Log z ComboFixu:ComboFix 09-02-07.01 - Michael 2009-02-08 19:24:38.6 -
FAT32x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1535.1050 [GMT 1:00]
Spuštěný z: c:\documents and settings\Michael\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Michael\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1296 [VPS 090208-0] *On-access scanning disabled* (Updated)
FW: COMODO Firewall Pro *disabled*
* Vytvořen nový Bod Obnovení
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
FILE ::
c:\windows\SYSTEM32\flvDX.dll
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\SYSTEM32\flvDX.dll
c:\windows\system32\NeW\
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-01-08 do 2009-02-08 )))))))))))))))))))))))))))))))
.
2009-02-01 16:35 . 2009-02-08 11:30 95 --a------ C:\23990098.$$$
2009-01-29 09:40 . 2009-01-29 09:40 <DIR> d-------- C:\CloneDVDTemp
2009-01-28 01:39 . 2009-01-28 01:39 <DIR> d-------- c:\documents and settings\Michael\.jogl_ext
2009-01-24 07:19 . 2009-01-24 07:20 <DIR> d-------- c:\program files\Active WebCam
2009-01-23 16:18 . 2009-01-23 16:18 <DIR> d-------- c:\program files\The KMPlayer
2009-01-08 22:59 . 2009-01-08 22:59 <DIR> d-------- c:\windows\Application Data\U3
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-04 23:49 --------- d-----w c:\windows\Application Data\Vista Start Menu
2009-01-04 23:25 --------- d-----w c:\program files\MSN Messenger
2008-12-27 11:58 548,864 ----a-w c:\windows\SYSTEM32\msvcp80.dll
2008-12-26 17:21 47,360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2008-12-26 17:21 47,360 ----a-w c:\windows\Application Data\pcouffin.sys
2008-12-26 17:21 --------- d-----w c:\program files\DVDFab 5
2008-12-26 14:41 87,608 ----a-w c:\windows\Application Data\ezpinst.exe
2008-12-21 20:06 --------- d-----w c:\program files\Xvid
2008-12-17 15:09 153,592 ----a-w c:\windows\Application Data\GDIPFONTCACHEV1.DAT
2008-12-17 13:40 --------- d-----w c:\windows\Application Data\OpenOffice.org
2008-12-08 18:35 --------- d-----w c:\windows\Application Data\Malwarebytes
2008-12-08 18:35 --------- d-----w c:\windows\All Users\Application Data\Malwarebytes
2008-11-29 20:17 410,976 ----a-w c:\windows\SYSTEM32\deploytk.dll
2007-12-14 12:45 22,328 ----a-w c:\windows\Application Data\PnkBstrK.sys
2006-12-31 15:50 92 ----a-w c:\windows\Application Data\fusioncache.dat
2006-12-31 14:55 271 --sh--w c:\program files\desktop.ini
2006-12-31 14:55 23,423 ---h--w c:\program files\folder.htt
2007-02-21 11:47 31,232 --sh--r c:\windows\SYSTEM32\msfDX.dll
2007-12-17 13:43 27,648 --sh--w c:\windows\SYSTEM32\Smab0.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-02-08_17.01.20,73 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-08 12:32:38 2,732 ----a-w c:\windows\All Users\Application Data\Skype\Plugins\_sstore.dat
+ 2009-02-08 17:44:06 2,732 ----a-w c:\windows\All Users\Application Data\Skype\Plugins\_sstore.dat
- 2009-02-08 15:32:28 2,114 ----a-w c:\windows\Application Data\Microsoft\Outlook\outcmd.dat
+ 2009-02-08 18:03:54 2,114 ----a-w c:\windows\Application Data\Microsoft\Outlook\outcmd.dat
- 2009-02-08 12:33:26 443,392 ----a-w c:\windows\Application Data\Skype\mike.ruprecht\dyncontent\bundle.dat
+ 2009-02-08 17:44:26 443,392 ----a-w c:\windows\Application Data\Skype\mike.ruprecht\dyncontent\bundle.dat
- 2009-02-08 12:33:28 3,108 ----a-w c:\windows\Application Data\Skype\mike.ruprecht\chatsync\6e\6e72ee895bb10478.dat
+ 2009-02-08 17:44:26 3,108 ----a-w c:\windows\Application Data\Skype\mike.ruprecht\chatsync\6e\6e72ee895bb10478.dat
- 2009-02-08 12:33:28 21,648 ----a-w c:\windows\Application Data\Skype\mike.ruprecht\index2.dat
+ 2009-02-08 17:44:26 21,680 ----a-w c:\windows\Application Data\Skype\mike.ruprecht\index2.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus DX4400 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE" [2007-03-01 180736]
"CursorXP"="c:\program files\CursorXP\CursorXP.exe" [2005-01-19 128000]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"VistaStartMenu"="c:\program files\Transform XP to Vista\Vista Start Menu\VistaStartMenu.exe" [2007-11-12 1702064]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"BootSkin Startup Jobs"="c:\program files\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 270336]
"razer"="c:\program files\Razer\razerhid.exe" [2005-05-17 147456]
