Provedeno dle rozkazu. Internet se umoudřil a jede jak má. Snad mu to i vydrží.
ComboFix 12-06-23.05 - Administrator 25.06.2012 16:42:23.7.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1279.815 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Free Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Vytvořen nový Bod Obnovení
.
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-05-25 do 2012-06-25 )))))))))))))))))))))))))))))))
.
.
2012-06-13 12:35 . 2012-05-11 14:44 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2012-06-01 09:49 . 2012-06-01 09:49 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\MOVAVI
2012-06-01 09:49 . 2012-06-01 09:50 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Movavi Video Editor 7 SE
2012-06-01 09:47 . 2012-06-01 09:48 -------- d-----w- c:\program files\Movavi Video Editor 7 SE
2012-05-30 12:30 . 2012-05-30 12:30 -------- d-----w- c:\program files\SoftOrbits Photo Retoucher
2012-05-29 10:11 . 2012-05-29 10:11 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\DFX
2012-05-29 10:11 . 2012-05-29 10:11 -------- d-----w- c:\documents and settings\SUPPORT_388945a0
2012-05-29 10:11 . 2012-05-29 10:11 -------- d-----w- c:\documents and settings\HelpAssistant
2012-05-29 10:11 . 2012-05-29 10:11 -------- d-----w- c:\documents and settings\Guest
2012-05-29 10:10 . 2012-05-29 10:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DFX
2012-05-29 10:10 . 2012-05-29 10:19 -------- d-----w- c:\program files\Common Files\DFX
2012-05-28 12:40 . 2012-05-28 12:40 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Oleksandr_Reminnyi
2012-05-28 12:39 . 2012-05-28 12:39 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\IsolatedStorage
2012-05-28 12:33 . 2012-05-28 12:42 -------- d-----w- c:\program files\StepShot
2012-05-28 12:32 . 2012-05-28 12:32 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\StepShot
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-23 14:13 . 2012-04-04 06:41 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-23 14:13 . 2011-05-24 07:00 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-02 13:19 . 2010-08-26 18:55 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2010-08-26 18:55 22552 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2010-08-26 15:34 329240 ----a-w- c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2010-08-26 15:34 210968 ----a-w- c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2010-08-26 15:34 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2010-08-26 18:55 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 13:19 . 2010-08-26 18:55 18456 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2010-08-26 18:55 15384 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2010-08-26 15:34 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2010-08-26 15:34 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 13:19 . 2004-08-18 10:00 97304 ----a-w- c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2010-08-26 15:34 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2010-08-26 15:34 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-05-31 13:22 . 2004-08-18 10:00 602112 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:09 . 2006-03-04 03:35 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 13:55 . 2004-08-18 10:00 1863168 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 14:44 . 2004-08-18 10:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-05-11 14:44 . 2004-08-18 10:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2004-08-18 10:00 385024 ----a-w- c:\windows\system32\html.iec
2012-05-05 03:14 . 2005-03-30 17:37 2194816 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-05 03:14 . 2005-03-30 17:37 2071296 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-04 06:01 . 2012-05-04 06:01 265797 ----a-w- c:\windows\system32\pdvcodec.dll
2012-05-02 13:46 . 2010-08-26 15:32 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2012-06-23_14.55.47 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-06-25 14:51 . 2012-06-25 14:51 16384 c:\windows\Temp\Perflib_Perfdata_440.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-07 00:15 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ICQ"="c:\program files\ICQ7.6\ICQ.exe" [2011-10-10 127040]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Matrox PowerDesk SE"="c:\program files\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe" [2010-02-11 4246784]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb06.exe" [2002-07-11 188416]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-07 4241512]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2011-11-03 738944]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2011-11-09 73360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Timer Wizard.lnk - c:\program files\Timer Wizard\Timer Wizard.exe [2005-6-5 225280]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\ICQ7.6\\ICQ.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
"c:\\Program Files\\VSO\\VSO Downloader\\2\\VsoDownloader.exe"=
"c:\\Program Files\\Opera\\pluginwrapper\\opera_plugin_wrapper.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5000:TCP"= 5000:TCP:Active@ SMART Monitor
.
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [9.5.2012 14:06 24408]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [8.6.2011 10:34 612184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [8.6.2011 10:34 337880]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8.6.2011 10:34 20696]
R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [1.11.2011 18:41 21992]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [3.11.2011 16:44 27016]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [3.11.2011 16:44 497280]
R2 Matrox Centering Service;Matrox Centering Service;c:\program files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe [11.2.2010 16:48 1266944]
R2 Matrox.Pdesk.ServicesHost;Matrox.Pdesk.ServicesHost;c:\program files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe [11.2.2010 16:48 344832]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [16.7.2010 2:45 35088]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [19.11.2010 17:27 27632]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4.4.2012 8:41 250056]
S3 GSService;GSService;c:\windows\system32\GSService.exe [2.11.2010 10:07 364544]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [19.11.2010 17:25 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [19.11.2010 17:25 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [19.11.2010 17:25 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [19.11.2010 17:26 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [19.11.2010 17:25 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [19.11.2010 17:25 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [19.11.2010 17:26 115752]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-06-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 14:13]
.
.
------- Doplňkový sken -------
.
uStart Page =
hxxp://isearch.avg.com/?cid={EE4BCC69-0BA6-4F24-AF21-D1E8DB605E4D}&mid=65afccf487be47d0afced14132423f1a-8f2e30cf10c608c06c9e1af784d682f9dff22fd8&lang=cs&ds=gm011&pr=sa&d=2012-04-29 04:38&v=11.0.0.9&sap=hp
mSearch Bar =
hxxp://www.google.com/ieIE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
TCP: DhcpNameServer = 46.30.232.3 217.168.208.20 217.168.208.21
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\i4ftlo3y.default\
FF - prefs.js: browser.startup.homepage -
www.centrum.cz/skinit/icq/FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter:
jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2012-06-25 16:52
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1229272821-1960408961-839522115-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,42,78,b3,80,34,0f,c8,49,97,5d,67,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,42,78,b3,80,34,0f,c8,49,97,5d,67,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(744)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'lsass.exe'(800)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'explorer.exe'(3196)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\mgabg.exe
.
**************************************************************************
.
Celkový čas: 2012-06-25 16:57:47 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-06-25 14:57
ComboFix2.txt 2012-06-24 08:49
ComboFix3.txt 2012-06-23 14:58
.
Před spuštěním: Volných bajtů: 125 967 749 120
Po spuštění: Volných bajtů: 125 950 803 968
.
- - End Of File - - B3570DA86F6FB8DC6D6D140FFE500D81
