prosim o kontrolu logu ComboFix Vyřešeno

[martin krok]

ComboFix 13-08-29.02 - SMCeleron 29.08.2013 21:32:40.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.624 [GMT 2:00]
Spuštěný z: c:\documents and settings\SMCeleron\Plocha\combofix_13.8.12.1.exe
AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\TZLog.log
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-07-28 do 2013-08-29 )))))))))))))))))))))))))))))))
.
.
2013-08-29 19:15 . 2013-08-29 19:20 -------- d-sh--w- c:\windows\system32\AI_RecycleBin
2013-08-28 21:46 . 2013-08-28 21:47 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Facebook
2013-08-28 18:57 . 2013-08-28 18:57 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\ChemTable Software
2013-08-28 18:55 . 2013-08-28 18:55 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\ChemTable Software
2013-08-28 18:55 . 2013-08-28 19:20 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\AnVir
2013-08-28 17:43 . 2013-08-28 17:43 -------- d-----w- c:\windows\system32\wbem\mof\good
2013-08-28 17:43 . 2013-08-28 17:43 -------- d-----w- c:\windows\system32\wbem\mof\bad
2013-08-27 23:35 . 2013-08-27 23:35 -------- d-----w- c:\documents and settings\All Users\Data aplikací\YTD Video Downloader
2013-08-27 23:34 . 2013-08-27 23:34 -------- d-----w- c:\program files\GreenTree Applications
2013-08-27 23:29 . 2013-08-27 23:30 -------- d-----w- c:\program files\YTD
2013-08-27 15:51 . 2013-08-27 15:51 -------- d-----w- c:\program files\CCleaner
2013-08-25 22:44 . 2013-08-25 22:44 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2013-08-25 21:12 . 2013-08-26 15:41 -------- d-----w- c:\program files\Microsoft Bootvis
2013-08-24 16:24 . 2013-08-24 16:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\PC1Data
2013-08-22 21:51 . 2013-08-25 19:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\clp
2013-08-22 21:36 . 2013-08-22 21:36 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Fighters
2013-08-22 21:04 . 2006-06-29 11:07 14048 ------w- c:\windows\system32\spmsg2.dll
2013-08-22 20:35 . 2013-08-22 21:50 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Common Toolkit Suite
2013-08-22 20:21 . 2013-08-22 20:21 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\Fighters
2013-08-22 20:21 . 2013-08-22 21:51 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\Fighters
2013-08-22 20:20 . 2013-08-22 22:17 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Fighters
2013-08-22 20:14 . 2013-08-22 20:14 23456 ----a-w- c:\windows\system32\drivers\DrvAgent32.sys
2013-08-22 20:14 . 2013-08-22 20:14 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\eSupport.com
2013-08-22 19:27 . 2013-08-22 19:29 -------- d-----w- c:\program files\Google
2013-08-18 21:42 . 2013-08-18 21:42 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Anthropics
2013-08-15 16:15 . 2011-06-21 09:24 32768 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2013-08-14 05:46 . 2013-08-15 16:08 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Unity
2013-08-11 13:29 . 2010-07-25 20:23 56496 ----a-w- c:\windows\system32\wbhelp2.dll
2013-08-11 13:29 . 2010-07-25 20:23 544768 ----a-w- c:\windows\system32\wbocx.ocx
2013-08-11 13:29 . 2010-07-25 20:23 258352 ----a-w- c:\windows\system32\unicows.dll