"COMODO Firewall Pro"="c:\program files\Comodo\Firewall\CPF.exe" [2007-12-06 1115728]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"C-Media Mixer"="Mixer.exe" [2001-10-22 c:\windows\mixer.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\SYSTEM32\bthprops.cpl]
"SoundMan"="SOUNDMAN.EXE" [2003-11-13 c:\windows\SOUNDMAN.EXE]
c:\documents and settings\Michael\Nabˇdka Start\Programy\Po spuçtŘnˇ\
MutiKeyboard Driver.lnk - c:\program files\MultiKeyboard Driver\KbdDrv.exe [2007-11-29 367104]
Z stupce - WATCHDOG.lnk - c:\my_system\WATCHDOG.xls [2006-05-23 120320]
c:\windows\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
AudioDeck.lnk - c:\program files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe [2007-04-15 581632]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.VDOM"= vdowave.drv
"VIDC.I420"= i420vfw.dll
"VIDC.MJPG"= Pvmjpg30.dll
"msacm.g723"= g723.acm
"vidc.I263"= I263_32.drv
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
--a------ 2006-11-13 13:39 1289000 c:\program files\Microsoft ActiveSync\wcescomm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchList]
--a------ 2007-03-21 15:41 145496 c:\program files\Pinnacle\Studio 11\LaunchList2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"\\\\BASTLENI\\SDÍLENÉDOKUM\\Quake III Arena\\quake3.exe"=
"c:\\WINDOWS\\System32\\dpvsetup.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R0 BootScreen;BootScreen; [x]
R0 hhcpchfg;hhcpchfg; [x]
R3 SetupNTGLM7X;SetupNTGLM7X; [x]
R3 Vsp;Vsp;c:\windows\system32\drivers\Vsp.sys [2003-05-27 3351]
R4 Viewpoint Manager Service;Viewpoint Manager Service; [x]
S0 viasraid;viasraid;c:\windows\system32\DRIVERS\viasraid.sys [2003-06-12 75904]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560]
S2 PHPGeekUtil;PHPGeekUtil;c:\apache\APACHE.EXE [2002-01-25 20480]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [2008-01-14 21632]
S3 ovt530;Webcam Deluxe;c:\windows\system32\Drivers\ov530vid.sys [2005-03-15 161792]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\Drivers\Razerlow.sys [2005-04-24 13225]
S3 Usbfilt;Usbfilt;c:\windows\SYSTEM32\DRIVERS\usbfilt.sys [2004-02-01 26166]
--- Ostatní služby/ovladače v paměti ---
*Deregistered* - ALG
*Deregistered* - Apache
*Deregistered* - aswUpdSv
*Deregistered* - Ati HotKey Poller
*Deregistered* - ATI Smart
*Deregistered* - AudioSrv
*Deregistered* - avast! Antivirus
*Deregistered* - avast! Mail Scanner
*Deregistered* - avast! Web Scanner
*Deregistered* - Browser
*Deregistered* - BthServ
*Deregistered* - CmdAgent
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - EPSON_PM_RPCV4_01
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTP
*Deregistered* - HTTPFilter
*Deregistered* - ImapiService
*Deregistered* - Inspect
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - JavaQuickStarterService
*Deregistered* - Kbdclass
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LightScribeService
*Deregistered* - LmHosts
*Deregistered* - ManyCam
*Deregistered* - MarvinBus
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - Mouclass
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Null
*Deregistered* - ParVdm
*Deregistered* - PCLEPCI
*Deregistered* - pcouffin
*Deregistered* - PenClass
*Deregistered* - PHPGeekUtil
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - RasAcd
*Deregistered* - RasAuto
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RDPWD
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Secdrv
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Schedule
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TDTCP
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Udfs
*Deregistered* - UMWdf
*Deregistered* - Update
*Deregistered* - upnphost
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - Vsp
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - WmiApSrv
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Y]
\Shell\AutoRun\command - wd_windows_tools\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c17ecd0-021b-11dd-b87f-000c76969a4e}]
\Shell\AutoRun\command - wd_windows_tools\setup.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Obsah adresáře 'Naplánované úlohy'
2009-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]
2009-02-06 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe []
2009-01-28 c:\windows\Tasks\Schedule Task Weekly.job
- c:\program files\Registry Easy\RE.exe []
.
.
