ComboFix 09-02-28.01 - caci 2009-03-01 12:01:57.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.3070.2587 [GMT 1:00]
Spuštěný z: c:\documents and settings\caci.WIN-M8BJMBUM0PM\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1282 [VPS 090228-0] *On-access scanning disabled* (Updated)
* Vytvořen nový Bod Obnovení
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\YMANTE~1
c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\YMANTE~1\?ymantec\
c:\temp\tn3
c:\windows\system32\adeeg.bak1
c:\windows\system32\adeeg.bak2
c:\windows\system32\adeeg.ini2
c:\windows\system32\adeeg.tmp
c:\windows\system32\AutoRun.inf
c:\windows\system32\fiobfxbe.ini
c:\windows\system32\jrlagjbg.ini
c:\windows\system32\lbsexqvn.ini
c:\windows\system32\ohqrnjbd.ini
c:\windows\system32\xgyclmvt.ini
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_CORE
-------\Legacy_DOMAINSERVICE
((((((((((((((((((((((((( Soubory vytvořené od 2009-02-01 do 2009-03-01 )))))))))))))))))))))))))))))))
.
2009-02-26 16:43 . 2009-02-26 16:43 <DIR> d-------- c:\program files\Trend Micro
2009-02-25 17:54 . 2009-02-25 18:10 <DIR> d-------- C:\WoW + wotlk + 3.0.3
2009-02-25 17:46 . 2009-03-01 11:04 <DIR> d-------- C:\WoW + TBC + 2.4.3
2009-02-22 17:12 . 2009-02-22 17:12 <DIR> d-------- c:\program files\SysJewel
2009-02-22 17:08 . 2009-02-22 17:08 <DIR> d-------- c:\program files\Ultra Sys Info
2009-02-19 11:29 . 2009-02-19 14:47 <DIR> d-------- c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\tor
2009-02-19 11:28 . 2009-02-19 11:28 <DIR> d-------- c:\program files\Vidalia Bundle
2009-02-19 11:28 . 2009-03-01 12:05 <DIR> d-------- c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\Vidalia
2009-02-16 20:04 . 2009-02-24 16:32 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Plocha
2009-02-15 20:50 . 2009-01-15 08:19 206,793 --a------ c:\windows\system32\nvapps.nvb
2009-02-07 13:51 . 2009-02-07 13:51 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-07 13:51 . 2009-02-07 13:51 <DIR> d-------- c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\Malwarebytes
2009-02-07 13:51 . 2009-02-07 13:51 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Data aplikací\Malwarebytes
2009-02-07 13:51 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-07 13:51 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-07 13:27 . 2009-02-07 13:27 <DIR> d-------- c:\program files\CCleaner
2009-02-03 16:22 . 2009-02-03 16:22 <DIR> d-------- c:\program files\Notepad++
2009-02-03 16:22 . 2009-02-03 16:34 <DIR> d-------- c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\Notepad++
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-28 15:14 --------- d-----w c:\program files\ICQ6
2009-02-27 19:38 --------- d-----w c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\Skype
2009-02-27 19:31 --------- d-----w c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\skypePM
2009-02-26 17:39 --------- d-----w c:\program files\DAEMON Tools Toolbar
2009-02-25 18:54 --------- d-----w c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\OpenOffice.org2
2009-02-25 13:26 --------- d-----w c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\uTorrent
2009-02-16 19:16 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-16 19:15 --------- d-----w c:\program files\GameSpy Arcade
2009-02-16 19:09 --------- d-----w c:\program files\Styler
2009-02-16 19:07 --------- d-----w c:\program files\Total Video Converter
2009-02-16 19:06 --------- d-----w c:\program files\SQLyog
2009-02-16 19:05 --------- d-----w c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\Samsung
2009-02-16 17:45 --------- d-----w c:\program files\AIMP2
2009-01-18 09:46 --------- d-----w c:\program files\DesetiPrsty
2009-01-18 09:26 --------- d-----w c:\program files\Yahoo!