2013-08-11 13:29 . 2010-07-25 20:23 33968 ----a-w- c:\windows\system32\anim.dll
2013-08-11 13:29 . 2010-07-25 20:23 1706800 ----a-w- c:\windows\system32\gdiplus.dll
2013-08-11 13:29 . 2010-07-25 20:23 4608 ----a-w- c:\windows\system32\W95INF32.DLL
2013-08-11 13:29 . 2010-07-25 20:23 2272 ----a-w- c:\windows\system32\W95INF16.DLL
2013-08-11 12:15 . 2013-08-11 12:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ESET
2013-08-07 17:02 . 2013-08-07 17:02 4484 ----a-w- c:\windows\system32\drivers\cpuidlep.sys
2013-07-31 15:56 . 2013-07-31 15:56 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-02 23:48 . 2006-10-18 19:47 1543680 ------w- c:\windows\system32\wmvdecod.dll
2013-07-29 17:49 . 2013-07-29 17:49 16048 ----a-w- c:\windows\system32\drivers\GdPhyMem.sys
2013-07-26 02:49 . 2008-04-14 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-07-26 02:48 . 2008-04-14 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-07-26 02:48 . 2008-04-14 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-07-25 15:52 . 2008-04-14 12:00 385024 ----a-w- c:\windows\system32\html.iec
2013-07-10 10:37 . 2008-04-14 12:00 406016 ----a-w- c:\windows\system32\usp10.dll
2013-07-04 07:34 . 2008-04-14 08:06 2072320 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-07-04 07:34 . 2008-04-14 12:00 2195712 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-06-05 09:08 . 2008-04-14 12:00 1876736 ----a-w- c:\windows\system32\win32k.sys
2013-06-04 07:23 . 2008-04-14 12:00 563712 ----a-w- c:\windows\system32\qedit.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="d:\programy\eset\egui.exe" [2013-03-21 5078504]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Windows Search.lnk]
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner]
2013-08-21 18:22 3676952 ----a-w- c:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2013-07-25 06:58 20684656 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-11-17 03:42 577536 ----a-r- c:\windows\soundman.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\MadOnion.com\\3DMark2001 SE\\3DMark2001SE.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [10.1.2013 10:25 122240]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [10.1.2013 10:25 105784]
R2 ekrn;ESET Service;d:\programy\eset\ekrn.exe [21.3.2013 15:19 1341664]
S2 GDTdiInterceptor;GDTdiInterceptor;\??\c:\windows\system32\drivers\GDTdiIcpt.sys --> c:\windows\system32\drivers\GDTdiIcpt.sys [?]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [22.8.2013 22:14 23456]
S3 LMIRescue_391ac7ff-9f90-4cad-b200-d1ea20cd8371;LogMeIn Rescue (391ac7ff-9f90-4cad-b200-d1ea20cd8371);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000B.tmp\LMI_Rescue_srv.exe [28.7.2013 16:31 2570592]
S3 LMIRescue_796396c6-ef97-4e85-a52a-782c471ee2ce;LogMeIn Rescue (796396c6-ef97-4e85-a52a-782c471ee2ce);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000A.tmp\LMI_Rescue_srv.exe [28.7.2013 16:17 2570592]
S3 LMIRescue_b27ea1d2-3851-4c29-b5b2-00bfaf75611a;LogMeIn Rescue (b27ea1d2-3851-4c29-b5b2-00bfaf75611a);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000C.tmp\LMI_Rescue_srv.exe [20.8.2013 17:43 2570592]
