Zde je log z Combofixu
ComboFix 10-01-26.02 - ufak 26.01.2010 22:35:03.8.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1527 [GMT 1:00]
Spuštěný z: c:\documents and settings\.....\Plocha\Baby.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-1410589228-3187114857-2256998706-1001
c:\documents and settings\All Users\Data aplikací\mazuki.dll
c:\program files\ICQ6.5\ICQLRun.exe
c:\recycler\S-1-5-21-1343024091-1275210071-1417001333-1003
c:\windows\regedit.com
c:\windows\system32\SHELLLNK.TLB
c:\windows\system32\taskmgr.com
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_DUMETERSVC
-------\Service_DUMeterSvc
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-26 do 2010-01-26 )))))))))))))))))))))))))))))))
.
2010-01-26 20:38 . 2010-01-26 20:38 -------- d-----w- c:\program files\LameACM
2010-01-26 20:36 . 2010-01-26 20:38 -------- d-----w- c:\program files\SWiSH Max3
2010-01-24 19:01 . 2010-01-24 19:01 -------- d-----w- c:\program files\Selteco
2010-01-24 16:59 . 2010-01-24 16:59 -------- d-----w- c:\program files\TopCD
2010-01-24 16:21 . 2010-01-24 16:21 -------- d-----w- c:\windows\system32\QuickTime
2010-01-24 16:21 . 2010-01-24 16:23 -------- d-----w- c:\program files\Macromedia
2010-01-24 16:21 . 2010-01-24 16:21 -------- d-----w- c:\program files\Common Files\Macromedia
2010-01-24 15:51 . 2010-01-24 15:51 -------- d-----w- C:\TEMP
2010-01-23 12:19 . 2010-01-24 14:37 -------- d-----w- C:\Download
2010-01-23 12:18 . 2010-01-23 12:51 -------- d-----w- C:\tmpDownload
2010-01-23 12:16 . 2010-01-23 12:24 -------- d-----w- C:\YouTubeGet
2010-01-23 12:08 . 2010-01-23 12:08 -------- d-----w- c:\program files\Elektromer_Pro_2008
2010-01-23 11:48 . 2010-01-23 12:04 -------- d-----w- c:\program files\Smart Security
2010-01-21 18:50 . 2010-01-21 18:48 59240 ----a-w- c:\windows\system32\GenSvcInst.exe
2010-01-21 18:50 . 2010-01-21 18:48 38944 ----a-w- c:\windows\system32\drivers\CDRBSDRV.SYS
2010-01-21 18:50 . 2010-01-21 18:48 139264 ----a-w- c:\windows\system32\bgsvcgen.exe
2010-01-21 18:49 . 2010-01-21 18:49 -------- d-----w- c:\program files\Pegasys Inc
2010-01-21 18:33 . 2010-01-21 18:33 -------- d-----w- c:\program files\VirtualDub-1.9.8
2010-01-21 18:08 . 2010-01-21 18:08 -------- d-----w- c:\program files\Real Alternative
2010-01-21 18:08 . 2007-04-24 16:30 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2010-01-21 17:54 . 2010-01-21 18:29 -------- d-----w- c:\program files\The FilmMachine
2010-01-21 16:31 . 2010-01-21 16:31 -------- d-----w- c:\program files\Your Uninstaller 2010
2010-01-19 22:00 . 2010-01-19 22:00 -------- d-----w- c:\program files\Redsystem
2010-01-19 17:58 . 2010-01-19 17:58 -------- d-----w- c:\program files\Common Files\ATI Technologies
2010-01-19 17:57 . 2009-08-19 07:05 100368 ----a-w- c:\windows\system32\drivers\AtiHdmi.sys
2010-01-19 17:55 . 2009-09-14 20:25 64512 ----a-w- c:\windows\system32\atimpc32.dll
2010-01-19 17:55 . 2009-09-14 20:21 45056 ----a-w- c:\windows\system32\aticalrt.dll
2010-01-19 17:55 . 2009-09-14 20:19 3489792 ----a-w- c:\windows\system32\aticaldd.dll
