Tak jsem zpátky, a tady mám další log ->
ComboFix 08-09-05.14 - Pavel Jirgal 2008-09-11 19:28:54.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1484 [GMT 2:00]
Spusteny z: C:\Documents and Settings\Pavel Jirgal\Plocha\ComboFix.exe
* Vytvoren novy Bod Obnoveni
VAROVANI - NA TOMTO POCITACI NENI NAINSTALOVANA KONZOLA PRO ZOTAVENI !!
.
((((((((((((((((((((((((((((((((((((((( Ostatni vymazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Johny.RODINKA-FA95D67\Nabídka Start\Programy\Download programs.url
C:\Documents and Settings\Johny.RODINKA-FA95D67\Nabídka Start\Programy\Games.url
C:\Documents and Settings\Johny.RODINKA-FA95D67\Nabídka Start\Programy\Translator.url
C:\Documents and Settings\Johny.RODINKA-FA95D67\Nabídka Start\Programy\Videos.url
C:\Documents and Settings\Johny.RODINKA-FA95D67\Oblíbené položky\Download programs.url
C:\Documents and Settings\Johny.RODINKA-FA95D67\Oblíbené položky\Games.url
C:\Documents and Settings\Johny.RODINKA-FA95D67\Oblíbené položky\Translator.url
C:\Documents and Settings\Johny.RODINKA-FA95D67\Oblíbené položky\Videos.url
C:\WA6P
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\Packet.dll
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\WanPacket.dll
C:\WINDOWS\system32\wpcap.dll
I:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Ovladace/Sluzby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MYWEBSEARCHSERVICE
-------\Legacy_NPF
-------\Service_MyWebSearchService
-------\Service_NPF
((((((((((((((((((((((((( Soubory vytvorene od 2008-08-11 do 2008-09-11 )))))))))))))))))))))))))))))))
.
2008-09-11 19:17 . 2008-09-11 19:17 <DIR> d-------- C:\!FixIEDef
2008-09-09 17:29 . 2008-09-08 00:11 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 17:29 . 2008-09-08 00:11 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-08 16:33 . 2008-09-08 16:33 <DIR> d-------- C:\Program files\CCleaner
2008-09-06 14:40 . 2008-09-06 14:40 <DIR> d-------- C:\WINDOWS\Profiles
2008-09-06 14:39 . 2008-09-06 14:39 <DIR> d-------- C:\Documents and Settings\JOHNY~1~ROD\LOCALS~1
2008-09-06 14:39 . 2008-09-06 14:39 <DIR> d-------- C:\Documents and Settings\JOHNY~1~ROD
2008-09-06 14:39 . 1998-11-13 12:08 308,224 --a------ C:\WINDOWS\IsUn0413.exe
2008-09-06 14:34 . 2008-09-06 14:42 <DIR> d-------- C:\Program files\KaM - The Peasants Rebellion
2008-09-06 13:04 . 2008-09-06 13:04 <DIR> d-------- C:\Program files\IsoBuster
2008-09-06 13:04 . 2008-09-06 13:04 <DIR> d-------- C:\Program files\Conduit
2008-09-03 17:14 . 2008-09-03 17:14 <DIR> d-------- C:\Program files\Hamachi
2008-08-29 21:51 . 2008-08-29 21:51 <DIR> d-------- C:\Program files\Google
2008-08-29 20:12 . 2008-08-29 20:12 <DIR> d-------- C:\WINDOWS\Eurobattle.net Installer
2008-08-28 08:53 . 2008-08-28 08:53 <DIR> d-------- C:\WINDOWS\system32\cs
2008-08-28 08:53 . 2008-08-28 08:53 <DIR> d-------- C:\WINDOWS\system32\bits
2008-08-28 08:53 . 2008-08-28 08:53 <DIR> d-------- C:\WINDOWS\l2schemas
2008-08-28 08:48 . 2008-08-28 08:54 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-08-26 18:06 . 2008-08-26 18:06 <DIR> d-------- C:\Program files\rajce
2008-08-25 14:49 . 2005-09-01 12:03 127,488 --------- C:\WINDOWS\system32\drivers\imagesrv.sys
2008-08-25 14:49 . 2005-09-01 12:03 5,888 --------- C:\WINDOWS\system32\drivers\imagedrv.sys
2008-08-25 14:47 . 2008-08-25 14:47 <DIR> d-------- C:\Program files\Common Files\Ahead
