Vypadá to, že by to mohl jít !!!!
ComboFix 09-10-08.04 - Jirka 10.10.2009 19:30.3.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.652 [GMT 2:00]
Spuštěný z: c:\documents and settings\Jirka\Dokumenty\Stažené věci\ComboFix.exe
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
FW: Outpost Firewall Pro *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\USS
c:\program files\USS\Schedule.dat
c:\program files\USS\unins000.dat
c:\program files\USS\unins000.exe
c:\program files\USS\USS.exe
c:\windows\Installer\17bad4.msp
c:\windows\Installer\1c83c.msp
c:\windows\Installer\250386.msp
c:\windows\Installer\578e10.msp
c:\windows\Installer\84407.msp
c:\windows\Installer\a55958.msp
c:\windows\Installer\a5595b.msp
Nakažená kopie c:\windows\system32\drivers\atapi.sys byla nalezena a vyléčena.
Kitty ate it :)
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_OREANS32
-------\Service_oreans32
((((((((((((((((((((((((( Soubory vytvořené od 2009-09-10 do 2009-10-10 )))))))))))))))))))))))))))))))
.
2009-10-10 14:36 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-10 14:36 . 2009-10-10 14:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-10 14:36 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-10 13:57 . 2009-10-10 13:57 -------- d-----w- c:\windows\system32\wbem\Repository
2009-10-10 12:29 . 2009-10-10 13:56 -------- d-----w- c:\documents and settings\Administrator\Data aplikací
2009-10-10 12:29 . 2009-10-10 13:56 -------- d-----w- c:\documents and settings\Administrator\Oblíbené položky
2009-10-10 12:29 . 2009-10-10 13:56 -------- d-----w- c:\documents and settings\Administrator\Šablony
2009-10-10 12:29 . 2009-10-10 13:56 -------- d-s---w- c:\documents and settings\Administrator
2009-10-04 15:36 . 2009-10-04 15:36 756736 ------w- c:\windows\system32\ir41_32.dll
2009-10-03 11:58 . 2009-10-01 08:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-10-02 09:35 . 2009-10-02 09:35 -------- d-----w- c:\program files\VirtualDJ
2009-09-26 07:51 . 2009-09-26 07:51 -------- d-----w- c:\program files\zlatykalich
2009-09-13 07:34 . 2009-10-10 13:56 -------- d-----w- c:\program files\Game Booster
2009-09-10 18:43 . 2009-09-23 15:52 -------- d-----w- c:\program files\rajce
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-10 17:29 . 2006-10-08 16:38 12317 ----a-w- c:\windows\system32\Tablet.dat
2009-10-10 17:21 . 2008-04-07 17:06 -------- d-----w- c:\program files\Mozilla Firefox 3 Beta 4
2009-10-10 17:19 . 2007-04-09 20:18 -------- d-----w- c:\program files\Avast4
2009-10-10 14:30 . 2006-06-20 20:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-10 14:26 . 2009-05-23 15:50 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2009-10-10 13:56 . 2006-10-21 15:51 -------- d--h--w- c:\program files\Zenographics
2009-10-07 14:59 . 2006-11-12 15:48 -------- d-----w- c:\program files\Microsoft Games
2009-10-06 14:08 . 2006-10-21 09:31 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-10-04 15:36 . 1997-06-13 05:56 56832 ------w- c:\windows\system32\Iyvu9_32.dll
2009-09-26 07:39 . 2009-04-26 13:32 -------- d-----w- c:\program files\Skipper1
2009-09-12 17:57 . 2009-09-07 12:26 -------- d-----w- c:\program files\Microsoft Flight Simulator X
2009-09-05 12:25 . 2008-01-24 20:07 -------- d-----w- c:\program files\ShipSim2008
2009-08-27 16:53 . 2009-08-27 16:49 -------- d-----w- c:\program files\Euro Truck SimulatorG
2009-08-27 16:48 . 2009-08-27 16:39 -------- d-----w- c:\program files\Euro Truck SimulatorGOLD
2009-08-26 16:41 . 2008-10-22 16:52 -------- d-----w- c:\program files\Euro Truck Simulator
2009-08-22 18:22 . 2006-06-20 20:25 84578 ----a-w- c:\windows\system32\perfc005.dat
2009-08-22 18:22 . 2006-06-20 20:25 442406 ----a-w- c:\windows\system32\perfh005.dat
2009-08-05 09:01 . 2006-06-20 20:24 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-26 16:16 . 2009-10-05 16:12 4988972 ----a-w- c:\program files\crew3_climbingdevice.wav
2009-07-25 16:19 . 2009-10-05 16:12 3006508 ----a-w- c:\program files\crew8_aftland.wav
2009-07-25 14:09 . 2009-10-05 16:12 2695212 ----a-w- c:\program files\crew_fastenseatbelt.wav
2009-07-25 14:09 . 2009-10-05 16:12 2695212 ----a-w- c:\program files\crew7_beforeland.wav
2009-07-25 14:06 . 2009-10-05 16:12 1564716 ----a-w- c:\program files\crew1_welcomeonboard.wav
2009-07-24 18:05 . 2009-10-05 16:12 22667308 ----a-w- c:\program files\crew2_safetyaboard.wav
