ComboFix 15-03-23.01 - DOMA 24.03.2015 14:03:50.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.4048.2942 [GMT 1:00]
Spuštěný z: c:\users\DOMA\Desktop\ComboFix.exe
AV: ESET Smart Security 8.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
FW: ESET Personální firewall *Disabled* {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
SP: ESET Smart Security 8.0 *Disabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\DOMA\AppData\Roaming\inst.exe
c:\windows\IsUn0405.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-02-24 do 2015-03-24 )))))))))))))))))))))))))))))))
.
.
2015-03-23 16:34 . 2014-02-13 22:59 24064 ----a-w- c:\windows\zoek-delete.exe
2015-03-23 16:20 . 2015-03-23 16:31 -------- d-----w- C:\zoek_backup
2015-03-23 06:09 . 2015-03-23 06:09 -------- d-----w- c:\users\DOMA\AppData\Local\Adobe
2015-03-21 17:08 . 2015-03-21 17:26 -------- d-----w- c:\programdata\RogueKiller
2015-03-21 16:53 . 2015-03-21 16:55 -------- d-----w- C:\AdwCleaner
2015-03-13 12:27 . 2015-03-13 15:19 -------- d-----w- c:\program files (x86)\VSO
2015-03-12 12:19 . 2015-02-03 03:31 1424896 ----a-w- c:\windows\system32\WindowsCodecs.dll
2015-03-12 12:16 . 2015-02-04 03:16 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2015-03-12 12:16 . 2015-02-04 02:54 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2015-03-10 15:22 . 2015-01-29 09:07 11910896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5A4055EB-57A6-4343-BC22-4B7A5334F4F2}\mpengine.dll
2015-03-05 17:04 . 2015-03-05 17:04 -------- d-----w- c:\users\DOMA\AppData\Local\ESET
2015-02-27 23:59 . 2015-03-23 16:40 169584 ----a-w- c:\program files (x86)\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll
2015-02-27 23:59 . 2015-02-27 23:59 970912 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr120.dll
2015-02-27 23:59 . 2015-02-27 23:59 455328 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp120.dll
2015-02-27 23:59 . 2015-02-27 23:59 3466856 ----a-w- c:\program files (x86)\Mozilla Firefox\d3dcompiler_47.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-03-23 16:11 . 2014-09-29 16:15 37624 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-03-13 15:27 . 2014-01-06 15:43 82816 ----a-w- c:\users\DOMA\AppData\Roaming\pcouffin.sys
2015-03-06 05:42 . 2015-03-12 12:19 341504 ----a-w- c:\windows\system32\schannel.dll
2015-03-06 05:10 . 2015-03-12 12:19 248832 ----a-w- c:\windows\SysWow64\schannel.dll
2015-03-02 09:21 . 2014-10-18 17:49 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-02-24 03:17 . 2013-07-17 10:54 295552 ------w- c:\windows\system32\MpSigStub.exe
2015-02-18 09:56 . 2015-02-18 09:56 6295288 ----a-w- c:\windows\SysWow64\nvopencl.dll
2015-02-18 09:55 . 2015-02-18 09:55 7639952 ----a-w- c:\windows\system32\nvopencl.dll
2015-02-18 09:55 . 2015-02-18 09:55 26341704 ----a-w- c:\windows\system32\nvoglv64.dll
2015-02-18 09:55 . 2015-02-18 09:55 19916432 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2015-02-18 09:55 . 2015-02-18 09:55 13585736 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2015-02-18 09:55 . 2015-02-18 09:55 1510728 ----a-w- c:\windows\system32\nvdispgenco6430908.dll
2015-02-18 09:55 . 2015-02-18 09:55 1801544 ----a-w- c:\windows\system32\nvdispco6430908.dll
2015-02-18 09:55 . 2009-07-13 21:59 18320440 ----a-w- c:\windows\system32\nvd3dumx.dll
2015-02-18 09:55 . 2015-02-18 09:55 2748232 ----a-w- c:\windows\system32\nvcuvid.dll
2015-02-18 09:55 . 2015-02-18 09:55 2576200 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2015-02-18 09:55 . 2013-02-19 20:32 15373568 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2015-02-18 09:55 . 2015-02-18 09:55 9185504 ----a-w- c:\windows\system32\nvcuda.dll
2015-02-18 09:55 . 2015-02-18 09:55 7755632 ----a-w- c:\windows\SysWow64\nvcuda.dll
2015-02-18 09:55 . 2015-02-18 09:55 2220176 ----a-w- c:\windows\system32\nvcuvenc.dll
2015-02-18 09:55 . 2015-02-18 09:55 1868104 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2015-02-18 09:55 . 2015-02-18 09:55 17559184 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2015-02-18 09:55 . 2015-02-18 09:55 25255568 ----a-w- c:\windows\system32\nvcompiler.dll
2015-02-18 09:55 . 2015-02-18 09:55 2447000 ----a-w- c:\windows\SysWow64\nvapi.dll