------- Doplňkový sken -------
.
uStart Page =
hxxp://mail.foxconn.cz/uSearchURL,(Default) =
hxxp://www.google.com/search?q=%s
DPF: DirectAnimation Java Classes -
file://c:\windows\SYSTEM\dajava.cab
DPF: Microsoft XML Parser for Java -
file://c:\windows\Java\classes\xmldso4.cab
FF - ProfilePath - c:\windows\Application Data\Mozilla\Firefox\Profiles\5h0gcrnh.default\
FF - prefs.js: browser.startup.homepage -
hxxp://www.seznam.czFF - plugin: c:\program files\Mozilla Firefox\plugins\np32asw.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-02-08 19:25:33
Windows 5.1.2600 Service Pack 3 FAT NTAPI
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\$$$\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C8000ED5-3463-43EC-3B92-C00E4301D097}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"jagcgicldolaagaeigcc"=hex:62,61,6b,63,00,00
"jagcgicldolaagaeigob"=hex:62,61,67,65,00,00
"iagdlgnalhplgcpkch"=hex:6b,61,64,65,64,70,65,70,63,6e,70,63,70,67,69,6e,6e,6d,
62,65,6b,69,00,00
"haibfdoijfppghdb"=hex:6b,61,64,65,64,70,65,70,63,6e,70,63,70,67,69,6e,6e,6d,
6a,65,6e,6b,00,00
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{0A6C8521-363D-45C1-93C0-34B133B3948E}\InProcServer32*]
"oaajjehjeolelfodceooiahfdnmcck"=hex:6a,61,62,69,65,6d,6a,6c,68,65,67,6f,64,61,
6b,6f,6b,6b,64,65,00,29
"naajpgohhbkkplidhdhkfbgadkan"=hex:6a,61,6c,68,6c,6c,69,70,6f,6a,61,6b,6a,63,
69,64,6d,70,68,69,00,00
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,3e,78,c6,cd,63,
ec,4c,0e,c8,28,51,af,b0,29,a3,98,1e,ce,0f,11,e0,7b,6a,b7,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:46,47,15,b0,92,4b,c7,ef,90,80,da,94,23,
64,06,af,71,3b,04,66,8b,46,0d,96,13,fa,9b,24,65,93,6d,8b,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,e0,cd,56,17,bf,
b3,85,b7,25,da,ec,7e,55,20,c9,26,85,d0,8f,96,c1,16,53,65,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,84,e1,5d,80,ea,
98,77,f5,3e,1e,9e,e0,57,5a,93,61,51,6f,51,a5,76,21,11,60,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,76,75,3b,71,e9,
0c,90,7d,cd,44,cd,b9,a6,33,6c,cd,81,e9,4f,e1,03,ea,5a,38,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,66,c3,91,35,a7,
13,e5,0f,b0,18,ed,a7,3f,8d,37,a4,d3,a9,ec,05,a2,d9,06,18,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,f8,0c,96,c4,42,
bb,2f,00,31,77,e1,ba,b1,f8,68,02,b5,fa,30,57,21,df,09,2e,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,ca,30,55,73,f6,
b5,93,03,83,6c,56,8b,a0,85,96,ab,1d,7e,11,1b,ee,18,7a,da,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,42,e1,18,b8,5b,
65,fd,7d,51,fa,6e,91,28,9e,14,cc,c9,6a,5d,81,e6,48,30,4f,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,a2,2d,7c,9c,20,
33,04,ca,b1,cd,45,5a,a8,c4,f8,b9,e9,e2,2d,0f,da,eb,cb,36,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,c3,9f,e1,a8,90,
29,ca,55,e3,0e,66,d5,eb,bc,2f,6b,c1,5c,2f,75,7b,0e,a7,8d,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:05,73,21,dd,54,d8,4a,c5,ff,39,37,92,33,
78,04,f2,fa,ea,66,7f,d4,3b,6b,70,61,57,08,a2,2b,ba,af,50,6c,43,2d,1e,aa,22,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(496)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2009-02-08 19:26:31
ComboFix-quarantined-files.txt 2009-02-08 18:26:30
ComboFix3.txt 2009-02-08 16:02:04
ComboFix2.txt 2009-02-08 17:50:32
Před spuštěním: Volných bajtů: 25 442 385 920
Po spuštění: Volných bajtů: 25,419,218,944
Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
375
Log z HijackThis:Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:27:35, on 8.2.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\apache\Apache.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
c:\apache\Apache.exe
C:\WINDOWS\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\apache\APACHE.EXE
c:\apache\APACHE.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Razer\razerhid.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Transform XP to Vista\Vista Start Menu\VistaStartMenu.exe
C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
C:\Program Files\MultiKeyboard Driver\KbdDrv.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Razer\razertra.exe
C:\Program Files\Razer\razerofa.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Programy a hry\kontrola proti virům\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://mail.foxconn.cz/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\WINDOWS\TEMP\E_SA9.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [VistaStartMenu] "C:\Program Files\Transform XP to Vista\Vista Start Menu\VistaStartMenu.exe"
O4 - Startup: MutiKeyboard Driver.lnk = C:\Program Files\MultiKeyboard Driver\KbdDrv.exe
O4 - Startup: Zástupce - WATCHDOG.lnk = C:\my_system\WATCHDOG.xls
O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apache - Unknown owner - c:\apache\Apache.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\WINDOWS\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PHPGeekUtil - Unknown owner - c:\apache\APACHE.EXE
--
End of file - 5805 bytes