2009-07-17 19:04 . 2006-06-20 20:24 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2006-06-20 20:25 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2004-08-23 22:38 . 2004-08-23 22:38 3371 ----a-w- c:\program files\!!!readme.txt
2004-08-23 20:08 . 2004-08-23 20:08 83968 ----a-w- c:\program files\NB_NB_2_12_37.xls
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-01-19 221184]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-03-14 16010752]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2006-10-26 434528]
c:\documents and settings\Lenka\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-10-9 110592]
c:\documents and settings\Tom\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-10-9 110592]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-10-9 110592]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0smrgdf c:\program files\iolo\System Mechanic Professional 6\\0lsdelete
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Azureus.lnk]
backup=c:\windows\pss\Azureus.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^ICQ 5.1.lnk]
backup=c:\windows\pss\ICQ 5.1.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDElbyCDFL
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneDVDElbyDelay
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCLEUSBTip
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\Msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\Tom\\Dokumenty\\Hry\\Blobby Volley\\volley.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\CyberLink\\PCM4Everio\\PCM4Everio.exe"=
"c:\\Program Files\\CyberLink\\PCM4Everio\\EverioService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"c:\\Program Files\\TrackMania Sunrise\\TmSunrise.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5.7.2006 14:46 63352]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
S2 gupdate1c9878cdf02b4bc;Google Update Service (gupdate1c9878cdf02b4bc);c:\program files\Google\Update\GoogleUpdate.exe [5.2.2009 14:25 133104]
S3 MODRC;DiBcom Infrared Receiver;c:\windows\system32\drivers\modrc.sys [4.12.2007 20:18 13056]
S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [20.6.2006 22:27 215040]
.
Obsah adresáře 'Naplánované úlohy'
2009-10-10 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-07-15 12:17]
2009-10-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-05 12:25]
2009-10-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-05 12:25]
2009-10-10 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
2009-08-09 c:\windows\Tasks\SmartDefrag.job
- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2008-08-24 17:15]
.
.
------- Doplňkový sken -------
.
uSearchMigratedDefaultURL =
hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page =
hxxp://www.aktualne.czuInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) =
hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
FF - ProfilePath - c:\documents and settings\Jirka\Data aplikací\Mozilla\Firefox\Profiles\87jlfwtn.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage -
hxxp://www.atlas.cz/FF - prefs.js: keyword.URL -
hxxp://search.icq.com/search/afe_result ... id=afex&q=FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 4\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox 3 Beta 4\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
.
------- Asociace souborů -------
.
JSEFile=NOTEPAD.EXE %1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
HKU-Default-Run-PcSync - c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe
AddRemove-Adobe Photoshop 5.0 - c:\documents and settings\lenka\dokumenty\hudba\DeIsL1.isu
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-10-10 19:40
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(564)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(1964)
c:\windows\system32\tabhook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
c:\program files\Common Files\InterVideo\DeviceService\DevSvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\Tablet.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-10-10 19:46 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-10-10 17:46
ComboFix2.txt 2008-07-06 19:56
ComboFix3.txt 2008-07-06 18:30
Před spuštěním: Volných bajtů: 76 573 605 888
Po spuštění: Volných bajtů: 76 591 345 664
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
238 --- E O F --- 2009-10-09 11:40