2010-01-19 17:55 . 2009-05-11 16:35 118784 ----a-w- c:\windows\system32\atibtmon.exe
2010-01-19 17:55 . 2009-09-14 20:47 12644352 ----a-w- c:\windows\system32\atioglxx.dll
2010-01-19 17:55 . 2009-09-14 20:20 45056 ----a-w- c:\windows\system32\aticalcl.dll
2010-01-19 17:54 . 2010-01-19 17:54 -------- d-----w- c:\program files\ATI
2010-01-17 10:41 . 2001-11-20 17:09 278528 ----a-w- c:\windows\system32\mejlovani.dll
2010-01-17 10:41 . 2010-01-17 10:41 -------- d-----w- c:\program files\2HCS
2010-01-15 17:12 . 2009-09-02 20:58 626688 ----a-w- c:\windows\system32\vp7vfw.dll
2010-01-15 17:12 . 2009-09-02 20:58 65602 ----a-w- c:\windows\system32\cook3260.dll
2010-01-15 17:12 . 2009-09-02 20:58 217127 ----a-w- c:\windows\system32\drv43260.dll
2010-01-15 17:12 . 2009-09-02 20:58 208935 ----a-w- c:\windows\system32\drv33260.dll
2010-01-15 17:12 . 2009-09-02 20:58 176165 ----a-w- c:\windows\system32\drv23260.dll
2010-01-15 17:12 . 2009-09-02 20:58 102439 ----a-w- c:\windows\system32\sipr3260.dll
2010-01-15 17:12 . 2009-09-02 20:57 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
2010-01-15 14:34 . 2010-01-21 22:40 -------- d-----w- C:\Premier
2010-01-14 20:39 . 2010-01-14 20:39 -------- d-----w- C:\Binjet
2010-01-14 20:30 . 2010-01-25 19:01 -------- d-----w- c:\program files\GrabIt
2010-01-14 20:17 . 2010-01-14 20:17 -------- d-----w- c:\program files\UseNeXT
2010-01-11 21:24 . 2010-01-11 21:24 -------- d-----w- c:\program files\3D Flash Animator 4.9.8.7
2010-01-02 23:14 . 2008-05-02 13:30 465920 -c----w- c:\windows\system32\dllcache\imapi2fs.dll
2010-01-02 23:14 . 2008-05-02 13:30 465920 ------w- c:\windows\system32\imapi2fs.dll
2010-01-02 23:14 . 2008-05-02 13:30 317440 -c----w- c:\windows\system32\dllcache\imapi2.dll
2010-01-02 23:14 . 2008-05-02 13:30 317440 ------w- c:\windows\system32\imapi2.dll
2010-01-02 12:21 . 2009-09-28 19:57 7168 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2009-12-30 17:13 . 2009-12-30 17:13 -------- d-----w- c:\windows\EzWinFlash.tmp
2009-12-29 18:57 . 2009-12-29 18:58 -------- d-----w- c:\program files\CesarFTP
2009-12-28 00:44 . 2009-12-28 00:44 5888 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp CD Writer.dat
2009-12-27 22:29 . 2010-01-03 16:02 -------- d-----w- c:\program files\Trojan Remover
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-26 21:47 . 2009-05-23 08:45 15044792 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-01-26 21:47 . 2009-05-23 08:45 1292343328 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-01-26 21:45 . 2009-06-15 16:54 -------- d-----w- c:\program files\ICQ6.5
2010-01-26 19:11 . 2009-06-22 15:41 -------- d-----w- c:\program files\WebSite X5 v8 - Evolution
2010-01-25 18:16 . 2008-09-21 22:38 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-24 17:19 . 2009-09-13 18:12 -------- d-----w- c:\program files\CENIK_ELIMAT
2010-01-24 16:50 . 2009-11-22 00:28 -------- d-----w- c:\program files\Garden 2008
2010-01-24 15:54 . 2008-12-21 00:31 -------- d-----w- c:\program files\DVD-RB PRO