2009-01-17 10:43 138,184 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-01-15 07:19 6,301,248 ----a-w c:\windows\system32\drivers\nv4_mini.sys
2009-01-11 16:24 --------- d-----w c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\ICQ
2009-01-11 09:52 --------- d-----w c:\program files\ICQ6Toolbar
2009-01-03 15:46 --------- d-----w c:\program files\Norton AntiVirus
2009-01-03 15:46 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-03 15:41 --------- d-----w c:\documents and settings\All Users.WINDOWS\Data aplikací\Symantec
2009-01-02 23:09 --------- d-----w c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\vlc
2009-01-02 22:53 --------- d-----w c:\program files\VideoLAN
2008-12-07 09:29 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-12-07 09:29 249,856 ------w c:\windows\Setup1.exe
2008-05-26 17:58 27,480 ----a-w c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\GDIPFONTCACHEV1.DAT
2008-04-09 18:57 22,328 ----a-w c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\PnkBstrK.sys
2008-03-16 15:06 32 ----a-w c:\documents and settings\All Users.WINDOWS\Data aplikací\ezsid.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Vidalia"="c:\program files\Vidalia Bundle\Vidalia\vidalia.exe" [2009-01-21 4033618]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelAudioStudio"="c:\program files\Intel Audio Studio\IntelAudioStudio.exe" [2005-08-09 8597586]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-12 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
"nwiz"="nwiz.exe" [2009-01-15 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336]
c:\documents and settings\caci.WIN-M8BJMBUM0PM\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
c:\documents and settings\caci.WIN-M8BJMBUM0PM\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
c:\documents and settings\caci.WIN-M8BJMBUM0PM\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
c:\documents and settings\All Users.WINDOWS\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Privoxy.lnk - c:\program files\Vidalia Bundle\Privoxy\privoxy.exe [2006-11-20 250368]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2007-03-05 16:36 140976 c:\progra~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\
0OODBS
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^ WinCinema Manager.lnk]
path=c:\documents and settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění\ WinCinema Manager.lnk
backup=c:\windows\pss\ WinCinema Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=c:\documents and settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^ScreenHunter 4.0 Free.lnk]
path=c:\documents and settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění\ScreenHunter 4.0 Free.lnk
backup=c:\windows\pss\ScreenHunter 4.0 Free.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^TV Remote Control.lnk]
path=c:\documents and settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění\TV Remote Control.lnk
backup=c:\windows\pss\TV Remote Control.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^caci.WIN-M8BJMBUM0PM^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.0.lnk]
path=c:\documents and settings\caci.WIN-M8BJMBUM0PM\Nabídka Start\Programy\Po spuštění\OpenOffice.org 2.0.lnk
backup=c:\windows\pss\OpenOffice.org 2.0.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^caci.WIN-M8BJMBUM0PM^Nabídka Start^Programy^Po spuštění^TA_Start.lnk]
path=c:\documents and settings\caci.WIN-M8BJMBUM0PM\Nabídka Start\Programy\Po spuštění\TA_Start.lnk
backup=c:\windows\pss\TA_Start.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^caci.WIN-M8BJMBUM0PM^Nabídka Start^Programy^Po spuštění^Think-Adz.lnk]
path=c:\documents and settings\caci.WIN-M8BJMBUM0PM\Nabídka Start\Programy\Po spuštění\Think-Adz.lnk
backup=c:\windows\pss\Think-Adz.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2008-11-12 17:54 81000 c:\progra~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-11-16 19:04 139264 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-04-14 07:52 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-07-17 13:20 490952 c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FLMOFFICE4DMOUSE]
--a------ 2008-02-23 11:24 958464 c:\program files\Labtec\Mouse\V3.0\moffice.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-26 23:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-03-11 21:34 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelAudioStudio]