2015-02-18 09:55 . 2013-02-19 20:32 2753952 ----a-w- c:\windows\system32\nvapi64.dll
2015-02-17 14:19 . 2015-02-17 14:19 1614496 ----a-w- c:\windows\system32\FM20.DLL
2015-02-13 09:11 . 2013-07-17 17:06 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-02-13 09:11 . 2013-07-17 17:06 701616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-02-04 03:16 . 2015-02-11 14:51 609280 ----a-w- c:\windows\system32\generaltel.dll
2015-02-04 03:16 . 2015-02-11 14:51 762368 ----a-w- c:\windows\system32\invagent.dll
2015-02-04 03:16 . 2015-02-11 14:51 414720 ----a-w- c:\windows\system32\devinv.dll
2015-02-04 03:16 . 2015-02-11 14:51 894976 ----a-w- c:\windows\system32\appraiser.dll
2015-02-04 03:16 . 2015-02-11 14:51 227328 ----a-w- c:\windows\system32\aepdu.dll
2015-02-04 03:16 . 2015-02-11 14:51 192000 ----a-w- c:\windows\system32\aepic.dll
2015-02-04 03:13 . 2015-02-11 14:51 1098752 ----a-w- c:\windows\system32\aeinv.dll
2015-01-31 00:57 . 2013-07-16 09:27 6223680 ----a-w- c:\windows\system32\nvcpl.dll
2015-01-31 00:57 . 2013-07-16 09:27 3299472 ----a-w- c:\windows\system32\nvsvc64.dll
2015-01-31 00:57 . 2013-07-16 09:27 878400 ----a-w- c:\windows\system32\nvvsvc.exe
2015-01-31 00:57 . 2013-07-16 09:27 62792 ----a-w- c:\windows\system32\nvshext.dll
2015-01-31 00:57 . 2013-07-16 09:27 2558272 ----a-w- c:\windows\system32\nvsvcr.dll
2015-01-31 00:57 . 2013-07-16 09:27 117392 ----a-w- c:\windows\system32\nvmctray.dll
2015-01-27 23:36 . 2015-02-11 14:51 1239720 ----a-w- c:\windows\system32\aitstatic.exe
2015-01-26 23:23 . 2015-01-26 23:23 14464 ----a-w- c:\windows\system32\drivers\wdcsam64.sys
2015-01-09 03:14 . 2015-02-11 15:42 91136 ----a-w- c:\windows\system32\wdi.dll
2015-01-09 03:14 . 2015-02-11 15:42 950272 ----a-w- c:\windows\system32\perftrack.dll
2015-01-09 03:14 . 2015-02-11 15:42 29696 ----a-w- c:\windows\system32\powertracker.dll
2015-01-09 02:48 . 2015-02-11 15:42 76800 ----a-w- c:\windows\SysWow64\wdi.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2010-11-20 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\erdnt\cache64\user32.dll
[7] 2010-11-20 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
[7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[-] 2010-11-20 . E573BD9AB55C8E333C202B9E255F972E . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll
.
[-] 2014-10-04 . 2C9CC9F492CA596B1B9FC1AE5E916356 . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\erdnt\cache86\user32.dll
[7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 Garmin Core Update Service;Garmin Core Update Service;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys;c:\windows\SYSNATIVE\DRIVERS\revoflt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
R4 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe;c:\windows\SYSNATIVE\viakaraokesrv.exe [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 t_mouse.sys;HID-compliand device;c:\windows\system32\DRIVERS\t_mouse.sys;c:\windows\SYSNATIVE\DRIVERS\t_mouse.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-03-21 18:06 1061704 ----a-w- c:\program files (x86)\Google\Chrome\Application\41.0.2272.101\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2015-03-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-11-18 16:08]
.
2015-03-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA1cf6c6fe86010bb.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-11-18 16:08]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2014-10-01 5595336]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 213.46.172.37 213.46.172.36
FF - ProfilePath - c:\users\DOMA\AppData\Roaming\Mozilla\Firefox\Profiles\omtt2d0x.default-1413530589483\
FF - prefs.js: browser.startup.homepage -
hxxps://www.seznam.cz/.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-10 - (no file)
AddRemove-{714dc1e5-69a4-4ecd-9552-93397e084298} - c:\programdata\Package Cache\{714dc1e5-69a4-4ecd-9552-93397e084298}\GarminExpressInstaller.exe
AddRemove-{ce085a78-074e-4823-8dc1-8a721b94b76d} - c:\programdata\Package Cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2015-03-24 14:11:12
ComboFix-quarantined-files.txt 2015-03-24 13:11
.
Před spuštěním: Volných bajtů: 367 472 447 488
Po spuštění: Volných bajtů: 367 169 060 864
.
- - End Of File - - 37E365628F753AFC4A1705B349200EFD
A36C5E4F47E84449FF07ED3517B43A31