2010-01-24 14:26 . 2008-12-21 09:43 -------- d-----w- c:\program files\AVS4YOU
2010-01-21 22:22 . 2008-09-21 16:30 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-21 21:03 . 2009-10-25 22:57 -------- d-----w- c:\program files\SEO Studio
2010-01-21 21:02 . 2008-09-30 19:12 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-21 18:05 . 2008-12-21 00:30 -------- d-----w- c:\program files\AviSynth 2.5
2010-01-19 17:59 . 2009-11-24 22:32 -------- d-----w- c:\program files\ATI Technologies
2010-01-19 17:42 . 2008-04-14 06:51 6656 ----a-w- c:\windows\system32\lpcio.dll
2010-01-19 17:37 . 2008-10-08 19:40 -------- d-----w- c:\program files\test
2010-01-17 15:13 . 2008-09-21 20:51 -------- d-----w- c:\program files\Download Express
2010-01-17 11:47 . 2009-10-09 18:21 -------- d-----w- c:\program files\ProFact 3.0
2010-01-16 10:45 . 2008-10-29 19:47 -------- d-----w- c:\program files\Share Rapid Uploader
2010-01-15 17:12 . 2008-12-15 19:48 -------- d-----w- c:\program files\VSO
2010-01-12 19:54 . 2008-12-16 19:12 -------- d-----w- c:\program files\TeamViewer
2010-01-10 14:37 . 2009-09-13 23:02 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-08 07:13 . 2009-06-19 08:10 33096 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2010-01-07 15:07 . 2009-07-05 23:01 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-07-05 23:01 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-02 12:21 . 2009-09-21 15:28 -------- d-----w- c:\program files\CDBurnerXP
2009-12-30 22:49 . 2008-11-12 23:07 -------- d-----w- c:\program files\Everest
2009-12-28 22:48 . 2008-12-14 22:50 -------- d-----w- c:\program files\Rapid
2009-12-28 00:43 . 2008-12-20 22:57 11024 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp DSP Effects.dat
2009-12-28 00:43 . 2008-12-20 22:57 15607 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2009-12-27 19:28 . 2008-10-11 16:42 -------- d-----w- c:\program files\uTorrent
2009-12-27 19:04 . 2009-12-26 14:09 -------- d-----w- c:\program files\The KMPlayer
2009-12-27 16:23 . 2008-12-25 18:33 -------- d-----w- c:\program files\Activision
2009-12-27 13:28 . 2009-12-27 13:24 -------- d-----w- c:\program files\Kobra 11 Nitro
2009-12-26 13:32 . 2008-12-15 19:42 -------- d-----w- c:\program files\SlySoft
2009-12-26 13:31 . 2009-01-24 19:17 -------- d-----w- c:\program files\GRETECH
2009-12-22 21:18 . 2001-10-25 14:00 83674 ----a-w- c:\windows\system32\perfc005.dat
2009-12-22 21:18 . 2001-10-25 14:00 441140 ----a-w- c:\windows\system32\perfh005.dat
2009-12-22 21:03 . 2009-12-22 20:23 -------- d-----w- c:\program files\DVDFab 6
2009-12-22 20:38 . 2009-06-01 21:16 -------- d-----w- c:\program files\NOD32view
2009-12-21 20:27 . 2009-12-21 20:27 -------- d-----w- c:\program files\DVD2one V2
2009-12-21 19:08 . 2008-04-23 04:16 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-20 18:36 . 2009-12-20 18:29 -------- d-----w- c:\program files\USIM Editor
2009-12-20 18:36 . 2009-12-20 18:30 65536 ----a-w- c:\windows\system32\afasrv32.exe
2009-12-20 18:24 . 2009-12-20 18:23 -------- d-----w- c:\program files\MOBILedit!
