ComboFix 12-07-31.03 - Miroslav 02.08.2012 17:45:45.2.1 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.1280.609 [GMT 2:00]
Spuštěný z: c:\users\Miroslav\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Miroslav\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1445107617-2002140488-3262147951-1001Core.job"
"c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1445107617-2002140488-3262147951-1001UA.job"
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-07-02 do 2012-08-02 )))))))))))))))))))))))))))))))
.
.
2012-08-02 16:06 . 2012-08-02 16:06 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-02 15:29 . 2012-08-02 15:29 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B01B73CB-806A-48EB-82D3-98AE2B84164D}\MpKsl307cf3a4.sys
2012-08-02 13:27 . 2012-08-02 13:27 -------- d-----w- c:\users\Marketka
2012-08-02 06:48 . 2012-07-16 00:41 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B01B73CB-806A-48EB-82D3-98AE2B84164D}\mpengine.dll
2012-08-01 18:46 . 2012-08-01 18:46 -------- d-----w- C:\ifx
2012-08-01 18:46 . 2010-05-12 01:23 16896 ----a-w- c:\windows\system32\drivers\FlashUSB.sys
2012-08-01 18:43 . 2012-03-02 14:03 25216 ----a-w- c:\windows\system32\drivers\lgusbmodem.sys
2012-08-01 18:43 . 2012-03-02 14:03 20864 ----a-w- c:\windows\system32\drivers\lgusbdiag.sys
2012-08-01 18:43 . 2012-03-02 14:03 13056 ----a-w- c:\windows\system32\drivers\lgusbbus.sys
2012-08-01 18:40 . 2012-08-01 18:40 -------- d-----w- C:\LG_USB
2012-08-01 18:01 . 2009-10-19 19:49 1164728 ----a-w- c:\windows\system32\NMSDVDXU.dll
2012-08-01 18:01 . 2009-05-22 11:26 419240 ----a-w- c:\windows\system32\Vsflex7L.ocx
2012-08-01 18:01 . 2009-05-22 11:26 244416 ----a-w- c:\windows\system32\Msflxgrd.ocx
2012-08-01 18:01 . 2009-05-22 11:26 630784 ----a-w- c:\windows\system32\vsflex8u.ocx
2012-08-01 17:58 . 2011-05-10 11:37 655872 ----a-w- c:\windows\system32\msvcr90.dll
2012-08-01 17:58 . 2011-05-10 11:37 568832 ----a-w- c:\windows\system32\msvcp90.dll
2012-08-01 17:58 . 2011-05-10 11:37 224768 ----a-w- c:\windows\system32\msvcm90.dll
2012-08-01 17:58 . 2006-05-04 06:33 53248 ----a-w- c:\windows\system32\CommonDL.dll
2012-08-01 17:58 . 2005-11-24 00:34 82432 ----a-w- c:\windows\system32\msxml4r.dll
2012-08-01 17:58 . 2005-10-03 23:39 44544 ----a-w- c:\windows\system32\msxml4a.dll
2012-08-01 17:58 . 2005-09-11 12:51 1233920 ----a-w- c:\windows\system32\msxml4.dll
2012-08-01 17:58 . 2012-08-01 17:59 -------- d-----w- c:\programdata\LGMOBILEAX
2012-08-01 17:56 . 2012-08-01 18:43 -------- d-----w- c:\program files\LG Electronics
2012-08-01 16:14 . 2012-07-16 00:41 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-07-31 20:18 . 2012-07-31 20:18 -------- d-----w- c:\program files\Microsoft SkyDrive
2012-07-31 20:15 . 2012-07-31 20:15 -------- d-----w- c:\programdata\Microsoft SkyDrive
2012-07-30 17:38 . 2012-07-30 17:39 -------- d-----w- c:\program files\CrystalDiskInfo
2012-07-30 17:33 . 2012-07-30 17:33 -------- d-----w- c:\programdata\Malwarebytes
2012-07-30 17:32 . 2012-07-03 11:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-30 17:32 . 2012-07-30 17:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-07-30 16:51 . 2012-07-30 16:51 -------- d-----w- c:\program files\Trend Micro
2012-07-30 16:30 . 2012-07-30 16:30 -------- d-----w- c:\program files\Verdict Free
2012-07-29 12:01 . 2012-07-29 12:01 -------- d-----w- c:\program files\Lavalys
2012-07-28 20:15 . 2012-07-28 20:16 -------- d-----w- c:\program files\7-Zip
2012-07-28 10:16 . 2012-07-28 10:16 -------- d-----w- c:\windows\system32\SPReview
2012-07-28 10:14 . 2012-07-28 10:14 -------- d-----w- c:\windows\system32\EventProviders
2012-07-28 10:03 . 2012-07-28 10:03 304 ----a-w- C:\user.js
2012-07-28 10:02 . 2012-07-28 10:33 -------- d-----w- c:\program files\hpmonitor
