Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.511.78 [GMT 1:00]
Spuštěný z: c:\documents and settings\pbeck\Dokumenty\Stažené soubory\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100209-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\regedit.com
c:\windows\system32\taskmgr.com
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-10 do 2010-02-10 )))))))))))))))))))))))))))))))
.
2010-02-10 18:30 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-10 18:30 . 2010-02-10 18:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-10 18:30 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-06 06:48 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-02-05 19:57 . 2010-02-05 19:57 -------- d-sh--w- c:\documents and settings\pbeck\IECompatCache
2010-02-01 18:08 . 2010-02-01 18:08 -------- d-----w- c:\documents and settings\pbeck\kbpki
2010-02-01 17:14 . 2010-02-01 17:14 36864 ----a-w- c:\windows\system32\BGData.bin
2010-01-25 18:35 . 2005-10-03 11:04 3629056 ----a-w- c:\program files\Zps8.exe
2010-01-25 17:38 . 2001-07-25 14:36 2619 ----a-w- c:\windows\system32\drivers\sensupgd.sys
2010-01-25 17:38 . 2001-07-25 14:40 438200 ----a-w- c:\windows\system32\drivers\smwdm.sys
2010-01-25 17:38 . 2010-01-25 17:38 -------- d-----w- c:\program files\Analog Devices
2010-01-25 17:38 . 2001-05-31 18:29 36864 ----a-w- c:\windows\system32\Aud2Full.exe
2010-01-25 17:37 . 1998-10-29 14:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-01-25 17:36 . 2000-09-28 10:30 21786 ----a-w- c:\windows\system32\IPrtCnst.dll
2010-01-25 17:36 . 2000-09-28 10:30 12753 ----a-w- c:\windows\system32\drivers\IdeBusDr.sys
2010-01-25 17:36 . 2000-09-28 10:30 133290 ----a-w- c:\windows\system32\drivers\IntelAta.sys
2010-01-25 17:36 . 2010-01-25 17:36 -------- d-----w- c:\program files\Intel
2010-01-25 17:31 . 2010-01-25 17:31 -------- d-----w- c:\program files\Matrox Graphics Inc
2010-01-25 17:31 . 2010-01-25 17:31 -------- d-----w- c:\windows\system32\PDesk
2010-01-25 17:31 . 2007-04-04 08:48 87560 ----a-w- c:\windows\system32\mgabg.exe
2010-01-25 17:31 . 2007-04-03 16:10 139264 ----a-w- c:\windows\system32\MtxCIP.dll
2010-01-25 17:31 . 2007-04-13 10:21 350464 ----a-w- c:\windows\system32\drivers\g400dhm.sys
2010-01-25 17:31 . 2007-04-13 10:20 2399232 ----a-w- c:\windows\system32\g400dhd.dll
2010-01-25 17:31 . 2004-08-31 12:59 962560 ----a-w- c:\windows\system32\g400icd.dll
2010-01-25 17:31 . 2010-01-25 17:31 -------- d-----w- C:\mgafold
2010-01-24 05:59 . 2010-02-07 18:22 768 ----a-w- c:\windows\system32\d3d8caps.dat
2010-01-23 22:10 . 2010-01-23 22:10 -------- d---a-w- c:\windows\VDLL.DLL
2010-01-23 22:10 . 2010-01-23 22:10 -------- d---a-w- c:\windows\system32\runouce.exe
2010-01-23 22:10 . 2010-01-23 22:10 -------- d---a-w- c:\windows\rundll16.exe
2010-01-23 22:10 . 2010-01-23 22:10 -------- d---a-w- c:\windows\RUNDL132.EXE
2010-01-23 22:10 . 2010-01-23 22:10 -------- d---a-w- c:\windows\logo1_.exe
2010-01-23 22:10 . 2010-01-23 22:10 -------- d---a-w- c:\windows\logo_1.exe
2010-01-23 21:52 . 2010-01-23 21:52 632064 ----a-w- c:\windows\system32\msvcr80.dll
2010-01-23 21:52 . 2010-01-23 21:52 554240 ----a-w- c:\windows\system32\msvcp80.dll
2010-01-23 21:52 . 2010-01-23 21:52 34048 ----a-w- c:\windows\system32\eEmpty.exe
2010-01-23 21:52 . 2008-04-14 06:52 137216 ----a-w- c:\windows\system32\T.COM
2010-01-23 21:52 . 2008-04-14 06:52 147968 ----a-w- c:\windows\R.COM
2010-01-23 21:51 . 2010-01-23 21:51 -------- d-----w- c:\program files\Common Files\MicroWorld
2010-01-23 21:31 . 2010-01-23 21:31 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-01-23 21:01 . 2010-01-23 21:04 -------- dc-h--w- c:\windows\ie8
2010-01-23 19:04 . 2001-10-24 11:24 1733120 -c--a-w- c:\windows\system32\dllcache\g400d.dll
2010-01-23 19:04 . 2001-10-24 11:24 1733120 ----a-w- c:\windows\system32\G400d.dll
2010-01-23 19:04 . 2001-10-24 10:56 322432 -c--a-w- c:\windows\system32\dllcache\g400m.sys
2010-01-23 19:04 . 2001-10-24 10:56 322432 ----a-w- c:\windows\system32\drivers\G400m.sys
2010-01-13 18:21 . 2001-05-16 16:54 309616 ----a-w- c:\windows\system32\wmv8dmod.dll
2010-01-13 18:21 . 2001-05-11 12:18 420240 ----a-w- c:\windows\system32\mpg4c32.dll
2010-01-12 19:17 . 2008-04-13 23:21 101120 -c--a-w- c:\windows\system32\dllcache\bthpan.sys
2010-01-12 19:17 . 2008-04-13 23:21 101120 ----a-w- c:\windows\system32\drivers\bthpan.sys
2010-01-12 19:17 . 2008-04-13 23:16 59136 -c--a-w- c:\windows\system32\dllcache\rfcomm.sys
2010-01-12 19:17 . 2008-04-13 23:16 59136 ----a-w- c:\windows\system32\drivers\rfcomm.sys
2010-01-12 19:17 . 2008-04-13 23:16 17024 -c--a-w- c:\windows\system32\dllcache\bthenum.sys
2010-01-12 19:17 . 2008-04-13 23:16 17024 ----a-w- c:\windows\system32\drivers\BthEnum.sys
2010-01-12 19:17 . 2008-04-14 07:51 27648 -c--a-w- c:\windows\system32\dllcache\irmon.dll
2010-01-12 19:17 . 2008-04-14 07:51 27648 ----a-w- c:\windows\system32\irmon.dll
