ComboFix 09-08-27.01 - Uzivatel 27.08.2009 21:42.5.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.511.244 [GMT 2:00]
Spuštěný z: c:\documents and settings\Uzivatel\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Uzivatel\Plocha\CFScript.txt
AV: Eset NOD32 Antivirus 2.70 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FILE ::
"c:\docume~1\Uzivatel\LOCALS~1\Temp\BPB1614.tmp"
"c:\windows\system32\ezsidmv.dat"
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\ezsidmv.dat
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_GARENAPENGINE
((((((((((((((((((((((((( Soubory vytvořené od 2009-07-27 do 2009-08-27 )))))))))))))))))))))))))))))))
.
2009-08-26 14:10 . 2009-08-26 14:10 98304 ----a-w- c:\windows\system32CmdLineExt.dll
2009-08-22 12:06 . 2009-08-27 19:16 -------- d-----w- c:\program files\Garena
2009-08-12 21:17 . 2009-07-10 13:28 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-10 15:43 . 2009-08-10 15:43 -------- d-----w- c:\program files\Webteh
2009-08-10 13:11 . 2009-08-10 13:11 298104 ----a-w- c:\windows\system32\imon.dll
2009-08-10 13:11 . 2009-08-10 13:11 512096 ----a-w- c:\windows\system32\drivers\amon.sys
2009-08-10 13:11 . 2009-08-10 13:11 15424 ----a-w- c:\windows\system32\drivers\nod32drv.sys
2009-08-10 09:10 . 2009-08-10 09:12 -------- d-----w- c:\program files\ICQ6.5
2009-08-09 20:26 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-09 20:26 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-09 20:26 . 2009-08-09 20:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-08 14:22 . 2009-08-08 14:22 -------- d-----w- c:\windows\system32\wbem\Repository
2009-08-08 13:11 . 2009-08-08 13:11 -------- d-----w- c:\program files\Trend Micro
2009-07-29 11:10 . 2009-07-03 16:59 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-29 11:10 . 2009-07-03 16:59 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-27 19:36 . 2009-07-21 12:52 -------- d-----w- c:\program files\Warcraft III
2009-08-26 19:14 . 2009-05-20 14:41 -------- d-----w- c:\program files\Windows Media Connect 2
2009-08-26 14:30 . 2009-05-22 15:15 -------- d-----w- c:\program files\ESET
2009-08-26 14:13 . 2009-05-22 15:29 611064 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-08-26 14:10 . 2009-05-19 20:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-21 11:01 . 2009-07-03 14:23 137928 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-08-21 11:00 . 2009-07-03 14:23 189768 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-08-08 12:33 . 2009-06-06 19:57 -------- d-----w- c:\program files\Java
2009-08-05 18:44 . 2009-05-22 15:26 -------- d-----w- c:\program files\MediaCoder
2009-08-05 09:01 . 2004-08-17 13:49 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-25 03:23 . 2009-06-06 19:58 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-21 17:11 . 2009-07-21 17:06 51618 ----a-w- c:\windows\War3Unin.dat
2009-07-21 17:11 . 2009-07-21 17:06 2829 ----a-w- c:\windows\War3Unin.pif
2009-07-21 17:11 . 2009-07-21 17:06 139264 ----a-w- c:\windows\War3Unin.exe
2009-07-21 14:42 . 2009-07-21 14:42 -------- d-----w- c:\program files\Palm
2009-07-17 19:04 . 2004-08-17 13:49 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-17 13:49 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-04 07:24 . 2009-07-04 07:20 -------- d-----w- c:\program files\Ubi Soft
2009-07-04 07:23 . 2009-07-04 07:23 -------- d-----w- c:\program files\directx
2009-07-03 16:59 . 2004-08-17 13:49 915456 ------w- c:\windows\system32\wininet.dll
2009-07-03 14:22 . 2009-07-03 14:22 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-07-03 14:14 . 2009-07-03 14:14 -------- d-----w- c:\program files\GamePark
2009-07-03 13:37 . 2009-07-03 13:37 -------- d-----w- c:\program files\Activision
2009-07-03 13:35 . 2009-05-19 20:28 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-25 08:27 . 2004-08-17 13:49 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:27 . 2004-08-17 13:49 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:27 . 2004-08-17 13:49 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:27 . 2004-08-17 13:49 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:27 . 2004-08-17 13:49 729088 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:27 . 2004-08-17 13:49 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2004-08-03 20:59 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-22 14:55 . 2009-06-22 14:55 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-06-20 07:51 . 2001-10-25 14:00 91736 ----a-w- c:\windows\system32\perfc005.dat
