ComboFix 08-03-14.4 - PC 2008-03-16 18:02:10.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.639 [GMT 1:00]
Running from: E:\Internet\Programy\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\win32.dll
.
((((((((((((((((((((((((( Files Created from 2008-02-16 to 2008-03-16 )))))))))))))))))))))))))))))))
.
2008-03-15 03:19 . 2008-03-15 03:19 <DIR> d-------- C:\Program Files\Dota Keys
2008-03-14 23:44 . 2008-03-16 02:44 <DIR> d-------- C:\Program Files\Garena
2008-03-14 23:44 . 2008-03-14 23:44 <DIR> d-------- C:\Documents and Settings\PC\Data aplikací\InstallShield
2008-03-14 23:44 . 2006-03-14 02:26 53,248 --a------ C:\WINDOWS\system32\ImageOle.dll
2008-03-14 21:45 . 2008-03-14 21:45 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-02 02:20 . 2008-03-02 02:20 <DIR> d-------- C:\Program Files\Ocean Technologies & Media
2008-02-29 01:54 . 2006-04-20 12:51 359,808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.old
2008-02-29 01:38 . 2008-02-29 01:38 <DIR> d-------- C:\Documents and Settings\PC\Data aplikací\TVU networks
2008-02-29 01:38 . 2008-02-29 01:38 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\TVU networks
2008-02-26 17:26 . 2008-02-26 17:26 <DIR> d--h----- C:\WINDOWS\PIF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-20 22:12 --------- d-----w C:\Program Files\Nero
2008-12-20 22:12 --------- d-----w C:\Program Files\Common Files\Ahead
2008-03-16 16:57 --------- d-----w C:\Documents and Settings\PC\Data aplikací\OpenOffice.org2
2008-03-16 15:28 --------- d-----w C:\Program Files\Valve
2008-03-16 14:16 --------- d-----w C:\Program Files\sXe Injected
2008-03-14 22:44 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-14 22:44 --------- d-----w C:\Program Files\ICQToolbar
2008-02-28 11:45 17,032,984 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-02-21 10:36 --------- d-----w C:\Program Files\ICQ6
2008-02-20 20:29 --------- d-----w C:\Documents and Settings\PC\Data aplikací\Skype
2008-02-17 19:33 --------- d-----w C:\Documents and Settings\PC\Data aplikací\ICQ
2008-01-01 17:45 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-11-25 00:16 3,393,024 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2007-10-19 04:38 69,229 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2007_10_18_21_11_02_small.dmp.zip
2007-10-19 04:38 68,303 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2007_10_18_21_10_56_small.dmp.zip
2007-09-05 14:11 885,248 ----a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2007-09-03 21:48 3,015,680 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2007-08-31 13:30 3,089,920 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2007-08-28 19:26 3,267,072 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2007-08-23 11:15 2,912,768 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2007-08-14 16:24 2,899,968 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2007-08-11 10:21 44,688 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2007_08_11_12_08_18_small.dmp.zip
2007-08-11 10:21 38,105 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2007_08_11_12_20_22_small.dmp.zip
2007-08-11 10:21 17,416,276 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_08_11_11_54_26_full.dmp.zip
2007-08-11 10:21 123,294 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_08_11_11_53_56_small.dmp.zip
2007-07-26 09:10 17,335,064 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_07_25_19_41_05_full.dmp.zip
2007-07-26 09:10 124,734 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_07_25_19_40_37_small.dmp.zip
2007-05-19 17:58 2,569,216 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2007-05-11 17:07 2,764,800 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2007-04-06 22:39 1,363,968 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
.
------- Sigcheck -------
2006-04-20 13:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2001-10-25 13:00 327168 e7774698bb0d14b0710a9a31e209f9b6 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-03 22:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2004-08-03 22:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
2006-04-20 12:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\system32\dllcache\tcpip.sys
2006-04-20 12:51 359808 de891ad282e856acfd40990094a63b6f C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 14:49 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-12-16 12:57 94208]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-06 19:52 68856]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-01-30 10:19 967168]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 10:22 7618560]
"nwiz"="nwiz.exe" [2006-06-01 10:22 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 10:22 86016 C:\WINDOWS\system32\nvmctray.dll]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 16:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-11-10 10:14 15473664 C:\WINDOWS\RTHDCPL.exe]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24 32768]
"RAM Idle Professional"="C:\Program Files\RAM Idle\RAM_XP.exe" [2004-06-11 15:28 133632]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"KAVPersonal50"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" [2004-07-27 12:38 127079]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-08 23:02 919280]
"QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" [2007-08-23 17:27 282624]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-05-28 10:14 528384]
"netmon.exe"="C:\Program Files\netmon\netmon.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-17 14:49 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\BORGChat\\BORGChat.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
R1 Klmc;Klmc;C:\WINDOWS\system32\drivers\klmc.sys [2004-06-27 15:16]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 22:04]
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-05-11 12:12]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-05-11 12:12]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-05-11 12:12]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-05-11 12:12]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-05-11 12:12]
S3 s716bus;Sony Ericsson Device 716 driver (WDM);C:\WINDOWS\system32\DRIVERS\s716bus.sys [2007-06-29 09:59]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s716mdfl.sys [2007-06-29 09:59]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s716mdm.sys [2007-06-29 09:59]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s716mgmt.sys [2007-06-29 09:59]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);C:\WINDOWS\system32\DRIVERS\s716nd5.sys [2007-06-29 09:59]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s716obex.sys [2007-06-29 09:59]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);C:\WINDOWS\system32\DRIVERS\s716unic.sys [2007-06-29 09:59]
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 08:42]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 08:42]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 08:42]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 08:42]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 08:42]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c4c31fc-53de-11dc-b274-0016e6624aba}]
\Shell\AutoRun\command - EXPLORER.EXE
\Shell\explore\Command - EXPLORER.EXE
\Shell\open\Command - EXPLORER.EXE
*Newly Created Service* - DDSXEISERVICE
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-03-16 18:04:26
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 2498
**************************************************************************
.
Completion time: 2008-03-16 18:05:18
ComboFix-quarantined-files.txt 2008-03-16 17:05:03