2010-01-12 19:17 . 2008-04-14 07:52 152064 -c--a-w- c:\windows\system32\dllcache\irftp.exe
2010-01-12 19:17 . 2008-04-14 07:52 152064 ----a-w- c:\windows\system32\irftp.exe
2010-01-12 19:17 . 2008-04-14 07:52 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll
2010-01-12 19:17 . 2008-04-14 07:52 8192 ----a-w- c:\windows\system32\wshirda.dll
2010-01-12 19:16 . 2008-04-13 23:16 18944 -c--a-w- c:\windows\system32\dllcache\bthusb.sys
2010-01-12 19:16 . 2008-04-13 23:16 18944 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-09 15:22 . 2009-11-07 20:58 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-02-06 07:00 . 2001-10-25 12:00 47206 ----a-w- c:\windows\system32\perfc005.dat
2010-02-06 07:00 . 2001-10-25 12:00 312970 ----a-w- c:\windows\system32\perfh005.dat
2010-01-30 20:01 . 2009-11-07 22:15 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-25 17:38 . 2009-11-07 22:27 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-16 07:52 . 2009-11-08 07:40 -------- d-----w- c:\program files\Ford Racing 3
2010-01-13 19:57 . 2009-11-07 22:25 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-13 16:28 . 2010-01-13 16:28 691696 ----a-w- c:\windows\system32\drivers\sptd.sys.35052697
2010-01-04 17:27 . 2010-01-04 17:27 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2010-01-04 17:26 . 2010-01-04 17:26 -------- d-----w- c:\program files\VSO
2009-12-21 19:08 . 2008-08-08 15:43 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-24 23:54 . 2009-11-24 20:21 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2009-11-24 20:23 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:50 . 2009-11-24 20:23 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2009-11-24 20:23 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2009-11-24 20:23 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2009-11-24 20:23 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-11-24 20:23 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-11-24 20:23 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2009-11-24 20:23 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-24 20:23 . 2009-11-24 20:23 1709 ----a-w- c:\program files\avast! Antivirus.lnk
2009-11-21 16:03 . 2008-04-14 06:51 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-19 18:46 . 2009-11-19 18:46 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-11-07 22:18 . 2009-11-07 22:18 548 ----a-w- c:\program files\Total Commander.lnk
2009-11-07 21:35 . 2009-11-07 21:35 8950 ----a-w- c:\program files\Oblíbený motiv.theme
2008-09-19 13:17 . 2008-09-19 13:17 42308904 ----a-w- c:\program files\NeroExpress.exe
2006-06-05 12:07 . 2009-11-08 07:06 1445888 ----a-w- c:\program files\WinsockxpFix.exe
2009-12-06 12:59 . 2010-01-16 19:45 192512 ----a-w- c:\program files\mozilla firefox\components\mhxpcom.dll
2009-09-25 16:41 . 2009-09-25 16:41 1044480 -c--a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 -c--a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
------- Sigcheck -------
[-] 2008-08-08 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-01-07 429392]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
R0 IntelATA;DN Intel IDE/ESDI Hard Disk Controller;c:\windows\system32\drivers\IntelAta.sys [25.1.2010 18:36 133290]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [24.11.2009 21:23 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [24.11.2009 21:23 20560]
R2 Matrox Centering Service;Matrox Centering Service;c:\program files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe [4.4.2007 9:48 480776]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [10.2.2010 19:30 38224]
S0 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
--- Ostatní služby/ovladače v paměti ---
*NewlyCreated* - MBAMSWISSARMY
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\pbeck\Data aplikací\Mozilla\Firefox\Profiles\xeosfrny.default\
FF - prefs.js: browser.search.selectedEngine - Hledat
FF - prefs.js: browser.startup.homepage - hxxp://www.daemon-search.com/startpage
FF - prefs.js: keyword.URL - hxxp://search.myheritage.com/?orig=ds&q=
FF - component: c:\program files\Mozilla Firefox\components\mhxpcom.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-10 19:50
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-73586283-688789844-1708537768-1003\Software\SecuROM\License information*]
"datasecu"=hex:53,fd,e8,9d,ed,88,b3,c6,97,db,22,e9,f9,8b,24,51,31,e8,53,25,9b,
f4,bc,8a,53,7a,b9,c4,0a,ca,b3,02,28,20,cd,b5,0c,fa,1a,0b,78,b5,04,c0,44,65,\
"rkeysecu"=hex:d4,15,21,80,09,f2,5f,8b,dd,d6,cd,37,3b,d9,b2,fe
.
Celkový čas: 2010-02-10 19:56:30
ComboFix-quarantined-files.txt 2010-02-10 18:56
Před spuštěním: Volných bajtů: 19 169 849 344
Po spuštění: Volných bajtů: 19 140 059 136
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - 5FF54903F23A56564CB6EF6CEF5D7A59
děkuji pavlos
Přispějete na provoz fóra?