Prebehol som tom ComboFixom tu je log
ComboFix 08-03-21.2 - Fero 2008-03-22 10:18:50.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.153 [GMT 1:00]
Running from: C:\Documents and Settings\Fero\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Fero\Application Data\tmp1C1C.tmp.exe
C:\Documents and Settings\Fero\Application Data\tmp1C1E.tmp.exe
C:\Documents and Settings\Fero\Application Data\tmp1E81.tmp.exe
C:\Documents and Settings\Fero\Application Data\tmp37.tmp.exe
C:\Documents and Settings\Fero\Application Data\tmpF00.tmp.exe
C:\Documents and Settings\Fero\Application Data\tmpF05.tmp.exe
C:\Program Files\Common Files\{2C276~1
C:\Program Files\Common Files\{2C276~2
C:\Program Files\Common Files\{3C276~1
C:\WINDOWS\regedit.com
C:\WINDOWS\system32\components
C:\WINDOWS\system32\taskmgr.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_COM+_MESSAGES
((((((((((((((((((((((((( Files Created from 2008-02-22 to 2008-03-22 )))))))))))))))))))))))))))))))
.
2008-03-19 12:22 . 2008-03-19 13:01 <DIR> d-------- C:\Documents and Settings\Fero\Application Data\Hamachi
2008-03-19 12:20 . 2008-03-19 12:22 <DIR> d-------- C:\Program Files\Hamachi
2008-03-19 12:20 . 2008-03-19 12:20 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-03-16 09:26 . 2008-03-16 09:26 <DIR> d-------- C:\Documents and Settings\Fero\Application Data\kantaris
2008-03-08 17:39 . 2008-03-08 17:39 <DIR> d-------- C:\Program Files\Java
2008-03-08 17:39 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-08 17:37 . 2008-03-08 17:37 <DIR> d-------- C:\Program Files\Common Files\Java
2008-03-08 17:03 . 2008-03-21 21:24 <DIR> d-------- C:\Program Files\Unlocker
2008-03-08 17:03 . 2008-03-21 21:30 <DIR> d-------- C:\Documents and Settings\Fero\Application Data\Desktopicon
2008-03-08 12:53 . 2008-03-08 12:53 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-03-08 12:53 . 2008-03-21 19:25 <DIR> d-------- C:\Documents and Settings\Fero\Application Data\skypePM
2008-03-08 12:53 . 2008-03-08 12:53 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-03-06 16:31 . 2008-03-06 16:31 <DIR> d-------- C:\Program Files\MumboJumbo
2008-03-06 14:17 . 2008-03-19 15:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MumboJumbo
2008-03-05 17:55 . 2008-03-05 17:55 4,096 --a------ C:\WINDOWS\d3dx.dat
2008-03-05 15:30 . 2008-03-06 14:04 <DIR> d-------- C:\Documents and Settings\Fero\Application Data\PlayFirst
2008-03-04 19:12 . 2008-03-04 19:12 <DIR> d-------- C:\Documents and Settings\Fero\Application Data\vlc
2008-03-02 20:50 . 2008-03-02 21:19 <DIR> d-------- C:\Program Files\The KMPlayer
2008-03-01 17:51 . 2008-03-01 17:51 <DIR> d-------- C:\Program Files\Xilisoft
2008-03-01 17:51 . 2008-03-01 17:51 <DIR> d-------- C:\Program Files\QuickTime
2008-02-28 16:06 . 2008-02-28 16:06 244 --ah----- C:\sqmnoopt06.sqm
2008-02-28 16:06 . 2008-02-28 16:06 232 --ah----- C:\sqmdata06.sqm
2008-02-28 16:04 . 2008-02-28 16:04 244 --ah----- C:\sqmnoopt05.sqm
2008-02-28 16:04 . 2008-02-28 16:04 232 --ah----- C:\sqmdata05.sqm
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-21 21:15 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-21 21:15 --------- d-----w C:\Documents and Settings\Fero\Application Data\SUPERAntiSpyware.com
2008-03-21 20:05 --------- d-----w C:\Program Files\DC++
2008-03-21 18:39 --------- d-----w C:\Documents and Settings\Fero\Application Data\Skype
2008-03-20 14:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-20 14:19 --------- d-----w C:\Program Files\Oberon Media
2008-03-20 14:17 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-19 17:19 --------- d-----w C:\Program Files\LimeWire
2008-03-19 16:16 --------- d-----w C:\Program Files\ICQToolbar
2008-03-16 09:23 --------- d-----w C:\Program Files\XoftSpySE
2008-03-16 08:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-12 19:28 --------- d-----w C:\Program Files\PartyGaming
2008-03-02 10:16 --------- d-----w C:\Program Files\TV JOJ Media Player
2008-03-01 17:01 --------- d-----w C:\Program Files\Winamp
2008-03-01 16:43 --------- d-----w C:\Documents and Settings\Fero\Application Data\Nokia Multimedia Player
2008-03-01 16:42 --------- d-----w C:\Documents and Settings\Fero\Application Data\Nokia
2008-02-24 19:16 --------- d-----w C:\Program Files\Opera
2008-02-18 18:30 --------- d-----w C:\Program Files\Free Audio Pack
2008-02-18 18:05 663 ----a-w C:\Documents and Settings\Fero\Application Data\waver_2.95.dat
2008-02-13 12:02 --------- d-----w C:\Documents and Settings\Fero\Application Data\PC Suite
2008-02-13 12:00 --------- d-----w C:\Program Files\DIFX
2008-02-13 12:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Suite
2008-02-13 11:59 --------- d-----w C:\Program Files\Nokia
2008-02-13 11:59 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-02-13 11:59 --------- d-----w C:\Program Files\Common Files\Nokia
2008-02-13 11:58 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-02-13 11:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-02-09 17:08 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-09 16:58 691,545 ----a-w C:\WINDOWS\unins000.exe
2008-02-09 16:21 --------- d-----w C:\Program Files\ICQ6
2008-02-09 14:35 --------- d-----w C:\Documents and Settings\Fero\Application Data\InstallShield