--a------ 2005-08-09 17:35 8597586 c:\program files\Intel Audio Studio\IntelAudioStudio.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-04-14 07:52 1695232 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2009-01-15 08:19 13680640 c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 2007-12-10 10:12 695808 c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
--a------ 2007-11-07 17:35 1294336 c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2007-01-20 08:09 200704 c:\program files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-07-12 03:00 132496 c:\program files\Java\jre1.6.0_02\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VisualTaskTips]
--a------ 2006-07-31 12:33 36864 c:\program files\VisualTaskTips\VisualTaskTips.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2009-01-15 08:19 86016 c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2009-01-15 08:19 1657376 c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"VSS"=3 (0x3)
"SysmonLog"=3 (0x3)
"RasMan"=3 (0x3)
"Messenger"=2 (0x2)
"ekrn"=2 (0x2)
"EhttpSrv"=3 (0x3)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"z:\\Hry\\Need For Speed Carbon\\NFSC.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Documents and Settings\\caci.WIN-M8BJMBUM0PM\\temp\\TeamViewer3\\TeamViewer.exe"=
"z:\\Hry\\Unreal Tournament 2004\\System\\UT2004.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-09 110160]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-12-09 20560]
R2 NwSapAgent;Agent SAP;c:\windows\System32\svchost.exe -k netsvcs [2001-10-25 14336]
R3 Cap713x;Philips Cap713x Video Capture;c:\windows\system32\drivers\Cap713x.sys [2006-12-29 686080]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2002-08-29 69120]
S1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\documents and settings\All Users.WINDOWS\Data aplikací\Spyware Terminator\sp_rsdrv2.sys --> c:\documents and settings\All Users.WINDOWS\Data aplikací\Spyware Terminator\sp_rsdrv2.sys [?]
S3 Axtmvflt;Axesstel USB Filter Service;c:\windows\system32\drivers\Axtmvflt.sys [2008-06-05 3456]
S3 Axtmvmdm;Axesstel USB Modem;c:\windows\system32\drivers\Axtmvmdm.sys [2008-06-05 40064]
S3 Axtmvprt;Axesstel Diagnostic Port;c:\windows\system32\drivers\Axtmvprt.sys [2008-06-05 38784]
S3 BTCAMDRV;Mobiola Web Camera driver;c:\windows\system32\drivers\BTCamDrv.sys [2007-08-08 219264]
S3 qexosaimi;qexosaimi;\??\z:\uploadv2\mmo glider 1.6.8\qexosaimi.sys --> z:\uploadv2\mmo glider 1.6.8\qexosaimi.sys [?]
S3 uyqfkd;uyqfkd;\??\z:\uploadv2\mmo glider 1.6.8\uyqfkd.sys --> z:\uploadv2\mmo glider 1.6.8\uyqfkd.sys [?]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'
2009-03-01 c:\windows\Tasks\AF20663391841803.job
- c:\docume~1\caci~1.win\dataap~1\axisup~1\GlueDateTwo.exe []
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
MSConfigStartUp-au - c:\program files\Dealio\DealioAU.exe
MSConfigStartUp-CanonMyPrinter - c:\program files\Canon\MyPrinter\BJMyPrt.exe
MSConfigStartUp-CanonSolutionMenu - c:\program files\Canon\SolutionMenu\CNSLMAIN.exe
MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
MSConfigStartUp-CloneCDTray - c:\program files\CloneCD\CloneCDTray.exe
MSConfigStartUp-ExploreUpdSched - c:\windows\System32\lwinlndt.exe
MSConfigStartUp-ICQ - z:\aaa test icq6.5\ICQ6.5\ICQ.exe
MSConfigStartUp-ICQ Lite - c:\program files\ICQLite\ICQLite.exe
MSConfigStartUp-LClock - c:\program files\LClock\LClock.exe
MSConfigStartUp-NapsterShell - c:\program files\Napster\napster.exe
MSConfigStartUp-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
MSConfigStartUp-osCheck - c:\program files\Norton AntiVirus\osCheck.exe
MSConfigStartUp-PCSuiteTrayApplication - c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
MSConfigStartUp-PVR Agent - c:\program files\MSI\TV@Anywhere Plus\TVR\Scheduled.exe
MSConfigStartUp-QIP2005 - c:\program files\QIP\qip.exe
MSConfigStartUp-SystemOptimizer - c:\windows\System32\gbjgalrj.dll
MSConfigStartUp-ViOrb - c:\program files\ViOrb\ViOrb.exe
MSConfigStartUp-Vista Sidebar - c:\program files\Vista Sidebar\sidebar.exe
MSConfigStartUp-ViStart - c:\program files\ViStart\ViStart.exe
MSConfigStartUp-w3dr - z:\hry\Warcraft III\w3dr.exe
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe
MSConfigStartUp-{7C-C2-20-0B-ZN} - c:\windows\system32\mkdsregs.exe
MSConfigStartUp-32 Driver - iexplorer.exe
MSConfigStartUp-SigmatelSysTrayApp - sttray.exe
.