S3 LMIRescue_eb30bad3-8f1c-44a7-8b74-10db35342de0;LogMeIn Rescue (eb30bad3-8f1c-44a7-8b74-10db35342de0);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0009.tmp\LMI_Rescue_srv.exe [20.7.2013 15:02 2570592]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6.7.2013 23:31 22856]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [26.8.2013 0:44 40776]
S3 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [25.7.2013 8:52 162672]
S4 LMIRescue_25b8023e-94c1-4a98-9c08-04bc13b20828;LogMeIn Rescue (25b8023e-94c1-4a98-9c08-04bc13b20828);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0005.tmp\LMI_Rescue_srv.exe [19.7.2013 20:23 2570592]
S4 LMIRescue_2a132eac-b3f6-4401-ad4d-57df7118dbc9;LogMeIn Rescue (2a132eac-b3f6-4401-ad4d-57df7118dbc9);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0001.tmp\LMI_Rescue_srv.exe [19.7.2013 20:03 2570592]
S4 LMIRescue_3f210bad-2787-4c38-96c1-fa9d220e8150;LogMeIn Rescue (3f210bad-2787-4c38-96c1-fa9d220e8150);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0006.tmp\LMI_Rescue_srv.exe [19.7.2013 20:36 2570592]
S4 LMIRescue_9cb5ae85-6c76-4fb0-ab82-956d017a0c28;LogMeIn Rescue (9cb5ae85-6c76-4fb0-ab82-956d017a0c28);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0008.tmp\LMI_Rescue_srv.exe [20.7.2013 10:58 2570592]
S4 LMIRescue_de44e4bb-4696-477e-92f3-b3a718683581;LogMeIn Rescue (de44e4bb-4696-477e-92f3-b3a718683581);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0004.tmp\LMI_Rescue_srv.exe [19.7.2013 20:18 2570592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-22 19:29 1177552 ----a-w- c:\program files\Google\Chrome\Application\29.0.1547.57\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-08-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-08-22 19:27]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.bing.com/
TCP: DhcpNameServer = 10.0.0.138
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
MSConfigStartUp-Malwarebytes Anti-Malware - d:\programy\mbam-setup-1.75.0.1300\Malwarebytes' Anti-Malware\mbamgui.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-08-29 21:39
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="96BF69B2A24B8A8C4FD51275A18331D1D524B2404EACB0D5D92CB78429CA5535F99CC7974DB43C2B4F5557FA2EB772B27D28CEDDFA072202CFF041FE06FD5146720235DB3DABB13EB35D76A4B73AFD9D52B580134F19673FE652F5FEFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA9C6AECB7A5D1407A2D97226D213B555BA7FD869164D6794A2D97226D213B5556EC7FDE352371EFB5FE124C9F066F9100A1A2F9EFDEDEEBD493530FD2927BE5ACC98AA443B2ABF8B2C7C01BBFE2358DA94E474A32BFD00A983FAB0866CDE59EB0E2772D974E75733428528FA1BD5750B8AA240E9146378282B12E96430874E61CB457D482FF86B0116C5E4C7218A47DB57329EEE5ECFE13F468B46F5019955B1C3D83A68813B05F8BB99C51AD025CB7D8A015E658FCB466E7D0CF649CF612C46575C5AC765DE31136F6F9B984CD9FC93D716133416B0B6251ECD6FA3727E92FC8DDFD1253AE8813911C97C231BB3E0B719879475C22D45C8189F687AA1E3CD280F825AF5C2318DC92140C4C9AA8F7DF34781FB7748450B33025F5E7AFBD9A60E2AFCF0E1A5E4EB18C9FE8F52C89FDD4983C6293EC0CD243092059002027DE868D019D647EA06BD6B5245C13628E80F2C91A8407E28F32E81A89782A619BCE5E4993491B50368217F2DE4002461C6A483DA1228A35DB44D5C43B67E2E0C5BF1A63D4169F13FB43F83EAC6347DEF65352CE87D8C4CA663AB6989910F940672E5C29AC6EBF2D6683F98C2650DD5B247DB76ED7BD9C92C27F045C2EE058A996C1E43B2DEEAE6E4D24F5790CF7CF86DC1B6A53C304625797A5001DC2874F1BC0AFB27ACB7F92FE51AA14A52293AE2C67F68F14BD4C7957