VIRY.CZ

Zaboha se nepřipojí na internet.

ComboFix 10-02-05.04 - root 06.02.2010 15:55:56.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.255.123 [GMT 1:00]
Spuštěný z: F:\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý


VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\MySearch
c:\program files\MySearch\bar\1.bin\MYSEARCHPLUGINPROXY.CLASS
c:\program files\MySearch\bar\Cache\files.ini
c:\program files\MySearch\bar\History\search
c:\recycler\NPROTECT
c:\windows\system32\206.scr
c:\windows\system32\ieuinit.inf
c:\windows\system32\resetwpa.reg

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-06 do 2010-02-06 )))))))))))))))))))))))))))))))
.

2010-02-06 12:21 . 2009-09-03 09:17 15688 ----a-w- c:\windows\system32\lsdelete.exe
2010-02-06 11:23 . 2010-02-06 11:23 -------- dc----w- c:\windows\system32\DRVSTORE
2010-02-06 11:23 . 2009-09-23 12:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-02-06 11:21 . 2010-02-06 11:21 -------- d-----w- c:\program files\CCleaner
2010-01-23 15:55 . 2009-05-11 08:00 57440 ----a-w- c:\windows\system32\jswscimd.sys
2010-01-23 15:55 . 2009-05-11 08:00 57440 ----a-w- c:\windows\system32\drivers\jswscimd.sys
2010-01-23 15:55 . 2009-05-11 08:00 405582 ----a-w- c:\windows\system32\jswscsup.dll
2010-01-23 15:37 . 2008-08-16 12:02 60416 ----a-w- c:\windows\system32\antiwpa.dll
2010-01-23 14:57 . 2010-01-24 16:23 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-01-23 14:14 . 2010-01-23 14:14 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2010-01-23 14:13 . 2010-01-23 14:15 -------- d-----w- c:\windows\system32\wbem\AutoRecover
2010-01-23 13:02 . 2004-08-03 22:08 40832 ------w- c:\windows\system32\drivers\irbus.sys
2010-01-23 13:02 . 2004-08-03 21:59 9728 ------w- c:\windows\system32\comsdupd.exe
2010-01-23 12:32 . 2010-01-23 13:02 -------- d-----w- c:\windows\EHome
2010-01-23 12:01 . 2009-07-27 09:46 73800 ----a-w- c:\windows\system32\athgina.dll
2010-01-23 12:01 . 2009-07-27 09:46 262216 ----a-w- c:\windows\system32\IPTests.dll
2010-01-23 12:01 . 2009-07-27 09:46 495700 ----a-w- c:\windows\system32\acs.exe
2010-01-23 11:56 . 2009-07-09 11:24 1668352 ----a-w- c:\windows\system32\drivers\athuw.sys
2010-01-23 11:56 . 2009-07-09 11:24 1668352 ----a-w- c:\windows\system32\athuw.sys
2010-01-23 11:56 . 2009-07-08 15:39 1334784 ----a-w- c:\windows\system32\athur.sys
2010-01-23 11:56 . 2010-01-23 11:56 -------- d-----w- c:\windows\Options
2010-01-16 14:02 . 2010-01-23 11:43 -------- d-----w- c:\program files\ESET
2010-01-16 13:58 . 2010-01-16 13:58 -------- d-----w- c:\program files\WinASO
2010-01-16 13:53 . 2004-08-03 21:59 36352 ----a-w- c:\windows\system32\drivers\disk.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-06 12:20 . 2005-11-04 17:31 -------- d-----w- c:\program files\AWS
2010-02-06 11:22 . 2006-10-07 15:25 -------- d-----w- c:\program files\Lavasoft
2010-01-23 15:55 . 2010-01-23 11:59 -------- d-----w- c:\program files\TP-LINK
2010-01-23 15:55 . 2004-12-19 20:05 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-23 15:42 . 2002-09-23 12:00 47994 ----a-w- c:\windows\system32\perfc005.dat
2010-01-23 15:42 . 2002-09-23 12:00 313410 ----a-w- c:\windows\system32\perfh005.dat
2006-10-14 16:09 . 2006-10-14 16:09 60526 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2006-10-14 16:09 . 2006-10-14 16:09 49256 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-14 16:09 . 2006-10-14 16:09 166000 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-17 1667584]
"MA Handset Manager"="c:\program files\Mobile Action\Sony Ericsson K700i USB-Handset Manager\PanelExe.exe" [2005-02-23 253952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 57344]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2005-12-10 7311360]
"nwiz"="nwiz.exe" [2005-12-10 1519616]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2005-12-10 86016]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-10-26 652624]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-09-14 1603152]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"TWCU"="c:\program files\TP-LINK\TP-LINK Wireless Client Utility\TWCU.exe" [2009-07-27 573544]
"jswtrayutil"="c:\program files\TP-LINK\QSS\jswtrayutil.exe" [2009-05-12 32865]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2004-12-19 106560]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6.2.2010 12:23 64288]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14.5.2009 15:47 731840]
R2 jswpbapi;JumpStart Push-Button Service;c:\program files\TP-LINK\QSS\jswpbapi.exe [23.1.2010 16:55 188416]
R3 jswpsapi;JumpStart Wi-Fi Protected Setup;c:\program files\TP-LINK\QSS\jswpsapi.exe [23.1.2010 16:55 360529]
R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [23.1.2010 16:55 57440]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [24.9.2009 12:17 1169232]
S3 AR9271;Wireless Network Adapter Service;c:\windows\system32\drivers\athuw.sys [23.1.2010 12:56 1668352]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
.
Obsah adresáře 'Naplánované úlohy'

2010-02-06 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 13:06]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.msn.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {2CB65864-F4D3-43FD-AF04-967089B7AA29} = 192.168.1.1
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Zárubová Marie\Data aplikací\Mozilla\Firefox\Profiles\wt7hsb8t.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - http://www.seznam.cz
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-Run-RegistryMechanic - (no file)
Notify-reset5 - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-06 16:03
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents]
@Denied: (Full) (LocalSystem)
"OOBETimer"=hex:7f,63,3e,be,ec,25,8e,19,be,a7,92,c6
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(508)
c:\windows\system32\athgina.dll
c:\windows\system32\antiwpa.dll
.
Celkový čas: 2010-02-06 16:07:02
ComboFix-quarantined-files.txt 2010-02-06 15:06

Před spuštěním: 787 636 224
Po spuštění: 856 055 808

- - End Of File - - 2295F911858EE61268A775411C6BF390

Několik položek bylo smazáno, zbytek logu vypadá čistý.