Tady to je.
ComboFix 10-01-04.01 - Michal 07.01.2010 20:56:52.2.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1250.420.1029.18.3582.2735 [GMT 1:00]
Spuštěný z: c:\users\Michal\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Michal\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
FILE ::
"c:\windows\system32\ezsidmv.dat"
"c:\windows\system32\kea.dll"
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\ezsidmv.dat
c:\windows\system32\kea.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-07 do 2010-01-07 )))))))))))))))))))))))))))))))
.
2010-01-07 20:03 . 2010-01-07 20:04 -------- d-----w- c:\users\Michal\AppData\Local\temp
2010-01-07 20:03 . 2010-01-07 20:03 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-01-07 20:03 . 2010-01-07 20:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-07 20:03 . 2010-01-07 20:03 -------- d-----w- c:\users\all users.windows\AppData\Local\temp
2010-01-07 18:29 . 2010-01-07 18:29 -------- d-----w- c:\programdata\McAfee Security Scan
2010-01-07 18:29 . 2010-01-07 18:29 -------- d-----w- c:\program files\McAfee Security Scan
2010-01-05 17:06 . 2010-01-05 17:06 -------- d-----w- c:\program files\Trend Micro
2010-01-03 08:25 . 2010-01-06 18:31 -------- d-----w- C:\Filmy
2009-12-15 00:21 . 2009-12-15 00:21 5144576 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2009-12-14 23:47 . 2009-12-14 23:47 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-12-14 23:47 . 2009-12-14 23:47 368640 ----a-w- c:\windows\system32\atieclxx.exe
2009-12-14 23:46 . 2009-12-14 23:46 172032 ----a-w- c:\windows\system32\atiesrxx.exe
2009-12-14 23:45 . 2009-12-14 23:45 274432 ----a-w- c:\windows\system32\Oemdspif.dll
2009-12-14 23:44 . 2009-12-14 23:44 11776 ----a-w- c:\windows\system32\atimuixx.dll
2009-12-14 23:44 . 2009-12-14 23:44 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-12-14 23:41 . 2009-12-14 23:41 3056640 ----a-w- c:\windows\system32\atidxx32.dll
2009-12-14 23:13 . 2009-12-14 23:13 13487616 ----a-w- c:\windows\system32\atioglxx.dll
2009-12-14 22:55 . 2009-12-14 22:55 52224 ----a-w- c:\windows\system32\atimpc32.dll
2009-12-14 22:55 . 2009-12-14 22:55 52224 ----a-w- c:\windows\system32\amdpcom32.dll
2009-12-14 22:54 . 2009-12-14 22:54 225280 ----a-w- c:\windows\system32\atiadlxx.dll
2009-12-14 22:50 . 2009-12-14 22:50 53248 ----a-w- c:\windows\system32\aticalrt.dll
2009-12-14 22:49 . 2009-12-14 22:49 53248 ----a-w- c:\windows\system32\aticalcl.dll
2009-12-14 22:48 . 2009-12-14 22:48 3629056 ----a-w- c:\windows\system32\aticaldd.dll
2009-12-14 22:39 . 2009-12-14 22:39 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-07 20:05 . 2009-07-13 10:40 -------- d-----w- c:\program files\Steam
2010-01-07 19:59 . 2007-01-08 21:10 610548 ----a-w- c:\windows\system32\perfh005.dat
2010-01-07 19:59 . 2007-01-08 21:10 120950 ----a-w- c:\windows\system32\perfc005.dat
2010-01-07 19:31 . 2009-11-21 11:20 -------- d-----w- c:\program files\Mozilla Firefox 3.6 Beta 1
2010-01-02 09:43 . 2009-11-13 14:40 -------- d-----w- c:\programdata\BioWare
2010-01-02 09:33 . 2009-07-07 14:19 -------- d-----w- c:\programdata\Media Center Programs
2010-01-02 09:33 . 2009-11-13 14:13 -------- d-----w- c:\program files\Common Files\BioWare
2010-01-02 09:15 . 2009-07-02 14:33 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-14 23:45 . 2009-05-16 03:22 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2009-12-14 23:45 . 2009-05-16 03:22 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2009-12-14 23:25 . 2009-05-16 03:08 3618304 ----a-w- c:\windows\system32\atiumdag.dll
2009-12-14 23:07 . 2009-11-25 02:37 2902016 ----a-w- c:\windows\system32\atiumdva.dll
