ComboFix log
ComboFix 11-01-22.03 - Administrator 23.01.2011 22:36:00.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3071.2345 [GMT 1:00]
Spuštěný z: e:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: e:\documents and settings\Administrator\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
FILE ::
"e:\docume~1\ADMINI~1\LOCALS~1\Temp\pnicml.sys"
"e:\windows\system32\drivers\sptd.sys"
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
e:\windows\system32\drivers\sptd.sys
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_PNICML
-------\Legacy_SPTD
-------\Service_pnicml
-------\Service_sptd
((((((((((((((((((((((((( Soubory vytvořené od 2010-12-23 do 2011-01-23 )))))))))))))))))))))))))))))))
.
2011-01-23 09:54 . 2011-01-23 09:54 -------- d-----w- e:\documents and settings\Administrator\DoctorWeb
2011-01-22 11:08 . 2011-01-22 11:08 218688 ----a-w- e:\windows\system32\drivers\dtsoftbus01.sys
2011-01-22 11:08 . 2011-01-22 11:08 -------- d-----w- e:\program files\DAEMON Tools Lite
2011-01-20 17:36 . 2011-01-23 21:32 -------- d-----w- e:\windows\Internet Logs
2011-01-20 16:38 . 2011-01-20 18:30 -------- d-----w- e:\program files\CCleaner
2011-01-19 13:57 . 2011-01-20 22:09 -------- d-----w- e:\program files\trend micro
2011-01-17 17:23 . 2011-01-17 17:31 -------- d-----w- e:\documents and settings\Administrator\Data aplikací\BSplayer
2011-01-15 20:25 . 2009-06-07 15:16 819200 ----a-w- e:\windows\system32\xvidcore.dll
2011-01-15 20:24 . 2011-01-15 20:25 -------- d-----w- e:\program files\Xvid
2011-01-12 18:28 . 2010-11-04 00:03 178688 ----a-w- e:\windows\system32\ff_libmad.dll
2011-01-12 16:42 . 2011-01-16 17:46 -------- d-----w- e:\documents and settings\Administrator\Data aplikací\LEGO Company
2011-01-12 16:41 . 2011-01-20 18:36 -------- d-----w- e:\program files\Unity
2011-01-07 15:56 . 2011-01-07 15:56 -------- d-----w- e:\documents and settings\Administrator\Data aplikací\GRETECH
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-17 21:48 . 2010-07-17 19:55 445016 ----a-w- e:\windows\system32\wrap_oal.dll
2011-01-17 21:48 . 2010-07-17 19:55 109144 ----a-w- e:\windows\system32\OpenAL32.dll
2011-01-15 16:44 . 2010-02-25 08:50 22328 ----a-w- e:\windows\system32\drivers\PnkBstrK.sys
2011-01-15 16:44 . 2010-02-25 08:50 22328 ----a-w- e:\documents and settings\Administrator\Data aplikací\PnkBstrK.sys
2011-01-15 16:44 . 2010-02-25 08:49 107832 ----a-w- e:\windows\system32\PnkBstrB.exe
2011-01-15 16:43 . 2010-08-14 20:15 2337865 ----a-w- e:\windows\system32\pbsvc.exe
2011-01-15 16:43 . 2010-02-25 08:49 66872 ----a-w- e:\windows\system32\PnkBstrA.exe
2011-01-13 08:47 . 2010-06-29 13:04 38848 ----a-w- e:\windows\avastSS.scr
2011-01-13 08:47 . 2010-02-24 21:35 188216 ----a-w- e:\windows\system32\aswBoot.exe
2011-01-13 08:41 . 2010-02-24 21:35 294608 ----a-w- e:\windows\system32\drivers\aswSP.sys
2011-01-13 08:40 . 2010-02-24 21:35 47440 ----a-w- e:\windows\system32\drivers\aswTdi.sys
2011-01-13 08:40 . 2010-02-24 21:35 100176 ----a-w- e:\windows\system32\drivers\aswmon2.sys
2011-01-13 08:39 . 2010-02-24 21:35 94544 ----a-w- e:\windows\system32\drivers\aswmon.sys
2011-01-13 08:37 . 2010-02-24 21:35 23632 ----a-w- e:\windows\system32\drivers\aswRdr.sys
2011-01-13 08:37 . 2010-02-24 21:35 29392 ----a-w- e:\windows\system32\drivers\aavmker4.sys
2011-01-13 08:37 . 2010-02-24 21:35 17744 ----a-w- e:\windows\system32\drivers\aswFsBlk.sys
2011-01-07 16:33 . 2010-02-24 22:11 737280 ----a-w- e:\windows\iun6002.exe
2010-11-18 18:15 . 2010-02-24 18:26 81920 ----a-w- e:\windows\system32\isign32.dll
2010-11-09 14:52 . 2004-08-18 12:00 249856 ----a-w- e:\windows\system32\odbc32.dll