2009-12-18 14:02 . 2009-09-11 06:26 135048 ----a-w- c:\windows\system32\drivers\epfw.sys
2009-12-15 19:22 . 2009-12-15 19:21 -------- d-----w- c:\program files\Microsoft IntelliPoint
2009-12-13 18:07 . 2008-11-08 18:04 -------- d-----w- c:\program files\JRF
2009-12-06 10:55 . 2008-12-25 09:53 139280 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-12-06 10:52 . 2008-12-25 09:52 202000 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-11-28 09:42 . 2009-11-27 21:36 -------- d-----w- c:\program files\Electronic Arts
2009-11-27 21:16 . 2009-11-27 21:16 94208 ----a-w- c:\windows\system32\drivers\ezplay.sys
2009-11-24 21:54 . 2008-09-23 20:57 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-11-23 19:21 . 2009-11-23 19:21 89088 ----a-w- c:\program files\UnstopCpy_4_2_Win2K_UP.exe
2009-11-23 19:14 . 2009-11-23 19:14 65216 ----a-w- c:\program files\DiskImage_1_5_WinAll.exe
2009-11-23 19:13 . 2009-11-23 19:13 66240 ----a-w- c:\program files\RawCopy_1_2_WinAll.exe
2009-11-21 16:03 . 2008-04-14 06:51 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-16 08:06 . 2009-09-11 06:26 55768 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2009-11-16 08:03 . 2009-09-11 06:23 108792 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2009-11-16 07:56 . 2009-09-11 06:17 116520 ----a-w- c:\windows\system32\drivers\eamon.sys
2009-11-12 20:01 . 2009-11-12 20:01 262144 ----a-w- c:\windows\system32\default_user_class.dat
2009-09-13 16:34 . 2009-02-23 12:59 5 ----a-w- c:\program files\trl.trl
2002-07-31 17:55 . 2009-01-13 11:06 106 --sh--w- c:\windows\WSYS049.SYS
2008-12-23 13:01 . 2008-12-23 12:57 1160 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
Kód: Vybrat vše
<pre>
c:\program files\DiskInternals\PartitionRecovery\recovery .exe
</pre>[-] 2008-06-27 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2009-09-02 2647064]
"WEBTRAN"="" [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-09-09 16851968]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-11-08 188416]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-01-30 91432]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2008-11-03 2540800]
"BtTray"="c:\program files\IVT Corporation\BlueSoleil\BtTray.exe" [2009-02-27 278016]
"WinVNC"="c:\program files\TightVNC\WinVNC.exe" [2009-03-05 585728]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [N/A]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-11-06 570664]
"RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe" [2009-08-22 2781184]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-14 98304]
"egui"="c:\program files\Smart Security\egui.exe" [2009-11-16 2054360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"RestrictRun"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Action Manager 32.lnk]
backup=c:\windows\pss\Action Manager 32.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^PHOTOfunSTUDIO.lnk]
backup=c:\windows\pss\PHOTOfunSTUDIO.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2009-04-29 14:38 188728 ----a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
[N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EazyScheduler]
c:\program files\Eazy-Ware\ezSched.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-06-25 09:24 49152 ----a-w- c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-12-12 06:31 1840424 ----a-w- c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
2009-05-26 19:16 1468296 ----a-w- c:\program files\Microsoft IntelliPoint\ipoint.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-11-06 06:25 570664 ----a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PopRock]
c:\docume~1\UFK~1\LOCALS~1\Temp\c.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USBestCR]
2009-12-20 18:36 4792320 ----a-w- c:\program files\USIM Editor\iconcs9048828.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpeedItUpEX"=c:\program files\Speeditup Free\SpeedItUp.exe -MINI
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe"
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Documents and Settings\\ufák\\Plocha\\Internet\\netinstall.exe"=
"c:\\Documents and Settings\\ufák\\Plocha\\Internet\\Mikrotik\\netinstall.exe"=
