ComboFix 12-11-26.02 - Owner 26.11.2012 21:22:08.3.2 - x86
Spuštěný z: c:\documents and settings\Owner\Plocha\ComboFix.exe
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\iun6002.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-10-26 do 2012-11-26 )))))))))))))))))))))))))))))))
.
.
2020-04-23 07:01 . 2011-06-01 19:42 -------- d-----w- c:\windows\system32\GroupPolicy
2012-11-26 17:43 . 2012-11-26 17:43 63115 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS
2012-11-26 17:43 . 2012-11-26 17:43 4599 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS
2012-11-26 17:43 . 2012-11-26 17:43 9310 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS
2012-11-26 17:43 . 2012-11-26 17:43 8646 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS
2012-11-26 17:43 . 2012-11-26 17:43 6429 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS
2012-11-26 17:43 . 2012-11-26 17:43 5927 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXT.JS
2012-11-26 17:43 . 2012-11-26 17:43 8613 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS
2012-11-26 17:43 . 2012-11-26 17:43 1651 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\QUERYSTRING.JS
2012-11-26 17:42 . 2012-11-26 17:42 6910 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS
2012-11-26 17:42 . 2012-11-26 17:42 18541 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LOCALIZATION.JS
2012-11-26 17:42 . 2012-11-26 17:42 6208 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LINK.JS
2012-11-26 17:42 . 2012-11-26 17:42 8288 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\IMAGE.JS
2012-11-26 17:42 . 2012-11-26 17:42 51852 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\EXTERNALWRAPPER.JS
2012-11-26 17:42 . 2012-11-26 17:42 20719 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS
2012-11-26 17:42 . 2012-11-26 17:42 23327 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
2012-11-26 17:42 . 2012-11-26 17:42 8782 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
2012-11-26 17:42 . 2012-11-26 17:42 7271 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
2012-11-24 16:06 . 2012-11-24 16:13 -------- d-----w- c:\program files\Mockba to Berlin
2012-11-16 16:41 . 2012-11-23 22:06 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Zoom Player
2012-11-16 16:41 . 2012-11-16 16:42 -------- d-----w- c:\program files\Zoom Player
2012-11-13 20:48 . 2012-11-13 20:48 -------- d-----w- c:\documents and settings\Owner\Local Settings\Data aplikací\Ashampoo Music Studio 2012
2012-11-10 11:49 . 2012-11-10 11:49 -------- d-----w- c:\documents and settings\Owner\Local Settings\Data aplikací\MaFarm
2012-11-10 11:39 . 2012-11-10 11:39 -------- d-----w- c:\program files\Microsoft XNA
2012-11-10 11:35 . 2012-11-10 11:50 -------- d-----w- c:\documents and settings\Owner\Data aplikací\FarmFables
2012-11-10 11:34 . 2012-11-10 11:34 -------- d-----w- c:\program files\Farm Fables
2012-11-10 11:34 . 2012-11-10 11:34 -------- d-----w- c:\windows\Farm Fables
2012-11-10 10:29 . 2012-11-10 10:33 -------- d-----w- C:\PC-Checkup
2012-11-10 08:36 . 2012-11-21 10:47 40760 ----a-w- c:\windows\system32\drivers\tdifw.sys
2012-11-10 08:35 . 2012-11-21 10:50 27208 ----a-w- c:\windows\system32\tpnative.exe
2012-11-10 08:35 . 2012-11-21 10:49 202200 ----a-w- c:\windows\system32\avinspect.dll
2012-11-10 08:35 . 2012-11-21 10:47 37688 ----a-w- c:\windows\system32\drivers\avasdmft.sys
2012-11-10 08:35 . 2012-11-21 10:47 33080 ----a-w- c:\windows\system32\drivers\tpdevflt.sys
2012-11-08 16:59 . 2012-11-08 17:18 -------- d-----w- c:\program files\Farming Simulator 2013
2012-11-06 18:55 . 2012-11-06 18:56 -------- d-----w- c:\documents and settings\Owner\Data aplikací\Mermaid
2012-11-03 19:32 . 2012-01-09 17:59 133208 ----a-w- c:\windows\system32\drivers\kl1.sys
2012-11-03 19:26 . 2012-11-03 20:03 -------- d-----w- c:\program files\CheckPoint
2012-10-29 19:32 . 2012-11-24 21:38 -------- d-----w- c:\program files\Registry Washer
2012-10-27 20:47 . 2012-10-27 20:47 -------- d-----w- c:\program files\Youda Survivor [Update]
2012-10-27 20:47 . 2012-10-27 20:47 -------- d-----w- c:\windows\Youda Survivor [Update]
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-21 10:49 . 2012-04-07 13:05 46248 ----a-w- c:\windows\system32\drivers\tpsec.sys
2012-10-15 14:53 . 2012-10-15 14:53 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2012-10-09 16:54 . 2012-06-09 11:27 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-09 16:54 . 2011-10-01 19:30 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-29 10:45 . 2012-09-29 10:45 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-29 10:45 . 2012-09-29 10:45 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-09-29 10:45 . 2012-02-23 15:18 821736 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-09-29 10:45 . 2011-11-19 12:22 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-09-01 20:25 . 2012-09-01 20:25 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 16126464]
"TrustPortDiskProtectionWatchDog"="c:\program files\TrustPort\DiskProtection\bin\TDWatch.exe" [2012-11-21 225592]
"TrustPortTray"="c:\program files\Common Files\TrustPort\Bin\tptray.exe" [2012-11-21 1061176]
"AntivirusCommunicatorAgent"="c:\program files\TrustPort\Antivirus\bin\avcom.exe" [2012-11-21 926008]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-03 435096]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\avinspect.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0tpnative
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 18:43 69632 ------r- c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AntivirusCommunicatorAgent]
2012-11-21 10:42 926008 ----a-w- c:\program files\TrustPort\Antivirus\bin\avcom.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSGamerOSD]
2007-07-12 09:03 380928 ----a-w- c:\program files\ASUS\GamerOSD\GamerOSD.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2007-04-03 16:50 1603152 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2007-04-03 16:00 644696 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 03:22 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameFace Messenger]
2006-11-01 13:50 2154496 ----a-w- c:\program files\GameFace Messenger\GameFace.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2007-04-04 17:22 1822720 ------r- c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2006-11-10 11:35 90112 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrustPortDiskProtectionWatchDog]
2012-11-21 10:42 225592 ----a-w- c:\program files\TrustPort\DiskProtection\bin\tdwatch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrustPortTray]
2012-11-21 10:42 1061176 ----a-w- c:\program files\Common Files\TrustPort\bin\tptray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Farming Simulator 2013\\FarmingSimulator2013.exe"=
"c:\\Program Files\\Farming Simulator 2013\\FarmingSimulator2013Game.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"27402:TCP"= 27402:TCP:BitComet 27402 TCP
"27402:UDP"= 27402:UDP:BitComet 27402 UDP
.
