VIRY.CZ

ComboFix 11-03-04.06 - petulka 05.03.2011 12:00:45.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1618 [GMT 1:00]
Spuštěný z: c:\documents and settings\petulka\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-02-05 do 2011-03-05 )))))))))))))))))))))))))))))))
.
.
2011-03-04 15:42 . 2011-03-04 15:42 -------- d-----w- C:\VundoFix Backups
2011-03-01 09:19 . 2011-03-01 09:19 -------- d-----w- C:\totalcmd
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-21 14:44 . 2008-04-14 12:00 8466432 ----a-w- c:\windows\system32\shell32.dll
2011-01-21 14:44 . 2008-04-14 12:00 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2008-04-14 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 14:04 . 2008-04-14 12:00 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2008-04-14 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:52 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:52 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2010-12-20 23:52 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-12-20 22:14 . 2008-04-14 12:00 1510912 ----a-w- c:\windows\system32\shdocvw.dll
2010-12-20 17:25 . 2008-04-14 12:00 729088 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2010-12-09 15:15 . 2008-04-14 12:00 713216 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 15:14 . 2008-04-14 08:06 2029056 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-09 15:14 . 2008-04-14 12:00 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 14:30 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-03-04_16.22.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-03-05 10:59 . 2011-03-05 10:59 16384 c:\windows\Temp\Perflib_Perfdata_3a0.dat
+ 2008-04-14 12:00 . 2011-03-05 11:03 80114 c:\windows\system32\perfc009.dat
+ 2008-04-14 12:00 . 2011-03-05 11:03 93672 c:\windows\system32\perfc005.dat
+ 2011-02-28 19:04 . 2011-03-04 17:48 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2011-02-28 19:04 . 2011-03-04 07:18 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2011-02-28 19:04 . 2011-03-04 07:18 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2011-02-28 19:04 . 2011-03-04 17:48 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2011-03-03 15:22 . 2011-03-03 17:21 13403 c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\ATI\ACE\Manifest.Bin
+ 2011-03-03 15:22 . 2011-03-04 17:48 13403 c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\ATI\ACE\Manifest.Bin
+ 2011-03-03 06:30 . 2011-03-04 17:48 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
- 2011-03-03 06:30 . 2011-03-04 07:18 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
+ 2011-03-04 17:48 . 2011-03-04 17:48 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2011-02-28 19:04 . 2011-03-04 07:18 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2008-04-14 12:00 . 2011-03-05 11:03 463222 c:\windows\system32\perfh009.dat
+ 2008-04-14 12:00 . 2011-03-05 11:03 458410 c:\windows\system32\perfh005.dat
+ 2011-03-04 18:12 . 2011-03-04 18:12 218688 c:\windows\system32\drivers\dtsoftbus01.sys
- 2011-03-01 10:00 . 2011-03-01 10:00 218688 c:\windows\system32\drivers\dtsoftbus01.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 15:04 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\petulka\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2011-02-28 136176]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"uTorrent"="d:\download\uTorrent.exe" [2011-03-01 396152]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2010-07-02 2347216]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-02-23 3451496]
"RTHDCPL"="RTHDCPL.EXE" [2011-01-21 20026472]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"HDInspector.exe"="c:\program files\Hard Drive Inspector\HDInspector.exe" [2010-08-10 3145464]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2011-03-02 1233856]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Download\\uTorrent.exe"=
.
R0 mv614x;mv614x;c:\windows\system32\drivers\mv614x.sys [1.3.2011 9:35 63232]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [28.2.2011 20:09 371544]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [28.2.2011 20:09 301528]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [4.3.2011 19:12 218688]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [28.2.2011 20:09 19544]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [28.2.2011 20:14 35712]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [28.2.2011 20:10 136176]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1.3.2011 8:45 1691480]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-03-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-28 19:09]
.
2011-03-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-28 19:09]
.
.
------- Doplňkový sken -------
.
uStart Page = my.daemon-search.com
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-05 12:05
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
.
C:\## aswSnx private storage
.
sken byl úspešně dokončen
skryté soubory: 1
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(988)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2011-03-05 12:08:01
ComboFix-quarantined-files.txt 2011-03-05 11:07
.
Před spuštěním: 7 380 975 616
Po spuštění: 7 376 568 320
.
- - End Of File - - 72EC10AA249F59310ABAD31F462F36D7

Log vypadá čistý. Pro příště: Bez předchozí odborné kontroly pomocí logu RSIT ComboFix nespouštějte. Za určitých okolností byste mohl poškodit systém.