CKScanner - Additional Security Risks - These are not necessarily bad
scanner sequence 3.RP.11
----- EOF -----
ComboFix 11-04-12.01 - doma 12.04.2011 23:29:00.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3582.3150 [GMT 2:00]
Spuštěný z: c:\documents and settings\doma\Plocha\ComboFix.exe
AV: ESET Smart Security 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý
.
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\doma\Plocha\Best Malware Protection.lnk
c:\documents and settings\doma\Recent\cb.dll
c:\documents and settings\doma\Recent\DBOLE.tmp
c:\documents and settings\doma\Recent\ddv.dll
c:\documents and settings\doma\Recent\dudl.sys
c:\documents and settings\doma\Recent\eb.dll
c:\documents and settings\doma\Recent\eb.exe
c:\documents and settings\doma\Recent\eb.sys
c:\documents and settings\doma\Recent\energy.drv
c:\documents and settings\doma\Recent\exec.tmp
c:\documents and settings\doma\Recent\fan.sys
c:\documents and settings\doma\Recent\FW.tmp
c:\documents and settings\doma\Recent\hymt.sys
c:\documents and settings\doma\Recent\kernel32.exe
c:\documents and settings\doma\Recent\kernel32.tmp
c:\documents and settings\doma\Recent\pal.dll
c:\documents and settings\doma\Recent\pal.tmp
c:\documents and settings\doma\Recent\PE.exe
c:\documents and settings\doma\Recent\PE.sys
c:\documents and settings\doma\Recent\ppal.sys
c:\documents and settings\doma\Recent\SICKBOY.drv
c:\documents and settings\doma\Recent\tjd.exe
c:\documents and settings\doma\Recent\tjd.sys
c:\documents and settings\doma\Recent\tjd.tmp
c:\program files\ESET\MiNODLogin
c:\program files\ESET\MiNODLogin\MiNODLogin.exe
c:\program files\ESET\MiNODLogin\MiNODLogin.jar
c:\program files\ESET\MiNODLogin\MiNODLoginLib.dll
c:\program files\ESET\MiNODLogin\MiNODLoginUninst.exe
c:\program files\ESET\MiNODLogin\servidores.xml
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-12 do 2011-04-12 )))))))))))))))))))))))))))))))
.
.
2011-04-12 01:00 . 2011-04-12 01:00 -------- d-----w- c:\program files\MSXML 4.0
2011-04-11 21:52 . 2005-09-23 20:18 171520 ------w- c:\windows\system32\drivers\MarvinBus.sys
2011-04-11 21:52 . 2011-04-11 21:52 -------- d-----w- c:\program files\Common Files\Pinnacle
2011-04-11 21:52 . 2011-04-11 21:52 -------- d-----w- c:\documents and settings\doma\Local Settings\Data aplikací\Downloaded Installations
2011-04-11 21:52 . 2011-04-11 22:21 -------- d-----w- c:\documents and settings\doma\Local Settings\Data aplikací\Pinnacle
2011-04-11 21:51 . 2011-04-11 21:58 -------- d-----w- c:\documents and settings\All Users\Data aplikac
2011-04-11 21:47 . 2011-04-12 20:34 -------- d-----w- c:\program files\Pinnacle
2011-03-25 19:39 . 2011-03-25 19:39 -------- d-----w- c:\program files\FSCapture53
2011-03-22 19:22 . 2011-03-22 19:22 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-03-22 19:22 . 2011-03-22 19:22 728024 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-03-22 19:22 . 2011-03-22 19:22 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-03-22 19:22 . 2011-03-22 19:22 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-03-22 19:22 . 2011-03-22 19:22 142296 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-03-22 19:22 . 2011-03-22 19:22 1893336 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-03-22 19:22 . 2011-03-22 19:22 1975768 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-03-22 19:22 . 2011-03-22 19:22 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-03-21 23:18 . 2011-03-21 23:19 -------- d-----w- c:\documents and settings\doma\Data aplikací\PSpad
2011-03-21 23:18 . 2011-03-21 23:18 -------- d-----w- c:\program files\PSPad editor
2011-03-21 23:15 . 2011-03-21 23:15 -------- d-----w- c:\documents and settings\doma\Data aplikací\FastStone
2011-03-15 20:09 . 2011-03-15 20:09 -------- d-----w- c:\documents and settings\doma\Data aplikací\Thunderbird
2011-03-15 20:09 . 2011-03-15 20:09 -------- d-----w- c:\documents and settings\doma\Local Settings\Data aplikací\Thunderbird
2011-03-15 20:09 . 2011-03-15 20:09 -------- d-----w- c:\program files\Mozilla Thunderbird
2011-03-14 21:39 . 2011-03-25 18:54 271200 ------w- c:\windows\system32\PnkBstrB.xtr
2011-03-14 21:14 . 2011-03-14 21:14 -------- d-----w- c:\documents and settings\doma\Local Settings\Data aplikací\PunkBuster