"c:\\Program Files\\Sun\\xVM VirtualBox\\VirtualBox.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Czech\\setup.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MP.exe"=
"c:\\Program Files\\Activision\\Wolfenstein\\MP\\Wolf2MPLite.exe"=
"c:\\Program Files\\uTorrent\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [7.1.2009 22:39 20744]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23.9.2008 21:57 691696]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [21.9.2008 17:30 21656]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11.9.2009 7:23 108792]
R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [23.12.2008 13:31 181120]
R1 FSLX;FSLX;c:\windows\system32\drivers\fslx.sys [1.2.2008 15:50 191616]
R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [23.12.2008 13:31 51072]
R1 is-J0FGEdrv;is-J0FGEdrv;c:\windows\system32\drivers\20127665.sys [7.3.2009 14:00 148496]
R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [29.10.2008 23:49 100560]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [29.10.2008 23:49 41744]
R2 AfaService;Afa Card Reader Service;c:\windows\system32\afasrv32.exe [20.12.2009 19:30 65536]
R2 BsMobileCS;BsMobileCS;c:\program files\IVT Corporation\BlueSoleil\BsMobileCS.exe [27.2.2009 15:40 143467]
R2 ekrn;ESET Service;c:\program files\Smart Security\ekrn.exe [16.11.2009 9:04 735960]
R2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;c:\program files\Nitro PDF\Professional\NitroPDFDriverService.exe [23.6.2009 10:55 188736]
R2 SCPDFReadSpool;SolidConverterPDFReadSpool;c:\windows\Installer\MSI15E3.tmp [25.11.2009 0:13 189760]
R2 WMDrive;WMDrive;c:\windows\system32\drivers\WMDrive.sys [29.10.2008 22:01 102784]
R3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [7.12.2008 11:44 30088]
R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [2.7.2008 13:58 26248]
R3 mpfilt;mpfilt;c:\windows\system32\drivers\mpfilt.sys [26.1.2009 18:13 10588]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\drivers\VBoxNetFlt.sys [20.2.2009 22:20 87568]
R3 vdiskbus;Virtual Disk Bus;c:\windows\system32\drivers\VDiskBus.sys [10.3.2009 21:34 35107]
S1 hwinterface;hwinterface;c:\windows\system32\Drivers\hwinterface.sys --> c:\windows\system32\Drivers\hwinterface.sys [?]
S2 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys --> c:\program files\Anti Trojan Elite\ATEPMon.sys [?]
S3 CMC AntiRootkit Service;CMC AntiRootkit Servic;c:\windows\system32\drivers\cmcantirootkit.sys --> c:\windows\system32\drivers\cmcantirootkit.sys [?]
S3 drhard;DRHARD;c:\windows\system32\drivers\drhard.sys [1.3.2009 12:51 23600]
S3 esihdrv;esihdrv;\??\c:\docume~1\UFK~1\LOCALS~1\Temp\esihdrv.sys --> c:\docume~1\UFK~1\LOCALS~1\Temp\esihdrv.sys [?]
S3 FLASHSYS;FLASHSYS;c:\program files\MSI\Live Update 4\LU4\FlashSys.sys [24.11.2009 23:21 9216]
S3 kqemu;KQEMU virtualisation module for QEMU;c:\windows\system32\drivers\kqemu.sys [4.2.2009 0:33 123939]
S3 LGDDCDevice;LGDDCDevice;c:\program files\LG Soft India\forteManager\bin\I2CDriver.sys [24.9.2008 19:31 14336]
S3 LGII2CDevice;LGII2CDevice;c:\program files\LG Soft India\forteManager\bin\PII2CDriver.sys [24.9.2008 19:31 13312]
S3 MaplomL;MaplomL; [x]
S3 MHIKEY10;MHIKEY10;c:\windows\system32\drivers\MHIKEY10.sys [20.12.2009 19:29 51072]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [4.7.2009 20:18 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [4.7.2009 20:18 8320]
S3 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6.7.2009 7:47 34064]
S3 PAC207;Webcam 1200;c:\windows\system32\DRIVERS\PFC027.SYS --> c:\windows\system32\DRIVERS\PFC027.SYS [?]
S3 rkhdrv40;Rootkit Unhooker Driver; [x]
S3 Secdfu;USB DFU Device;c:\windows\system32\drivers\Secdfu.sys [23.11.2009 18:40 14875]
S3 SureThing Labelflash service;SureThing Labelflash service;c:\program files\Common Files\SureThing Shared\stllssvr.exe [6.1.2009 19:11 74392]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers\teamviewervpn.sys [25.1.2008 10:12 25088]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys --> c:\windows\system32\drivers\TfNetMon.sys [?]
S3 TrojanFindDriverNT;TrojanFindDriverNT;\??\c:\windows\system32\NtDriver.sys --> c:\windows\system32\NtDriver.sys [?]