2008-08-25 14:47 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2008-08-25 14:47 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2008-08-25 14:47 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2008-08-25 14:47 . 2004-07-09 09:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll
2008-08-25 14:47 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2008-08-25 14:47 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-08-25 14:35 . 2008-09-11 19:34 <DIR> d-------- C:\Program files\AskTBar
2008-08-24 14:48 . 2008-08-24 14:48 <DIR> d-------- C:\Program files\uTorrent
2008-08-19 12:29 . 2008-04-20 13:55 <DIR> d--h----- C:\Documents and Settings\Johny.RODINKA-FA95D67\ćablony
2008-08-19 12:29 . 2008-09-07 09:21 <DIR> d-------- C:\Documents and Settings\Johny.RODINKA-FA95D67\Plocha
2008-08-19 12:29 . 2008-04-20 15:22 <DIR> d--h----- C:\Documents and Settings\Johny.RODINKA-FA95D67\Okolnˇ tisk rny
2008-08-19 12:29 . 2008-04-20 15:22 <DIR> d--h----- C:\Documents and Settings\Johny.RODINKA-FA95D67\Okolnˇ sˇś
2008-08-19 12:29 . 2008-09-11 19:29 <DIR> dr------- C:\Documents and Settings\Johny.RODINKA-FA95D67\Oblˇben‚ polo§ky
2008-08-19 12:29 . 2008-04-20 15:22 <DIR> dr------- C:\Documents and Settings\Johny.RODINKA-FA95D67\Nabˇdka Start
2008-08-19 12:29 . 2008-09-06 14:40 <DIR> dr------- C:\Documents and Settings\Johny.RODINKA-FA95D67\Dokumenty
2008-08-19 12:29 . 2008-09-06 14:40 <DIR> dr-h----- C:\Documents and Settings\Johny.RODINKA-FA95D67\Data aplikacˇ
2008-08-19 12:29 . 2008-08-19 12:29 <DIR> d-------- C:\Documents and Settings\Johny.RODINKA-FA95D67
2008-08-19 12:10 . 2004-08-03 22:41 1,309,184 --------- C:\WINDOWS\system32\drivers\mtlstrm.sys
2008-08-19 12:09 . 2004-07-17 11:36 184,130 -----c--- C:\WINDOWS\system32\dllcache\compact.wmz
2008-08-19 12:09 . 2004-07-17 22:55 129,045 --------- C:\WINDOWS\system32\drivers\cxthsfs2.cty
2008-08-19 12:09 . 2001-10-25 16:00 9,585 -----c--- C:\WINDOWS\system32\dllcache\controls.css
2008-08-19 12:09 . 2001-10-25 16:00 999 -----c--- C:\WINDOWS\system32\dllcache\bktrh.gif
2008-08-19 12:09 . 2001-10-25 16:00 773 -----c--- C:\WINDOWS\system32\dllcache\cnth.gif
2008-08-19 12:09 . 2001-10-25 16:00 773 -----c--- C:\WINDOWS\system32\dllcache\cnt.gif
2008-08-19 12:09 . 2001-10-25 16:00 772 -----c--- C:\WINDOWS\system32\dllcache\cntd.gif
2008-08-19 12:09 . 2001-10-25 16:00 760 -----c--- C:\WINDOWS\system32\dllcache\cloapph.gif
2008-08-19 12:09 . 2001-10-25 16:00 717 -----c--- C:\WINDOWS\system32\dllcache\cloapp.gif
2008-08-18 21:59 . 2008-08-18 21:59 <DIR> d-------- C:\Program files\Winamp3
2008-08-16 18:01 . 2008-08-18 21:59 <DIR> d-------- C:\Documents and Settings\Johny\ćablony
2008-08-16 18:01 . 2008-09-04 09:22 <DIR> d-------- C:\Documents and Settings\Johny\Plocha
2008-08-16 18:01 . 2008-08-18 21:59 <DIR> d-------- C:\Documents and Settings\Johny\Oblˇben‚ polo§ky
2008-08-16 18:01 . 2008-08-18 21:59 <DIR> d-------- C:\Documents and Settings\Johny\Data aplikacˇ
2008-08-16 18:01 . 2008-08-18 21:59 <DIR> d---s---- C:\Documents and Settings\Johny
2008-08-15 21:57 . 2008-04-11 21:06 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-12 11:16 . 2008-08-15 12:00 <DIR> d-------- C:\Program files\PPT To Video Scout
2008-08-12 11:03 . 2008-08-12 11:03 <DIR> d-------- C:\Program files\Wondershare
2008-08-11 15:17 . 2008-08-11 15:20 <DIR> d-------- C:\Program files\ScreenVCR
2008-08-11 15:17 . 2006-02-05 22:01 122,880 --a------ C:\WINDOWS\system32\ScreenSource.ax
2008-08-11 15:17 . 2006-02-05 22:06 77,824 --a------ C:\WINDOWS\system32\Screen2Video.OCX
2008-08-11 11:07 . 2008-08-11 11:07 <DIR> d-------- C:\Program files\CDex_170b2
.