2012-07-28 10:00 . 2012-07-28 10:00 -------- d-----w- c:\programdata\Babylon
2012-07-28 09:59 . 1998-06-23 23:00 137000 ----a-w- c:\windows\system32\MSMAPI32.OCX
2012-07-28 09:59 . 2004-03-08 23:00 662288 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2012-07-28 09:59 . 2012-03-14 16:23 54784 ----a-w- c:\windows\system32\pdfcmon.dll
2012-07-28 09:59 . 1998-07-05 23:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2012-07-28 09:59 . 2012-07-28 10:05 -------- d-----w- c:\program files\PDFCreator
2012-07-28 08:32 . 2012-07-28 08:32 -------- d-----w- c:\program files\Elaborate Bytes
2012-07-28 08:09 . 2011-02-19 06:30 805376 ----a-w- c:\windows\system32\FntCache.dll
2012-07-28 08:09 . 2011-02-19 06:30 739840 ----a-w- c:\windows\system32\d2d1.dll
2012-07-27 18:34 . 2012-07-27 18:34 -------- d-----w- c:\program files\Mozilla Thunderbird
2012-07-27 17:51 . 2012-07-27 17:51 -------- d-----w- c:\program files\CCleaner
2012-07-27 01:42 . 2012-07-27 06:27 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-27 01:42 . 2012-07-27 06:27 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-26 21:21 . 2012-07-26 21:21 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2012-07-26 19:30 . 2012-07-26 19:30 -------- d-----w- c:\program files\KYE
2012-07-26 19:30 . 2012-07-26 19:30 -------- d-----w- c:\windows\Album
2012-07-26 19:30 . 2002-07-03 09:44 53248 ----a-w- c:\windows\amcap.exe
2012-07-26 19:28 . 2004-06-10 09:54 286720 ----a-w- c:\windows\vsnpstd2.exe
2012-07-26 19:28 . 2003-04-21 12:09 245408 ----a-w- c:\windows\system32\unicows.dll
2012-07-26 19:28 . 2004-06-08 16:25 53248 ----a-w- c:\windows\system32\dsnpstd2.dll
2012-07-26 19:26 . 2004-07-28 09:49 334080 ----a-w- c:\windows\system32\drivers\snpstd2.sys
2012-07-26 19:26 . 2004-06-08 16:56 40960 ----a-w- c:\windows\system32\rsnpstd2.dll
2012-07-26 19:26 . 2004-02-16 11:59 61440 ----a-w- c:\windows\system32\csnpstd2.dll
2012-07-26 19:26 . 2004-06-08 16:57 36864 ----a-w- c:\windows\system32\vsnpstd2.dll
2012-07-26 19:26 . 2004-06-08 16:57 36864 ----a-w- c:\windows\system32\dsnpstd2.ax
2012-07-26 19:25 . 2004-06-09 14:00 20480 ----a-w- c:\windows\usnpstd2.exe
2012-07-26 19:25 . 2012-07-26 19:28 -------- d-----w- c:\program files\Common Files\snpstd2
2012-07-26 19:23 . 2012-07-28 09:17 -------- d-----w- c:\program files\Common Files\InstallShield
2012-07-26 19:15 . 2012-07-28 07:54 -------- d-----w- c:\program files\Microsoft Silverlight
2012-07-26 19:14 . 2012-07-26 19:14 -------- dc----w- c:\windows\system32\DRVSTORE
2012-07-26 19:14 . 2010-04-28 05:44 54632 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2012-07-26 19:03 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2012-07-26 19:01 . 2012-07-26 19:01 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2012-07-26 19:01 . 2010-11-05 01:58 1130824 ----a-w- c:\windows\system32\dfshim.dll
2012-07-26 18:59 . 2010-11-20 12:20 9166336 ----a-w- c:\program files\DVD Maker\OmdBase.dll
2012-07-26 18:58 . 2010-11-20 12:21 381440 ----a-w- c:\windows\system32\wer.dll
2012-07-26 18:57 . 2010-11-20 12:18 494592 ----a-w- c:\windows\system32\BFE.DLL
2012-07-26 18:56 . 2010-11-20 12:18 321536 ----a-w- c:\windows\system32\aepdu.dll
2012-07-26 18:55 . 2010-11-20 12:36 1077248 ----a-w- c:\windows\system32\Narrator.exe
2012-07-26 18:54 . 2010-11-20 12:16 692736 ----a-w- c:\windows\system32\bthprops.cpl
2012-07-26 18:53 . 2010-11-20 12:21 541184 ----a-w- c:\windows\system32\WMVSDECD.DLL
2012-07-26 18:52 . 2010-11-20 12:21 4096 ----a-w- c:\windows\system32\dxmasf.dll
2012-07-26 18:51 . 2010-11-20 12:21 363008 ----a-w- c:\windows\system32\wbemcomn.dll
2012-07-26 18:51 . 2010-11-20 12:19 606208 ----a-w- c:\windows\system32\wbem\fastprox.dll
2012-07-26 18:47 . 2012-07-26 18:47 -------- d-----w- c:\program files\Common Files\Windows Live
2012-07-26 17:16 . 2012-07-26 17:16 -------- d-----w- c:\program files\Common Files\Skype