2011-03-14 21:04 . 2011-03-25 18:55 138160 ------w- c:\windows\system32\drivers\PnkBstrK.sys
2011-03-14 21:04 . 2011-03-14 21:04 22328 ----a-w- c:\documents and settings\doma\Data aplikací\PnkBstrK.sys
2011-03-14 21:04 . 2011-03-25 18:54 271200 ------w- c:\windows\system32\PnkBstrB.exe
2011-03-14 21:04 . 2011-03-25 18:52 271200 ------w- c:\windows\system32\PnkBstrB.ex0
2011-03-14 21:04 . 2011-03-14 21:23 75136 ------w- c:\windows\system32\PnkBstrA.exe
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-11 01:08 . 2011-03-11 01:08 73728 ------w- c:\windows\system32\javacpl.cpl
2011-03-11 01:08 . 2011-03-11 01:08 472808 ------w- c:\windows\system32\deployJava1.dll
2011-03-10 21:26 . 2011-03-10 21:14 16608 ----a-w- c:\windows\gdrv.sys
2011-03-10 21:17 . 2011-03-10 21:17 315392 ----a-w- c:\windows\HideWin.exe
2011-02-28 08:00 . 2011-03-12 19:41 80896 ------w- c:\windows\system32\ff_vfw.dll
2011-02-18 15:36 . 2011-03-11 23:32 41984 ------w- c:\windows\system32\drivers\usbaapl.sys
2011-02-18 15:36 . 2011-03-11 23:32 4184352 ------w- c:\windows\system32\usbaaplrc.dll
2011-02-09 13:53 . 2004-08-17 14:49 270848 ------w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-17 14:49 186880 ------w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2011-03-10 20:57 2067456 ------w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2011-03-10 20:57 677888 ------w- c:\windows\system32\mstsc.exe
2011-01-25 10:40 . 2011-03-10 15:47 97112 ------w- c:\windows\system32\drivers\idmtdi.sys
2011-01-21 14:44 . 2004-08-17 14:49 440320 ------w- c:\windows\system32\shimgvw.dll
2011-03-22 19:22 . 2011-03-22 19:22 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2011-03-02 16:23 68216 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2011-03-10 3278232]
"Best Malware Protection"="c:\documents and settings\All Users\Data aplikací\497751\BM497_2124.exe" [2011-04-12 2547712]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2006-12-26 196608]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-03-24 1983816]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-01-12 2219184]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-11 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Aktualizovat ESET licenci.lnk - c:\program files\ESET\MiNODLogin\MiNODLogin.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"=
"c:\\Program Files\\ICQ7.4\\ICQ.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\497751\\BM497_2124.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 16:04 115008]
R1 IDMTDI;IDMTDI;c:\windows\system32\drivers\idmtdi.sys [10.3.2011 17:47 97112]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [12.1.2011 17:41 810144]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\drivers\Amps2prt.sys [9.5.2006 18:27 13824]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 14:37 517096]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-04-12 c:\windows\Tasks\AdobeAAMUpdater-1.0-HONZA-doma.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-03-11 22:29]
.
2011-03-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 10:50]
.
2011-04-12 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2011-03-11 16:24]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:25401
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Stáhnout s IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Stáhnout s IDM obsah FLV videa - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Stáhnout s IDM všechny odkazy - c:\program files\Internet Download Manager\IEGetAll.htm
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
FF - ProfilePath - c:\documents and settings\doma\Data aplikací\Mozilla\Firefox\Profiles\xpp1auv6.default\
FF - prefs.js: browser.startup.homepage - hxxp://puvodni.centrum.cz
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-MiNODLogin - c:\program files\ESET\MiNODLogin\MiNODLoginUninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2011-04-12 23:38
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(992)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2011-04-12 23:39:38
ComboFix-quarantined-files.txt 2011-04-12 21:39
.
Před spuštěním: Volných bajtů: 132 655 239 168
Po spuštění: Volných bajtů: 135 122 857 984
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - AB8ACB38C62721500E1CEC5230E41D71
Tohle je log z RKillu