2009-06-20 07:51 . 2001-10-25 14:00 461624 ----a-w- c:\windows\system32\perfh005.dat
2009-06-16 14:40 . 2004-08-17 13:49 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2001-10-25 14:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 10:45 . 2004-08-17 13:49 78336 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:45 . 2004-08-17 13:49 81408 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-10 14:15 . 2004-08-17 13:49 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2009-05-19 03:50 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:16 . 2004-08-17 13:49 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:11 . 2004-08-17 13:49 1293824 ----a-w- c:\windows\system32\quartz.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-08-27_18.04.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-27 19:48 . 2009-08-27 19:48 16384 c:\windows\temp\Perflib_Perfdata_1d0.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-12-16 94208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-07-30 143360]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440]
"WinFast Schedule"="c:\program files\WinFast\WFTVFM\WFWIZ.exe" [2006-01-26 327680]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-08-10 949376]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23584:TCP"= 23584:TCP:BitComet 23584 TCP
"23584:UDP"= 23584:UDP:BitComet 23584 UDP
R0 m5289;m5289;c:\windows\system32\drivers\m5289.sys [18.5.2009 16:29 51840]
R0 uliagpkx;ULi AGP Bus Filter Driver;c:\windows\system32\drivers\AGPKX.SYS [19.5.2009 22:15 44928]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [10.8.2009 15:11 15424]
R3 ULI5261;ULi Based Ethernet NT Driver;c:\windows\system32\drivers\ULILAN.SYS [19.5.2009 22:15 28160]
R3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [22.5.2009 18:08 9446]
S3 ULI5261XP;ULi M526X Ethernet NT Driver;c:\windows\system32\drivers\ULILAN51.SYS [19.5.2009 22:15 28672]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'
2009-08-27 c:\windows\Tasks\User_Feed_Synchronization-{EEB22A03-1EBE-474C-B83F-15D5BC5EAC90}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page =
hxxp://www.centrum.cz/skinit/icq/IE: Download all links using BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Download all videos using BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Download link using &BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
TCP: {03203F6E-1EAF-42EF-8B7C-626AF86F41EA} = 89.203.139.1,192.167.60.1
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} -
hxxp://download.eset.com/special/eos/OnlineScanner.cabFF - ProfilePath - c:\documents and settings\Uzivatel\Data aplikací\Mozilla\Firefox\Profiles\khlb7793.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - prefs.js: keyword.URL -
hxxp://search.icq.com/search/afe_result ... id=afex&q=FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-08-27 21:50
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-682003330-1123561945-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:9d,ec,ca,b3,35,68,4f,99,c0,a4,04,52,22,b1,e3,ed,11,dc,55,a6,e2,bd,73,
a7,d1,09,a8,0a,52,27,34,c4,9b,95,8b,c2,0c,bd,12,42,94,98,30,ef,80,f2,d6,a7,\
"??"=hex:07,2a,6b,62,3d,9b,26,46,92,d7,f9,77,41,45,7e,b6
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(744)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'lsass.exe'(800)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
- - - - - - - > 'explorer.exe'(3280)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\ESET\nod32krn.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-08-27 21:52 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-08-27 19:52
ComboFix2.txt 2009-08-27 18:06
Před spuštěním: Volných bajtů: 269 096 652 800
Po spuštění: Volných bajtů: 269 011 750 912
244 --- E O F --- 2009-08-27 11:55
) přesto reději prosím o preventivní kontrolu logu...děkuji