2010-11-06 00:23 . 2004-08-18 12:00 916480 ----a-w- e:\windows\system32\wininet.dll
2010-11-06 00:23 . 2004-08-18 12:00 43520 ----a-w- e:\windows\system32\licmgr10.dll
2010-11-06 00:23 . 2004-08-18 12:00 1469440 ------w- e:\windows\system32\inetcpl.cpl
2010-11-03 12:25 . 2004-08-18 12:00 385024 ----a-w- e:\windows\system32\html.iec
2010-11-02 15:17 . 2004-08-18 12:00 40960 ----a-w- e:\windows\system32\drivers\ndproxy.sys
2010-10-31 14:12 . 2010-10-10 11:32 43520 ----a-w- e:\windows\system32\CmdLineExt03.dll
2010-10-28 13:09 . 2004-08-18 12:00 290048 ----a-w- e:\windows\system32\atmfd.dll
2010-10-26 13:58 . 2004-08-18 12:00 1853312 ----a-w- e:\windows\system32\win32k.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "e:\program files\ZoneAlarm_Security\tbZone.dll" [2010-12-01 2735200]
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
2010-12-01 10:27 2735200 ----a-w- e:\program files\ZoneAlarm_Security\tbZone.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "e:\program files\ZoneAlarm_Security\tbZone.dll" [2010-12-01 2735200]
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{91DA5E8A-3318-4F8C-B67E-5964DE3AB546}"= "e:\program files\ZoneAlarm_Security\tbZone.dll" [2010-12-01 2735200]
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="f:\steam\steam.exe" [2010-11-17 1242448]
"Pando Media Booster"="e:\program files\Pando Networks\Media Booster\PMB.exe" [2010-10-09 2969496]
"DAEMON Tools Lite"="e:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"ctfmon.exe"="e:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-27 16208384]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"avast5"="e:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2011-01-13 3396624]
"WheelMouse"="e:\program files\A4Tech\Mouse\Amoumain.exe" [2006-12-26 196608]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"amd_dc_opt"="e:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"LogMeIn Hamachi Ui"="f:\stahování\Hamachi\hamachi-2-ui.exe" [2010-12-06 1910152]
"ZoneAlarm Client"="e:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-11-16 1043968]
"ISW"="e:\program files\CheckPoint\ZAForceField\ForceField.exe" [2010-11-05 738808]
e:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - e:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Logitech Desktop Messenger.lnk - e:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2010-2-25 67128]
Logitech SetPoint.lnk - e:\program files\Logitech\SetPoint\SetPoint.exe [2010-3-28 805392]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 00:42 72208 ----a-w- e:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\Program Files\\Opera\\opera.exe"=
"e:\\Program Files\\ICQ7.0\\ICQ.exe"=
"e:\\Program Files\\ICQ7.0\\aolload.exe"=
"e:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"e:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"e:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"e:\\WINDOWS\\system32\\PnkBstrA.exe"=
"e:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"f:\\Stahování\\Hamachi\\hamachi-2-ui.exe"=
"f:\\Steam\\steam.exe"=
"e:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"e:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"e:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"f:\\Hry\\World_of_Tanks_closed_Beta\\WorldOfTanks.exe"=
"f:\\Hry\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"f:\\Hry\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"f:\\Hry\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\RainbowSixVegas2_SADS.exe"=
"f:\\Steam\\SteamApps\\gamblercz\\counter-strike source\\hl2.exe"=
"e:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"1035:TCP"= 1035:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