2012-07-26 17:16 . 2012-07-26 17:16 -------- d-----r- c:\program files\Skype
2012-07-26 17:14 . 2012-07-26 18:07 -------- d-----w- c:\programdata\Skype
2012-07-26 17:08 . 2012-07-26 17:11 -------- d-----w- c:\program files\QIP 2012
2012-07-26 15:30 . 2011-03-25 02:58 284672 ----a-w- c:\windows\system32\drivers\usbport.sys
2012-07-26 15:30 . 2011-03-25 02:57 43008 ----a-w- c:\windows\system32\drivers\usbehci.sys
2012-07-26 15:30 . 2011-03-25 02:58 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys
2012-07-26 15:29 . 2011-03-25 02:58 75776 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2012-07-26 15:29 . 2011-03-25 02:57 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2012-07-26 15:29 . 2011-03-25 02:57 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys
2012-07-26 15:29 . 2011-03-25 02:57 5888 ----a-w- c:\windows\system32\drivers\usbd.sys
2012-07-26 15:28 . 2011-03-11 05:33 1699328 ----a-w- c:\windows\system32\esent.dll
2012-07-26 15:28 . 2011-03-11 05:39 143744 ----a-w- c:\windows\system32\drivers\nvstor.sys
2012-07-26 15:28 . 2011-03-11 05:39 1211264 ----a-w- c:\windows\system32\drivers\ntfs.sys
2012-07-26 15:28 . 2011-03-11 05:39 117120 ----a-w- c:\windows\system32\drivers\nvraid.sys
2012-07-26 15:28 . 2011-03-11 05:39 148864 ----a-w- c:\windows\system32\drivers\storport.sys
2012-07-26 15:28 . 2011-03-11 05:38 332160 ----a-w- c:\windows\system32\drivers\iaStorV.sys
2012-07-26 15:28 . 2011-03-11 05:38 80256 ----a-w- c:\windows\system32\drivers\amdsata.sys
2012-07-26 15:28 . 2011-03-11 05:38 22400 ----a-w- c:\windows\system32\drivers\amdxata.sys
2012-07-26 15:28 . 2011-03-11 05:31 74240 ----a-w- c:\windows\system32\fsutil.exe
2012-07-26 15:26 . 2011-04-28 03:15 393728 ----a-w- c:\windows\system32\drivers\bthport.sys
2012-07-26 15:26 . 2011-04-28 03:15 60416 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS
2012-07-26 15:26 . 2010-11-20 12:17 219648 ----a-w- c:\windows\system32\fsquirt.exe
2012-07-26 07:37 . 2012-07-26 07:37 -------- d-----w- c:\windows\system32\Wat
2012-07-26 02:39 . 2012-07-27 17:56 -------- d-----w- c:\windows\Panther
2012-07-26 01:21 . 2012-06-12 02:40 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-07-26 01:19 . 2012-03-01 05:46 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-07-26 01:19 . 2012-03-01 05:29 5120 ----a-w- c:\windows\system32\wmi.dll
2012-07-26 01:19 . 2012-03-01 05:37 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-07-26 01:19 . 2012-03-01 05:33 159232 ----a-w- c:\windows\system32\imagehlp.dll
2012-07-26 01:18 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2012-07-25 22:54 . 2012-08-01 17:56 -------- d--h--w- c:\program files\InstallShield Installation Information
2012-07-25 22:52 . 2012-07-25 22:53 -------- d-----w- c:\program files\IrfanView
2012-07-25 22:51 . 2012-07-26 18:24 -------- d-----w- c:\program files\ICQ7.7
2012-07-25 22:40 . 2011-10-26 04:28 38912 ----a-w- c:\windows\system32\csrsrv.dll
2012-07-25 22:40 . 2012-04-07 11:26 2342400 ----a-w- c:\windows\system32\msi.dll
2012-07-25 22:39 . 2011-04-29 02:46 311808 ----a-w- c:\windows\system32\drivers\srv.sys
2012-07-25 22:39 . 2011-04-29 02:46 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
2012-07-25 22:39 . 2011-04-29 02:46 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys
2012-07-25 22:39 . 2011-04-25 02:18 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2012-07-25 22:39 . 2011-11-17 05:38 1288472 ----a-w- c:\windows\system32\ntdll.dll
2012-07-25 22:38 . 2011-03-03 05:38 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-28 10:50 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-07-25 17:34 . 2012-07-25 17:34 203776 ----a-w- c:\windows\system32\webcheck.dll
2012-07-14 00:15 . 2012-07-25 18:18 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\windows\Album ----
.