2008-02-08 05:43 --------- d-----w C:\Program Files\ESET
2008-02-03 18:29 --------- d-----w C:\Program Files\Skype
2008-02-03 18:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-02-03 18:28 --------- d-----w C:\Program Files\Sygate
2008-02-01 07:42 --------- d-----w C:\Program Files\bwin
2008-01-23 10:19 --------- d-----w C:\Program Files\PokerStars
2007-12-30 17:27 284 ----a-w C:\Documents and Settings\Fero\Application Data\ViewerApp.dat
2007-12-23 17:18 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
2007-08-29 08:50 0 ----a-w C:\Program Files\Common Files\dht342126
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 14:42 77824 C:\WINDOWS\SOUNDMAN.EXE]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 14:43 45056]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-10-06 07:24 949376]
"avp"="C:\WINDOWS\system32\winver.exe" [2004-08-03 23:56 5632]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2005-03-05 21:09 2573536]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:56 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"{2C2766E8-0708-1051-0713-0505111701a5}"= "C:\Program Files\Common Files\{2C2766E8-0708-1051-0713-0505111701a5}\Update.exe" mc-110-12-0000272
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NkbMonitor.exe.lnk
backup=C:\WINDOWS\pss\NkbMonitor.exe.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
--a------ 2002-07-05 16:37 491008 C:\WINDOWS\mHotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive]
C:\WINDOWS\system32\drvnoh.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashGet]
--a------ 2007-06-29 12:44 1990704 C:\Program Files\FlashGet\FlashGet.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-09-13 15:49 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
C:\Program Files\ICQLite\ICQLite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]
C:\Program Files\Ipwindows\ipwins.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 2007-12-10 10:12 695808 C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\1.5.2\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-02-22 04:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2008-03-01 06:10 15872 C:\Program Files\Unlocker\UnlockerAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoipBuster]
C:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{2C2766E8-0707-1051-0713-0505111701a5}]
C:\Program Files\Common Files\{2C2766E8-0707-1051-0713-0505111701a5}\Update.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{2C2766E8-0708-1051-0713-0505111701a5}]
C:\Program Files\Common Files\{2C2766E8-0708-1051-0713-0505111701a5}\Update.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LiveUpdate"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\MC2\\Sniper Elite\\SniperElite.exe"=
"C:\\Program Files\\Ubisoft\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\FlashGet\\FlashGet.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Documents and Settings\\Fero\\Desktop\\Hry\\CS 1.6\\cstrike.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10044:TCP"= 10044:TCP:BitComet 10044 TCP
"10044:UDP"= 10044:UDP:BitComet 10044 UDP
"7140:TCP"= 7140:TCP:BitComet 7140 TCP
"7140:UDP"= 7140:UDP:BitComet 7140 UDP
R1 eusk2par;EUTRON SmartKey Parallel Driver;C:\WINDOWS\system32\Drivers\eusk2par.sys [2004-11-18 11:49]
R3 PD100VID;Video Blaster WebCam 5 (WDM);C:\WINDOWS\system32\DRIVERS\PD100Vid.sys [2002-06-04 14:51]
R3 PSched;QoS Packet Scheduler;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 22:04]
S2 Ca50xav;Philips ThumbCam Video Device;C:\WINDOWS\system32\Drivers\Ca50xav.sys [2002-10-20 20:37]
S3 AX88172;ASIX AX88172 USB2 to Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\ax88172.sys [2003-05-26 13:05]
S3 eusk3usb;SmartKey 3 USB;C:\WINDOWS\system32\Drivers\eusk3usb.sys [2004-11-18 11:49]
S3 NFWVAD_ds2dhw;NFW Virtual Audio;C:\WINDOWS\system32\drivers\nfwvad.sys [2007-10-16 15:20]
S3 SE2Ebus;Sony Ericsson Device 046 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE2Ebus.sys [2006-05-01 13:16]
S3 SE2Emdfl;Sony Ericsson Device 046 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE2Emdfl.sys [2006-05-01 13:17]
S3 SE2Emdm;Sony Ericsson Device 046 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE2Emdm.sys [2006-05-01 13:17]
S3 SE2Emgmt;Sony Ericsson Device 046 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE2Emgmt.sys [2006-05-01 13:18]
S3 SE2Eobex;Sony Ericsson Device 046 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE2Eobex.sys [2006-05-01 13:18]
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys []
S3 USBCamera;Philips ThumbCam Still Camera;C:\WINDOWS\system32\Drivers\Bulk50x.sys [2002-07-24 20:19]
.
Contents of the 'Scheduled Tasks' folder
"2008-03-21 22:51:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-03-21 23:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job"
- C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe
"2008-01-08 09:19:09 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-03-22 10:24:47
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
"ImagePath"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-03-22 10:27:57 - machine was rebooted [Fero]
ComboFix-quarantined-files.txt 2008-03-22 09:27:51