2009-12-01 20:30 . 2009-07-13 10:40 -------- d-----w- c:\program files\Common Files\Steam
2009-12-01 15:53 . 2009-07-01 18:56 -------- d-----w- c:\program files\SpeedFan
2009-11-21 14:21 . 2009-11-21 14:10 31112 ----a-w- c:\windows\DIIUnin.dat
2009-11-21 14:10 . 2009-11-21 14:10 94208 ----a-w- c:\windows\DIIUnin.exe
2009-11-21 14:10 . 2009-11-21 14:10 2829 ----a-w- c:\windows\DIIUnin.pif
2009-11-21 08:24 . 2009-11-21 08:23 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2009-11-21 07:35 . 2009-11-21 07:35 -------- d-----w- c:\program files\GamePark
2009-11-17 11:15 . 2009-09-17 09:52 -------- d-----w- c:\users\Michal\AppData\Roaming\Ubisoft
2009-11-15 18:55 . 2009-11-15 18:55 -------- d-----w- c:\users\Michal\AppData\Roaming\PeerNetworking
2009-11-15 17:28 . 2009-07-01 19:28 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-14 20:22 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-11-13 20:20 . 2009-11-13 20:20 -------- d-----w- c:\program files\Software602
2009-11-06 09:59 . 2009-11-06 09:59 15406728 ----a-w- c:\windows\system32\xlive.dll
2009-11-06 09:59 . 2009-11-06 09:59 13642888 ----a-w- c:\windows\system32\xlivefnt.dll
2009-11-05 20:34 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-02 17:05 . 2009-11-02 17:05 167064 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-02 17:05 . 2009-11-02 17:05 71832 ----a-w- c:\windows\system32\xliveinstallhost.exe
2009-10-29 09:17 . 2008-11-07 13:26 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-22 15:59 . 2009-10-22 15:59 196565 ----a-w- c:\windows\system32\atiicdxx.dat
2009-10-17 12:39 . 2009-10-17 12:39 28160 ---h--w- c:\users\Michal\pgqkkue.exe
2009-10-16 10:19 . 2008-11-08 14:21 872448 ----a-w- c:\windows\system32\rapture3d_oal.dll
2009-10-15 11:44 . 2008-11-08 14:20 809560 ----a-r- c:\windows\system32\tmp3229.tmp
2009-10-15 11:44 . 2008-11-08 14:18 809560 ----a-r- c:\windows\system32\tmp31EA.tmp
2009-07-31 18:00 . 2009-07-31 18:00 21133528 ----a-w- c:\program files\DivXInstaller.exe
2009-07-17 19:33 . 2009-07-17 19:33 1914000 ----a-w- c:\program files\install_flash_player_10_active_x.exe
2009-02-14 11:35 . 2009-11-08 12:39 25244 ----a-w- c:\program files\608 - Red Hot Catholic Love.srt
2009-05-13 21:55 . 2009-05-13 21:55 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-13 21:55 . 2009-05-13 21:55 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2008-04-02 15:00 . 2008-04-02 14:45 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Steam"="c:\program files\steam\steam.exe" [2009-10-24 1217808]
"RGSC"="c:\games\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe" [2009-07-27 306088]
"AtiTrayTools"="c:\program files\Ray Adams\ATI Tray Tools\atitray.exe" [2009-07-28 663040]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-04-02 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-04-02 1008184]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.24\RivaTunerWrapper.exe" [2009-02-25 24576]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"RefreshLock"="c:\users\Michal\Desktop\RefreshLock.exe" [2003-10-15 193536]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2007-05-04 36864]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-14 98304]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"VistaSp2"=hex(b):73,64,39,29,22,ff,c9,01
R1 atitray;atitray;c:\program files\Ray Adams\ATI Tray Tools\atitray.sys [8.9.2008 18:32 18336]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\System32\atiesrxx.exe [15.12.2009 0:46 172032]
R2 lxbk_device;lxbk_device;c:\windows\system32\lxbkcoms.exe -service --> c:\windows\system32\lxbkcoms.exe -service [?]