F2BFB2367A936E2475FE35FD113745D3E36EB712BAABD464B7D9787B8B4988C925EAAA298F3E429F853BD528EC7F4BC32F4E6BE629DC687698E6F86C3B0BA2BEA0919EE481EE0447022775A77BFDE49ED755198626157C074571E82CF3D6D4925F587E674514F67B5DA0045417A56B17F2F6B5B3A6AB63FA4D056846462BA6E41C4B860BCC9187AB0E1CD54450944DCD8E77CD51EBE6C85154BCF86AE3B6D5CA5E673246758E698AEEE583E029156E1CF3E4E4A627948C7C567437BFDFA14849725066F5D64AC91E08E9CAD19CEFD0E2022AC71034CDBEF981AF0C4C762020CC598BC73A9651C695E9F1BBFD090EEE1E758E97320777E9C56AD1A3CA04C4DCF3FB06ED47FE82FD51F56D8079235A49029FA5DF1FAD3C89D294086ACC624D25DF930F02DB111A0458039DE886D37D904C975DD00FBCC9A79224380D619E831F5CB2D20893B927154C525B8C0919E11D89588CB22AB6114E9337CD66E1DB1CA127414DB69B63766D8914A789A558910DEBAC907D53C249CDBB4855B9BF8A4485C"
"OODEFRAG16.00.00.01PROFESSIONAL"="D178F64B240F4B49E312A8E921AE3FADD1DB511A56EB544A95429920B6B2FD2E4435279E29E3D5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA9C6AECB7A5D1407A2D97226D213B555BA7FD869164D6794A2D97226D213B5552ADF412764FAB7044731249BCC9ADA55C7DA7B8A4E9606129352F4C4EE8D50113C13F67ECFD5F75326BAD82F1AC315CAB6EE25BEF9B6726C1995F57FA3F568148D60D2FC776949BBD1A23018A212E17E0C7971F3DE61886B55C57F2F3FD13BAF44756E7581E04B81969A385784C6A0705F51FCF8390C076F497F5F9131EB073EEA53E82FB97BDE20AA28FCDE8434F5D8ACA2E50E6242718A5AAF66D0902055D370CEE1658E8B2B43242512970B45C522D56AD0E8DE201285521DE79198E26C3126907F46127999CCFDC08EDCA2743F6B1EFB64B151D5725C5F5EBD68A4B9DA51C2956CF5FC41D85398FA0D00FCD1CE06AEFECD85832A653D90DE44DF39BF7060E1ACD50B29705B9F37292B44EB02A778136D3BF56175FB0CDC5EDB767A2242BD7FFCEC8F95AA562F80770DE069BE42FEBB95E087FBA512609E71E89C32232CFE807EE6836528C3B20161D70390525905FD9B76B309BAC006117F543B4F19C8ECA97E7FDADE336491A6BAB7CA9F9D6B3111F43866E24BE87B57C48B29E36FF882A61CF17A6DAC36644627D94C7D95BB56926D65820381AFF6764FFDB6A423E372044E02BF9F8583F81721F10E304253010223C0DB0C977C5C5684A1A46CC7701F365CF377A8C6D3CF3377B60EE33FF9EEC38813BBC2617B4AC61C6DAAB881CE2313E311E65F8A751F1BCBE13BE83E4292A1E5A75E10449D0EF721DFF02B8CECC854D428C2BF817BD1B21233F9B281FC9346544E760237952DFE74F7950AB7819219F30BB7666D3C82BF166C2159E2C14BC343D9A847C9DC5ED5483B2B3FE1063463DB0EE398A65105EFF4D47E1A4EEBC80CF5230C379C2F0C59263338D885379619778CDA3B1898DECF1F3652D1C21CCEF90285AFC7648C56CB68EA3689AA15D5858762A35A4134C7555DDF4E8657B2D24954DF94196B381251BFF31325EE6742D622723924348B2FD646A51D60B159801929162EE90E3C4575AF62B12686B460202F210AEC1BC6358FC9DBD8A90F79366F1590671F3EE3AC230F4FE6AC364C69D56BD9792AADD5319E29DD925440430534FDBA9BC280BE36AC8AD6FC78593D49D3670A5F77BD6AAA88F90B4CF1A82936B31F839D81EEA186C8239A33EEDD5DA0D889A18693ADF960B3264602BCC0E2C19E86DFB0ABB525F50FAA3F3A1C45C7C40688172C61F3BFC26CEA751C8F16EBD78898C60F3697A30EFDC8EB382CA6573D63716506671EB878615A837CE9C682D96A8A3364BA68BF8F76FA4FC7F02C2DC6D9A608B8514928DA27"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(528)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2013-08-29 21:42:21
ComboFix-quarantined-files.txt 2013-08-29 19:42
.
Před spuštěním: Volných bajtů: 32 275 165 184
Po spuštění: Volných bajtů: 32 255 664 128
.
- - End Of File - - B1A30ECA350968FDE7F58FBA6F3045B9
413FC2A0C716421B3158746D63736515

[Reklama]

[jaro3]

Kdo Ti poradil Combofix , pomůže Ti zajisté i s jeho kontrolou.