(((((((((((((((((((((((((((((((((((((((( Find3M vypis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-06 12:40 --------- d-----w C:\Program Files\Common Files\Adobe
2008-09-03 15:14 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-08-25 12:47 --------- d-----w C:\Program Files\Ahead
2008-08-04 13:20 --------- d-----w C:\Program Files\RealVNC
2008-08-04 13:03 1,421,234 ----a-w C:\VNCNavigatorFree.exe
2008-08-03 16:17 --------- d-----w C:\Program Files\MP3 Player Utilities 4.18
2008-08-03 12:53 --------- d-----w C:\Program Files\MSECache
2008-07-31 08:19 --------- d-----w C:\Program Files\Avast
2008-07-28 17:02 --------- d-----w C:\Program Files\UPSANI
2008-07-19 14:00 --------- d-----w C:\Program Files\MIKSOFT
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-15 22:59 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2008-07-15 22:59 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2008-07-15 22:59 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2008-07-13 11:01 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es(2).dll
2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:42 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:49 247,296 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-05-01 19:33 6,820,560 ----a-w C:\Program Files\FirefoxGoogleToolbarSetup.exe
2006-03-02 15:18 2,539 -c--a-w C:\Program Files\COPYRIGHT
2006-01-05 22:34 293,255 -c--a-w C:\Program Files\LOGFILE.TXT
2006-01-05 22:34 29 -c--a-w C:\Program Files\CONFIG.CFG
2006-01-05 22:34 13,215 -c--a-w C:\Program Files\dx_error.log
2005-11-10 10:36 998 ----a-r C:\Program Files\Welcome.html
2005-11-10 10:36 993 -c--a-r C:\Program Files\CHANGES
2005-11-10 10:36 69,740 -c--a-r C:\Program Files\THIRDPARTYLICENSEREADME.txt
2005-11-10 10:36 14,272 -c--a-r C:\Program Files\README.txt
2005-11-10 10:36 11,007 -c--a-r C:\Program Files\LICENSE
2005-10-23 09:22 42,507 -c--a-w C:\Program Files\Uninst.isu
2004-04-07 19:57 2,241 -c--a-w C:\Program Files\AoM_návod.txt
2000-06-15 13:35 5,261 -c--a-w C:\Program Files\CREDITS.txt
2000-05-19 13:51 79,892 -c--a-w C:\Program Files\language.txt
1999-06-14 15:11 96 -c--a-w C:\Program Files\default.cfg
1999-05-08 18:53 2,001 -c--a-w C:\Program Files\CD Tracks.txt
1999-04-03 16:21 167,936 -c--a-w C:\Program Files\binkw32.dll
1999-01-28 11:44 95,232 -c--a-w C:\Program Files\SMACKW32.DLL
.
(((((((((((((((((((((((((((((((((( Spousteci body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznamka* prazdne zaznamy & legitimni vychozi udaje nejsou zobrazeny.