"59129:TCP"= 59129:TCP:Pando Media Booster
"59129:UDP"= 59129:UDP:Pando Media Booster
R1 aswSP;aswSP;e:\windows\system32\drivers\aswSP.sys [24.2.2010 22:35 294608]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;e:\windows\system32\drivers\dtsoftbus01.sys [22.1.2011 12:08 218688]
R2 aswFsBlk;aswFsBlk;e:\windows\system32\drivers\aswFsBlk.sys [24.2.2010 22:35 17744]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;f:\stahování\Hamachi\hamachi-2.exe -s --> f:\stahování\Hamachi\hamachi-2.exe -s [?]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;e:\program files\CheckPoint\ZAForceField\ISWKL.sys [5.11.2010 12:41 26872]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;e:\program files\CheckPoint\ZAForceField\ISWSVC.exe [5.11.2010 12:41 488952]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;e:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S3 TVICHW32;TVICHW32;e:\windows\system32\drivers\TVICHW32.SYS [25.2.2010 10:00 23600]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;e:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - e:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2011-01-23 22:46
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-1614895754-1343024091-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ba,88,0c,48,5e,bf,21,4c,a6,ea,40,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8a,66,e0,c4,4d,65,43,4d,b3,57,7c,\
[HKEY_USERS\S-1-5-21-1614895754-1343024091-725345543-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:5f,a4,07,5f,48,a6,e6,d0,b9,c3,1d,19,0b,83,1c,37,fe,00,c7,59,a1,12,d4,
51,2a,90,d0,ea,02,87,20,3f,aa,10,1b,89,b5,51,51,73,64,db,7d,fd,51,fd,96,70,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50
[HKEY_USERS\S-1-5-21-1614895754-1343024091-725345543-500\Software\SecuROM\License information*]
"datasecu"=hex:e3,ae,5d,fc,e0,4a,3b,98,19,51,6e,04,2e,9d,0e,7d,d2,ef,ce,ab,62,
ef,8e,c1,00,bd,39,16,4b,d5,0d,9d,9d,b3,71,24,c5,6d,0c,08,03,74,53,c7,d0,f8,\
"rkeysecu"=hex:b7,c9,94,9f,e8,bf,54,b7,d7,8d,5b,95,a9,13,15,c0
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(1052)
e:\windows\system32\Ati2evxx.dll
e:\windows\system32\atiadlxx.dll
e:\program files\common files\logitech\bluetooth\LBTWlgn.dll
e:\program files\common files\logitech\bluetooth\LBTServ.dll
e:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
- - - - - - - > 'lsass.exe'(1108)
e:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
- - - - - - - > 'explorer.exe'(1088)
e:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
e:\program files\Logitech\SetPoint\lgscroll.dll
e:\windows\system32\msi.dll
e:\windows\system32\webcheck.dll
e:\windows\system32\WPDShServiceObj.dll
e:\windows\system32\PortableDeviceTypes.dll
e:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
e:\windows\system32\Ati2evxx.exe
e:\windows\system32\Ati2evxx.exe
e:\program files\Alwil Software\Avast5\AvastSvc.exe
e:\windows\RTHDCPL.EXE
e:\windows\system32\rundll32.exe
e:\program files\Bonjour\mDNSResponder.exe
f:\stahování\Hamachi\hamachi-2.exe
e:\program files\Java\jre6\bin\jqs.exe
e:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
e:\windows\system32\PnkBstrA.exe
e:\windows\system32\PnkBstrB.exe
e:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
e:\windows\system32\wbem\wmiapsrv.exe
e:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2011-01-23 22:49:23 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-23 21:49
Před spuštěním: Volných bajtů: 61 883 785 216
Po spuštění: Volných bajtů: 61 773 860 864
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
- - End Of File - - 6A303C06496D769EC8C51D9D92284C75
Přispějete na provoz fóra?