------- Doplňkový sken -------
.
uStart Page =
hxxp://www.windowsxlive.netuInternet Connection Wizard,ShellNext =
hxxp://www.bitcomet.com/client/changelo ... 76&l=cz_czuInternet Settings,ProxyServer = 208.62.125.146:80
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Link to &MidpX - c:\program files\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm
DPF: DirectAnimation Java Classes -
file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java -
file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\Mozilla\Firefox\Profiles\f4orjtl8.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - prefs.js: keyword.URL -
hxxp://search.icq.com/search/afe_result ... id=afex&q=FF - component: c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\Mozilla\Firefox\Profiles\f4orjtl8.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampPlayer.dll
FF - component: c:\documents and settings\caci.WIN-M8BJMBUM0PM\Data aplikací\Mozilla\Firefox\Profiles\f4orjtl8.default\extensions\piclens@cooliris.com\components\piclensstub.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npWebLaunch.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-03-01 12:05:09
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-515967899-1770027372-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-515967899-1770027372-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{917CCA86-1A63-24D0-D5E8-2C1A08256796}*]
"hahniagdodlmfche"=hex:6a,61,6d,6f,6f,69,6e,67,70,6d,62,6e,6f,6f,62,68,61,6b,
6b,64,00,a4
"iafnchnkdinbijclhi"=hex:69,61,64,6f,70,6b,67,70,6c,66,6e,67,65,68,67,6c,6b,66,
00,77
[HKEY_USERS\S-1-5-21-515967899-1770027372-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{9D1E3314-5AA0-F885-1225-DCE2558BB65F}*]
"iamjneakfddbajokfe"=hex:6a,61,69,64,66,62,67,61,6d,65,6e,6f,61,69,61,64,64,70,
6b,69,00,00
"hacjhjljmohgfjml"=hex:6a,61,6a,64,6b,67,67,6e,62,68,6b,6e,61,65,64,6f,6c,62,
66,6c,00,00
[HKEY_USERS\S-1-5-21-515967899-1770027372-725345543-1003\Software\Policies\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (S-1-5-21-515967899-1770027372-725345543-1003)
@Allowed: (Read) (S-1-5-21-515967899-1770027372-725345543-1003)
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-515967899-1770027372-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:8f,d0,5f,bd,39,ae,31,30,61,8a,dc,98,45,26,7e,d1,00,97,f8,49,28,a4,56,
5f,02,07,06,eb,b3,44,b6,94,50,e5,65,60,aa,3c,32,fd,ac,c9,00,51,bb,ad,e4,95,\
"??"=hex:6c,f3,dc,94,45,11,c3,5a,bf,87,f7,3c,df,13,cf,83
[HKEY_USERS\S-1-5-21-515967899-1770027372-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:6b,14,29,57,56,85,9b,cc,e3,80,85,c9,a5,1b,08,76,39,a4,24,e9,a2,
