Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.3327.2529 [GMT 1:00]
Spuštěný z: c:\users\Krotil\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\users\Krotil\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\$NtUninstallKB1865$\2195031452\@
c:\windows\$NtUninstallKB1865$\2195031452\cfg.ini
c:\windows\$NtUninstallKB1865$\2195031452\Desktop.ini
c:\windows\$NtUninstallKB1865$\2195031452\L\xadqgnnk
c:\windows\$NtUninstallKB1865$\2195031452\twl.dll
c:\windows\$NtUninstallKB1865$\2195031452\U\00000001.@
c:\windows\$NtUninstallKB1865$\2195031452\U\00000002.@
c:\windows\$NtUninstallKB1865$\2195031452\U\00000004.@
c:\windows\$NtUninstallKB1865$\2195031452\U\80000000.@
c:\windows\$NtUninstallKB1865$\2195031452\U\80000004.@
c:\windows\$NtUninstallKB1865$\2195031452\U\80000032.@
c:\windows\$NtUninstallKB1865$\2195031452\version
c:\windows\$NtUninstallKB1865$\2216460260
.
Nakažená kopie c:\windows\system32\drivers\afd.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\combofix\HarddiskVolumeShadowCopy2_!Windows!System32!drivers!afd.sys
.
Nakažená kopie c:\windows\system32\drivers\afd.sys byla nalezena a vyléčena.
Obnovena kopie z - The cat found it
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-14 do 2012-02-14 )))))))))))))))))))))))))))))))
.
.
2012-02-14 20:30 . 2012-02-14 20:30 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{235F9C96-D4AD-4BDD-8D0C-318E0349B00E}\offreg.dll
2012-02-14 20:28 . 2012-02-14 20:29 -------- d-----w- c:\users\Krotil\AppData\Local\temp
2012-02-14 20:28 . 2012-02-14 20:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-14 20:18 . 2012-02-14 16:32 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2012-02-14 19:24 . 2012-02-14 19:24 -------- d-----w- C:\_OTL
2012-02-14 18:53 . 2009-07-13 23:45 83456 ----a-w- c:\windows\system32\drivers\Serial.sys
2012-02-14 18:46 . 2009-07-13 23:15 387584 ----a-w- c:\windows\system32\drivers\csc.sys
2012-02-14 18:24 . 2010-11-20 08:38 108544 ----a-w- c:\windows\system32\drivers\cdrom.sys
2012-02-14 15:19 . 2012-02-14 19:31 -------- d-----w- C:\TDSSKiller_Quarantine
2012-02-14 12:29 . 2012-01-17 03:39 6557240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{235F9C96-D4AD-4BDD-8D0C-318E0349B00E}\mpengine.dll
2012-02-12 21:43 . 2012-02-12 21:43 -------- d-----w- c:\program files\CCleaner
2012-02-12 13:26 . 2012-02-12 13:26 -------- d-----w- c:\programdata\Kaspersky Lab
2012-02-11 20:11 . 2012-02-12 14:32 187904 ----a-w- c:\windows\system32\drivers\netbt.sys
2012-02-11 17:57 . 2012-02-13 11:35 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-02-11 17:57 . 2012-02-11 18:05 -------- d-----w- c:\program files\Spybot - Search & Destroy
2012-02-09 18:00 . 2012-02-12 15:08 -------- d-----w- c:\program files\trend micro
2012-02-09 18:00 . 2012-02-11 18:34 -------- d-----w- C:\rsit
2012-02-05 15:55 . 2012-02-14 20:29 0 --sha-w- c:\windows\system32\dds_trash_log.cmd
2012-01-25 17:56 . 2011-11-17 05:41 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-01-25 17:56 . 2011-11-17 05:41 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-01-25 17:56 . 2011-11-17 05:39 369352 ----a-w- c:\windows\system32\drivers\cng.sys
2012-01-25 17:56 . 2011-11-17 05:35 314880 ----a-w- c:\windows\system32\webio.dll
2012-01-25 17:56 . 2011-11-17 05:34 15872 ----a-w- c:\windows\system32\sspisrv.dll
2012-01-25 17:56 . 2011-11-17 05:34 100352 ----a-w- c:\windows\system32\sspicli.dll
2012-01-25 17:56 . 2011-11-17 05:34 224768 ----a-w- c:\windows\system32\schannel.dll
2012-01-25 17:56 . 2011-11-17 05:34 22016 ----a-w- c:\windows\system32\secur32.dll
2012-01-25 17:56 . 2011-11-17 05:32 1038848 ----a-w- c:\windows\system32\lsasrv.dll
2012-01-25 17:56 . 2011-11-17 05:29 22528 ----a-w- c:\windows\system32\lsass.exe
2012-01-19 13:08 . 2012-01-19 13:08 -------- d-----w- c:\program files\TeamViewer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-14 19:35 . 2011-07-02 11:23 74752 ----a-w- c:\windows\system32\drivers\tdx.sys
2012-02-14 12:32 . 2010-10-22 16:59 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2012-02-13 16:04 . 2011-07-02 11:22 78336 ----a-w- c:\windows\system32\drivers\dfsc.sys
2012-02-12 18:10 . 2011-01-15 08:22 484176 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2012-02-08 09:08 . 2011-06-02 10:42 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2012-02-08 09:08 . 2010-10-22 16:59 484176 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-01-29 04:10 . 2010-10-25 12:45 237072 ------w- c:\windows\system32\MpSigStub.exe
2011-12-15 13:43 . 2011-11-22 16:34 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-24 04:25 . 2011-12-15 11:12 2342912 ----a-w- c:\windows\system32\win32k.sys
2011-11-19 14:01 . 2012-01-11 11:55 67072 ----a-w- c:\windows\system32\packager.dll
2011-11-17 05:38 . 2012-01-11 11:56 1288472 ----a-w- c:\windows\system32\ntdll.dll
2011-11-17 05:34 . 2012-01-25 17:56 224768 ----a-w- c:\windows\system32\schannel.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-08-16 2736128]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-10-06 39408]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2010-02-10 1713152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"NBAgent"="c:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2010-09-28 1406248]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
c:\users\Krotil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
_uninst_53949120.lnk - c:\users\Krotil\AppData\Local\temp\_uninst_53949120.bat [N/A]
_uninst_55685608.lnk - c:\users\Krotil\AppData\Local\temp\_uninst_55685608.bat [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Image Transfer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Image Transfer.lnk
backup=c:\windows\pss\Image Transfer.lnk.CommonStartup
backupExtension=.CommonStartup
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 CFcatchme;CFcatchme;c:\users\Krotil\AppData\Local\Temp\CFcatchme.sys [x]
R3 PROCEXP151;PROCEXP151;c:\windows\system32\Drivers\PROCEXP151.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-27 1343400]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-11-24 172032]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2011-07-22 690472]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-11-17 232448]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2010-01-11 1119232]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
compaq_rba
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-08-16 11:43 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
LSP: mswsock.dll
TCP: DhcpNameServer = 10.0.18.234 88.86.107.86
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
SafeBoot-70814140.sys
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\.avgldx86]
"ImagePath"="\?"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\atieclxx.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\conhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2012-02-14 21:33:34 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-02-14 20:33
ComboFix2.txt 2012-02-14 19:00
ComboFix3.txt 2012-02-12 22:16
.
Před spuštěním: Volných bajtů: 707 476 410 368
Po spuštění: Volných bajtů: 707 508 174 848
.
- - End Of File - - 0A23E128F1D57B175E960B1631B8E032
Přispějete na provoz fóra?