S3 VBoxUSB;VirtualBox USB;c:\windows\system32\drivers\VBoxUSB.sys [28.1.2009 17:46 31824]
S3 VirtualDK;VirtualDK;c:\documents and settings\ufák\Plocha\Internet\Boot\vdk.sys [7.2.2009 21:31 16283]
--- Ostatní služby/ovladače v paměti ---
*Deregistered* - uphcleanhlp
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-10-16 11:49 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'
2010-01-26 c:\windows\Tasks\User_Feed_Synchronization-{3601F6AF-6E67-4F2D-86EB-2C120665DD72}.job
- c:\windows\system32\msfeedssync.exe [2008-06-27 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
mWindow Title = Microsoft Internet Explorer
uInternet Settings,ProxyServer = 59.7.91.227:8080
IE: &Download All with FlashGet -
IE: &Download with FlashGet -
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send by Bluetooth - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
IE: Send via &Message... - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
IE: Stáhnout Free Download Managerem - file://c:\program files\Free Download Manager\dllink.htm
IE: Stáhnout pomocí Download &Express - c:\program files\Download Express\Add_Url.htm
IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} - c:\program files\Download Master\dmaster.exe
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
Trusted Zone: vzp.cz\portal
Name-Space Handler: ftp\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - c:\progra~1\DOWNLO~1\mdpph.dll
Name-Space Handler: http\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - c:\progra~1\DOWNLO~1\mdpph.dll
Name-Space Handler: https\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - c:\progra~1\DOWNLO~1\mdpph.dll
FF - ProfilePath - c:\documents and settings\ufák\Data aplikací\Mozilla\Firefox\Profiles\mi8kw3yh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.play.cz/listen/listen.php?sh=rockzone&bitrate=128
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npfiller.dll
FF - plugin: c:\program files\Opera\program\plugins\np_gp.dll
FF - plugin: c:\program files\Opera\program\plugins\npfdm.dll
FF - plugin: c:\program files\Opera\program\plugins\npmmaud.dll
FF - plugin: c:\program files\Opera\program\plugins\npmmprog.dll
FF - plugin: c:\program files\Opera\program\plugins\npmmvid.dll
FF - plugin: c:\program files\Opera\program\plugins\npmmzip.dll
FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
AddRemove-PC Translator - c:\docume~1\UFK~1\LOCALS~1\Temp\UN32.EXE
AddRemove-PDF Editor 2 - c:\windows\cadkasdeinst01e.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-26 22:49
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys atapi.sys spch.sys >>UNKNOWN [0x8A58F938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf74a3cb8
\Driver\atapi -> sfsync02.sys @ 0xf771fd60
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: VIA Rhine II Fast Ethernet Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf7b3abb0
PacketIndicateHandler -> NDIS.sys @ 0xf7b29a0d
SendHandler -> NDIS.sys @ 0xf7b3db40
user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SCPDFReadSpool]
"ImagePath"="c:\windows\Installer\MSI15E3.tmp"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-1123561945-448539723-1801674531-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-1123561945-448539723-1801674531-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{48B31F3E-F03F-2852-D224-2FEA138E8944}*]
"jagmdkbpfmopcddhkdon"=hex:70,61,70,6a,62,66,63,66,6d,69,64,62,69,6f,6c,6d,6c,
61,68,70,6b,6e,6a,6d,63,61,6c,65,67,67,68,6c,00,ab
"hahmmjgajpmcknoe"=hex:70,61,6e,6a,6d,6f,70,6d,6b,61,6d,6c,66,62,6f,69,66,69,
63,69,61,6a,62,6b,64,63,65,66,61,64,62,62,00,ab