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}]
2008-07-27 21:11 1606680 --a------ C:\Program Files\IsoBuster\tbIsoB.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}"= "C:\Program Files\IsoBuster\tbIsoB.dll" [2008-07-27 1606680]
[HKEY_CLASSES_ROOT\clsid\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 8491008]
"Adobe Reader Speed Launcher"="F:\adobe\Reader\Reader_sl.exe" [2008-01-11 39792]
"w3dr.exe"="D:\P_a_u_l_i_e\Warcraft III\w3dr.exe" [2008-08-03 61440]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-30 155648]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-01-20 217088]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 69632]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 81920]
"Counter"="C:\Program Files\Alex Buturuga\Counter 2\Counter.exe" [2005-03-05 806400]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-20 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2007-10-04 C:\WINDOWS\system32\nwiz.exe]
"CHotkey"="mHotkey.exe" [2006-12-08 C:\WINDOWS\mHotkey.exe]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\CNAB4RPK.EXE"=
"F:\\Program Files\\Garena\\Garena.exe"=
"D:\\P_a_u_l_i_e\\Warcraft III\\war3.exe"=
"D:\\P_a_u_l_i_e\\qip\\qip.exe"=
"D:\\P_a_u_l_i_e\\valve\\hl.exe"=
"D:\\P_a_u_l_i_e\\valve\\hlds.exe"=
"C:\\Program files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\StrongDC.exe"=
"D:\\P_a_u_l_i_e\\valve\\hltv.exe"=
"C:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"C:\\WINDOWS\\system32\\mstsc.exe"=
"C:\\Program files\\uTorrent\\uTorrent.exe"=
"D:\\AoE2\\EMPIRES2.ICD"=
"D:\\Program Files\\KaM - The Peasants Rebellion\\KM_TPR.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc1
"3600:TCP"= 3600:TCP:vnc2
"5800:TCP"= 5800:TCP:vnc3
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
R0 IFP1000;iriver Internet Audio Player IFP-1000;C:\WINDOWS\system32\drivers\ifp1000.sys [2004-03-29 14531]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R3 DualCoreCenter;DualCoreCenter;C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys [2007-04-17 28160]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2008-04-13 69120]
R3 RushTopDevice2;RushTopDevice2;C:\Program Files\MSI\DualCoreCenter\RushTop.sys [2007-10-18 51200]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 LOL;LOL;C:\WINDOWS\system32\LOL.sys [ ]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dca0a3a9-7bff-11dd-acb8-0019dbe87299}]
\Shell\AutoRun\command - E:\PMB_P.exe
*Newly Created Service* - DUALCORECENTER
*Newly Created Service* - RUSHTOPDEVICE2
.
- - - - NEPLATNE POLOZKY ODSTRANENE Z REGISTRU - - - -
Notify-WgaLogon - (no file)
.
------- Doplnkovy sken -------
.
FireFox -: Profile - C:\Documents and Settings\Pavel Jirgal\Data aplikací\Mozilla\Firefox\Profiles\n0m5n74r.default\
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-09-11 19:35:45
Windows 5.1.2600 Service Pack 3 NTFS
skenovani skrytych procesu ...
skenovani skrytych polozek 'Po spusteni' ...
skenovani skrytych souboru ...
sken byl uspesne dokoncen
skryte soubory: 0
**************************************************************************
.
------------------------ Jine spustene procesy ------------------------
.
C:\Program files\Avast\aswUpdSv.exe
C:\Program files\Avast\ashServ.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program files\Creative\Shared Files\CTDevSrv.exe
C:\Program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\locator.exe
C:\WINDOWS\system32\tlntsvr.exe
C:\Program files\RealVNC\VNC4\winvnc4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program files\Avast\ashMaiSv.exe
C:\Program files\Avast\ashWebSv.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
C:\Program files\MSI\DualCoreCenter\DualCoreCenter.exe
.
**************************************************************************
.
Celkovy cas: 2008-09-11 19:40:17 - pocitac byl restartovan
ComboFix-quarantined-files.txt 2008-09-11 17:40:11
Pre-Run: 574,482,432
Post-Run: 2,238,655,488
248 --- E O F --- 2008-08-30 00:57:02