R2 nxsIO32;NextSensor Kernel I/O Driver;c:\windows\System32\drivers\nxsIO32.sys [2.7.2009 16:57 2208]
S3 DAUpdaterSvc;Dragon Age: Prameny - aktualizace obsahu;c:\games\Dragon Age\bin_ship\daupdatersvc.service.exe [2.1.2010 10:27 25832]
S3 FontCache;Mezipaměť písem Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2.4.2008 15:56 21504]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Doplňkový sken -------
.
uDefault_Search_URL =
hxxp://www.google.com/ieuInternet Settings,ProxyOverride = *.local
uSearchAssistant =
hxxp://www.google.com/ieuSearchURL,(Default) =
hxxp://www.google.com/search?q=%s
FF - ProfilePath - c:\users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\pq2flc6j.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - prefs.js: keyword.URL -
hxxp://search.qip.ru/search?from=FF&query=FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
BHO-{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
**************************************************************************
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory:
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\users\Michal\AppData\Local\Temp\GYN1F43.tmp"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-21-3756572211-745874398-884327106-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:02,73,d9,11,d4,7d,67,4c,8d,c0,a2,07,2e,ed,44,ec,f3,19,50,b6,9a,84,99,
00,f2,bd,46,50,37,df,52,c6,c5,59,d3,59,73,88,ed,b4,d4,fa,f1,d7,88,76,10,a9,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50
[HKEY_USERS\S-1-5-21-3756572211-745874398-884327106-1000\Software\SecuROM\License information*]
"datasecu"=hex:db,8f,97,d9,00,b9,34,60,08,fa,c8,b4,dd,60,8d,1a,fb,e2,af,2a,08,
af,b3,6e,e0,24,f3,b2,fe,6f,1e,3d,0b,85,01,e8,ce,b4,18,59,ee,5f,e7,67,e5,74,\
"rkeysecu"=hex:96,df,75,d1,14,35,48,1d,20,81,53,6c,2a,c4,a8,53
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:c4,81,49,57,91,22,c1,89,e6,ed,cf,8d,dc,35,3e,88,c0,5a,b7,99,b0,
80,43,19,4b,48,ac,07,c1,30,fa,22,32,44,00,75,1a,3d,8b,48,10,48,5e,58,4c,0b,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:c4,81,49,57,91,22,c1,89,e6,ed,cf,8d,dc,35,3e,88,c0,5a,b7,99,b0,
80,43,19,4b,48,ac,07,c1,30,fa,22,32,44,00,75,1a,3d,8b,48,10,48,5e,58,4c,0b,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'Explorer.exe'(3484)
c:\program files\Ray Adams\ATI Tray Tools\raphook.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\lxbkcoms.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\conime.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\WerFault.exe
c:\games\GTA IV\Rockstar Games Social Club\1_1_3_0\RGSC.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Mozilla Firefox 3.6 Beta 1\firefox.exe
.
**************************************************************************
.
Celkový čas: 2010-01-07 21:12:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-07 20:12
ComboFix2.txt 2010-01-05 17:29
Před spuštěním: 2 115 674 112
Po spuštění: 1 976 487 936
Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,5
- - End Of File - - 8922A8A04EFB35F85474558414F2E4E9
Zítra se snad k tomu dostanu.
