07 13880424]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows\system32\dumprep 0 -u [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 10:55 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-06 10:55 35736 ----a-w- c:\programy\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:42 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2011-01-07 17:56 13880424 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2011-01-07 17:56 111208 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2010-11-04 06:51 1753192 ----a-w- c:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-05-17 10:48 77824 ----a-r- c:\windows\SOUNDMAN.EXE
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programy\\Skype\\Phone\\Skype.exe"=
"c:\\Programy\\QIP\\qip.exe"=
"c:\\Programy\\Garena\\Garena.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57840:TCP"= 57840:TCP:Pando Media Booster
"57840:UDP"= 57840:UDP:Pando Media Booster
.
R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [15.6.2011 22:06 26624]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [15.6.2011 19:21 136360]
S3 cpuz134;cpuz134;\??\c:\docume~1\Martin\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys --> c:\docume~1\Martin\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [?]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\programy\Garena\safedrv.sys --> c:\programy\Garena\safedrv.sys [?]
S4 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
.
.
------- Supplementary Scan -------
.
uSearchAssistant =
TCP: DhcpNameServer = 195.12.128.1 195.72.0.3
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Martin\Application Data\Mozilla\Firefox\Profiles\ghya889f.default\
FF - prefs.js: browser.search.selectedEngine - QIP Search
FF - prefs.js: browser.startup.homepage - hxxp://www.azet.sk/
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-08 16:01
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\nvsvc32.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\System32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-07-08 16:04:39 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-08 14:04
ComboFix2.txt 2011-07-06 06:32
ComboFix3.txt 2011-06-15 19:51
ComboFix4.txt 2011-06-04 22:54
ComboFix5.txt 2011-07-08 13:52
.
Pre-Run: 62 504 722 432 bytes free
Post-Run: 12 adresárov, 62 493 474 816 voľných bajtov
.
- - End Of File - - C31D2EEFE87634229E12384A6BE18AB6