[HKEY_USERS\S-1-5-21-1123561945-448539723-1801674531-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5E7509AE-52A8-DD15-17B7-AA90564AEBD7}*]
"haiiolobpiaekcme"=hex:70,61,67,6a,6f,65,6a,65,68,67,70,67,69,6c,69,6f,69,6c,
6a,6b,67,6a,6d,68,61,61,63,6f,6f,67,63,66,00,ab
"jajiplhnioahmghklfjj"=hex:70,61,61,69,68,69,6c,6b,6b,64,69,6a,65,68,6d,70,63,
68,6d,64,66,70,6c,6e,6a,6a,64,6d,6f,6e,6a,63,00,ab
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="D87C8107498BDCC1E6952E414EEA44980802D1952070286ED5B5C94100D9B59BAC6BEC2517529A878B8B5DD1CDC11DD980DC6BDFCCEA4CFAA88D069281D1B2E3BB0541D83101283E3008E60D238F27D761AE9416527FBADF57A7F84A3CE875F88FFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC7933C038D530D6EB3452BA7FD869164D67943F4037E838E7DB91393729E2448056742BC43903C2AC1EF221D84209D74562B9C2E8B458585B42889518F6B677B0D47C94022229C8C40CEF128607D404EAE86A6C338BF8A57B769B15ADCE7260061D6DE03DA256CE254520B059D7958ACEC1FAE24F4E3582C89709996FE711A81A87E64FD639366F1F73A4393B1449949A0F2F7ECFE2FBC1E5DA543B3B4D9173AAFA4E539432F8382A55E01D7872F1BD9D810CCDAC0340AC9C08C54251DDF85596F5CB1520B4542B5FBC010046F912134C615C10423C78FDD77A67AE544CCE5663894A6F07B57F3E7C8FEF3A3A08B7983B88AEBCCD6F9EE5272408324E1E1E75BA5A7B71B802385CE3C9DF594ECD6D44A569D37EF3D4B188BF89BB34ABAFF62269A252600DB8BF629AF7451CE0CE46036C84E1AF3DF3B5FEF841D8CEBBAF6CC1DF2F08313CCFD824CCBCD9F93466D6B21072B4E312AB2ED3CD777B50B4A0172EB3E01792E38CCC64454D1A986F3E392639DDE96145ACA9885EEE823CAC5912331C2EC161078B696077F6C7561C598C253107621F087E340F6F7A90C72283FC92789E8BB2083D7E45F995E7C2290CF06AE83F46CC71F8605169018DDD74A0FB81C6D13BCCB165E0B3059B44226A7E8BA4F1707ECAFE4B462BD580A31D6880B5282FF6DE2C311AE843F790686E132D8777829339AF8EF680EA6709C258A44BD62478D3C48099C974FDD30EA6D23FE991797739E744E3512C566F3E9E16B87A0E0790C203ACDD3262603F4294306ED9DBB54E04420626056D26E759AC1113DF10D48730EF4859E7975E83EE0A9B01749AAA2A2BC127E08EE983EBA5A837081B9386929C299F47527D5D0EEA25DC3F868ACC527B248B0440CC113B04922BD125D4898A1F8E31CB2D813672A047F0D2326502B1D16CCEE1C044613AE82D438AC614BF6CDF43B0E9099238E58E9388486A702656A3DFBD330904FDEE5C7F8A33A093FCD81CB0078CC8262541C6760815796F86F3F689D913E6426108FAD4BF30A41C8B152402CD80A4B433836E1A070E7BAB68626637D77F7B39FBD373BB55CB1978260B60A65577A83B0C4E42F1D3EDE173821A24FAA15EBDA7B1C78B08EFAF9AF880C5C6D5218634B9CD670E316CD271997EBCEFA9D5F3F7505B799B51ECED9570BE76678569277AB60AB83552883F4171FB8AA360C46E45F944268FF1D9F94DB7F7F361"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\ACPI\PNP0F03\4&1d8e1589&0\LogConf]
@DACL=(02 0000)
"BasicConfigVector"=hex(a):48,00,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,01,00,01,00,01,00,00,00,00,02,\
"BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,01,00,00,
00,02,01,01,00,0c,00,00,00,0c,00,00,00,ff,ff,ff,ff
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(1512)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(2920)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\BsMobileSDK.dll
c:\windows\system32\BsLangInDepRes.dll
c:\windows\system32\Bs2Res.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\program files\WinSCP\DragExt.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\windows\system32\ASTSRV.EXE
c:\windows\system32\bgsvcgen.exe
c:\program files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\oodag.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\UPHClean\uphclean.exe
c:\program files\IVT Corporation\BlueSoleil\BsHelpCS.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Celkový čas: 2010-01-26 23:00:07 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-26 22:00
Před spuštěním: 1 209 303 040
Po spuštění: 1 465 786 368
- - End Of File - - 14DB8116CA7FBD109332B5AE3019EE9B
Předem děkuji za pomoc
Přispějete na provoz fóra?