2012-07-26 19:30 . 2003-08-06 16:18 39462 ----a-w- c:\windows\Album\Music\Space Alarm.wav
2012-07-26 19:30 . 2003-08-06 16:18 100396 ----a-w- c:\windows\Album\Music\Police Siren.wav
2012-07-26 19:30 . 2003-08-06 16:18 43628 ----a-w- c:\windows\Album\Music\High Tech Alarm.wav
2012-07-26 19:30 . 2003-08-06 16:18 9264 ----a-w- c:\windows\Album\Music\Click.wav
2012-07-26 19:30 . 2003-08-06 16:18 109886 ----a-w- c:\windows\Album\Music\Cavalry to the Rescue.wav
2012-07-26 19:30 . 2003-08-06 16:18 20076 ----a-w- c:\windows\Album\Music\Breaking Glass.wav
2012-07-26 19:30 . 2003-08-06 16:18 49004 ----a-w- c:\windows\Album\Music\Barking Dog.wav
2012-07-26 19:30 . 2003-08-06 16:18 17404 ----a-w- c:\windows\Album\Music\Alien Alert.wav
2012-07-26 19:30 . 2003-08-06 16:18 1058 ----a-w- c:\windows\Album\Music\Alert.wav
2012-07-26 19:30 . 2003-08-06 16:18 30210 ----a-w- c:\windows\Album\Music\Zapped by Electricity.wav
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-07-31 20:29 220624 ----a-w- c:\users\Miroslav\AppData\Local\Microsoft\SkyDrive\16.4.6006.0718_1\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-07-31 20:29 220624 ----a-w- c:\users\Miroslav\AppData\Local\Microsoft\SkyDrive\16.4.6006.0718_1\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-07-31 20:29 220624 ----a-w- c:\users\Miroslav\AppData\Local\Microsoft\SkyDrive\16.4.6006.0718_1\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Miroslav^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Facebook Messenger.lnk]
path=c:\users\Miroslav\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
backup=c:\windows\pss\Facebook Messenger.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Miroslav^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
path=c:\users\Miroslav\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk
backup=c:\windows\pss\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\B2C_AGENT]
2012-03-28 00:53 404568 ----a-w- c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
2012-07-28 08:11 138096 ----atw- c:\users\Miroslav\AppData\Local\Facebook\Update\FacebookUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2009-02-26 16:36 30040 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware]
2012-07-03 11:46 462920 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Quick Moto Agent]
2004-03-21 13:43 459776 ----a-w- c:\program files\Quick Moto\Agent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SNPSTD2]
2004-06-10 09:54 286720 ----a-w- c:\windows\vsnpstd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2009-04-14 05:43 604704 ----a-w- c:\windows\SOUNDMAN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
2009-05-26 22:31 85160 ----a-w- c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [x]
R3 FlashUSB;FlashUSB;c:\windows\system32\DRIVERS\FlashUSB.sys [x]
R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbus.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 MpKsl307cf3a4;MpKsl307cf3a4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B01B73CB-806A-48EB-82D3-98AE2B84164D}\MpKsl307cf3a4.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2012-07-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-27 06:27]
.
2012-08-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1445107617-2002140488-3262147951-1001Core.job
- c:\users\Miroslav\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-28 08:11]
.
2012-08-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1445107617-2002140488-3262147951-1001UA.job
- c:\users\Miroslav\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-28 08:11]
.
.
------- Doplňkový sken -------
.
uStart Page =
hxxp://www.seznam.cz/IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files\ICQ7.7\ICQ.exe
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - c:\program files\Verdict Free\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - c:\program files\Verdict Free\etnxp.dll
TCP: DhcpNameServer = 10.29.2.1 192.168.0.1
FF - ProfilePath - c:\users\Miroslav\AppData\Roaming\Mozilla\Firefox\Profiles\e8s9w3st.default\
FF - prefs.js: browser.startup.homepage -
hxxp://www.seznam.cz/FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.urlbar.hideGoButton - false
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 4095
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 1000000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 1000000
FF - user.js: dom.disable_window_status_change - true
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: network.prefetch-next - true
FF - user.js: nglayout.initialpaint.delay - 1000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2012-08-02 18:16:53 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-08-02 16:16
ComboFix2.txt 2012-08-01 16:13
.
Před spuštěním: Volných bajtů: 16 385 327 104
Po spuštění: Volných bajtů: 16 362 348 544
.
- - End Of File - - 46768484537600EADCDB19C88E7FF1BC