2e,05,d6,69,b9,bf,79,51,eb,99,22,dc,61,0e,01,f0,ef,34,93,08,f7,1a,6a,d5,b2,\
"rkeysecu"=hex:d8,62,68,9b,a1,60,a1,90,1e,17,33,fa,c2,bc,ca,df
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="3DF6B5C63EF10504C6C52907095838751EF55DEB88CAA4B5D713DBBAB18F6D73BFCC61FBC66663996FBDEB3C85D6026129CEA25E3B1FC16A8DA5888013A3ABE4192282EC47F94B4EF46A2C1D907B6C38981078CA76F0A1A538B52D95E544277509D69D3095488CDBCC0D4AAA4492AF6B35F8BC3CBBDC0CB41724C0ACAFFED56A638DE6C3DEF1679E7E2A594A91ED7A12DF0F7E215F85BB847C98F3DF49E61EA8112D4A071F1B0F192A8820C5BB60EE64881C834C0A10DEA9D1FC26286192DB3F0EE2E53FAAE9AE6EFEB51BCBD9C423C1B62D42F2B7261AD9107E6E66F91EE05B6B9B8C92280B62E8C2007AEA5AF521AA8492E830BBF583FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5C9DB7CE019D40AA5CC038D530D6EB3452A488335373BCB6055FDBE894D3D44186C30A932D13FC9D4D3CA020205913389D59CD69AB7A840D1EDC3E1D28C2610F1FD0CEA93EDE2D9DBCB50DBAEEC88A8DC6BB0849615034BBFE0CEEB80C2944B5A5A60506AA104C7057C95F897AFA410FB5EA743DDBDC2EB869C68024A77843FBE878B4B37242274D1723B2558454288435AC64EFB6ECABFA138B9A8C92077CAAAA9C7780CB76E1ECEE13B72EFB9E08397F6A3F52C0B33800A77B7562998FE090238F7E7D200DEF10BF8CB4670A847A7C4831FA187E4532C8C3DCE0DCBC3034FE7DED0C818D4F1CF763287F178717ED2234B028B9271CCF597A9A3EF1B0EA91CA587CF628646904EBA521841A834CA682DA3FE5F2269496BBCF4084625D27E24EC6A02C4D2BE91A36C558C58F41FA39F84A54E8C49BF0E37A4001BC2DE02E6A6650E6A9159B4222267951D6D8B65E1364840E7C7359D5E6A739B287178A2F3DF5EEFB03E3A14D390D67335E9E0E9970A9FB2D7C85E94CA3571C5094AADFBC43E19235DE646144C9432B4B9A4BA5AFE5AE1C95DBC885C2F1A23EF5ABB4974D39931D08F885AD479723D6085B8E1188D96040511E4C9D0B7CA5EA67A6C5213AB0F9671021781258B70AEC7E835B9671862F3B0DDC6555D84481DE09733499420E853C8BBA35CAE0935CE4E40E68B09A7A0DD01945AA04479C5B4E649517D7898A2C58DD3B73CAAB6AFEAC9984318D189A72B9EA1A79B552AD5A5E29224DE3943267718DB03236E84CDDA21B09F48F629ADA249BAEF1A9DCF1ABA7284377794DE6352DC5B7B4E62A20671B0D4F37CC5687C6AF676DF7522A3B81B9D7B8FA89045B17265585806A679F0E5F389F3E91B33F38722FD3B258E5AB0E95515201B9E91A92EC2F605F03FB57472987D6165B1FF338F578728F189C3C8C33D2797662167F31836A24DE25292B102B8B630DDC222ED136EC6F3FA0BFB7B77A3E268B8D01BC02E1423F52FA0FCEE507F7"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(844)
c:\progra~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Canon\IJPLM\ijplmsvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\UAService7.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-03-01 12:07:49 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-03-01 11:07:46
Před spuštěním: 7 386 861 568
Po spuštění: 7,357,935,616
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
337 --- E O F --- 2009-02-26 12:58:17