R1 HMFAxCore46691b2fe72383a3b643d95081ef1d95;HMFAxCore46691b2fe72383a3b643d95081ef1d95; [x]
R2 ioloSystemService;iolo System Service; [x]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\DRIVERS\Amps2prt.sys [x]
R3 AVFSFilter;AVFSFilter; [x]
R3 DrvAgent32;DrvAgent32;c:\windows\system32\Drivers\DrvAgent32.sys [x]
R3 dsio;TrustPort Raw IO Driver;c:\program files\Common Files\TrustPort\bin\dsio.sys [x]
R3 EuDisk;EASEUS Disk Enumerator;c:\windows\system32\DRIVERS\EuDisk.sys [x]
R3 naecd;naecd; [x]
R3 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service; [x]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service; [x]
R3 WISOVD;WISOVD;c:\program files\WinISO Computing\WinISO\bin\driver\WISOVD_xp.sys [x]
S0 360HookOem;360HookOem;c:\windows\system32\drivers\360HookOem.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S0 tpdevflt;TrustPort Device Filter;c:\windows\System32\DRIVERS\tpdevflt.sys [x]
S1 360FileOem;360FileOem;c:\windows\system32\drivers\360FileOem.sys [x]
S1 360RegOem;360RegOem;c:\windows\system32\drivers\360RegOem.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [x]
S1 tdimapper;TrustPort TDI port to process mapper;c:\program files\TrustPort\PersonalFirewall\bin\tdimapper.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x]
S2 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 9\DfsdkS.exe [x]
S2 EncDisk;EncDisk;c:\program files\TrustPort\DiskProtection\bin\EncDsk.sys [x]
S2 tdifw;TrustPort PGTW driver;c:\windows\system32\drivers\tdifw.sys [x]
S2 tpmgma_service;TrustPort Core Service;c:\program files\Common Files\TrustPort\bin\tpmgma.exe [x]
S2 tpsec;TrustPort Security Filter;c:\windows\system32\drivers\tpsec.sys [x]
S2 wipesrv;TrustPort DataShredder Wipe Service;c:\program files\TrustPort\DataShredder\bin\wipesrv.exe [x]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l151x86.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [x]
S3 avas_service;TrustPort Antivirus On-Access Scanner Agent;c:\program files\TrustPort\Antivirus\bin\avas.exe [x]
S3 avasdmft;TrustPort Antivirus On-Access Scanner (W2K/XP) MF;c:\windows\system32\DRIVERS\avasdmft.sys [x]
S3 avss_service;TrustPort Antivirus Service Scanner Provider;c:\program files\TrustPort\Antivirus\bin\avss.exe [x]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S3 gozer;TrustPort Personal GTW;c:\program files\TrustPort\Antivirus\bin\gozer.exe [x]
S3 MouseCap;MouseCapture Driver;c:\windows\system32\Drivers\MouseCap.sys [x]
S3 TPPFHOOK;TPPFHOOK;c:\program files\TrustPort\PersonalFirewall\bin\TPPFHOOK.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2012-11-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-09 16:54]
.
2012-10-07 c:\windows\Tasks\Auslogics Disk Defrag Prof Task {00000001-C3A2-4E89-B997-2510B2D90E89} for Owner.job
- c:\program files\Auslogics\Auslogics Disk Defrag Professional\DiskDefrag.exe [2012-10-05 09:35]
.
2012-10-07 c:\windows\Tasks\Auslogics Disk Defrag Prof Task {00000001-E941-4E93-A63D-2CA6A84A917E} for Owner.job
- c:\program files\Auslogics\Auslogics Disk Defrag Professional\DiskDefrag.exe [2012-10-05 09:35]
.
2012-11-24 c:\windows\Tasks\Registry Winner Schedule.job
- c:\program files\Registry Winner\RegistryWinner.exe [2012-05-24 12:45]
.
2012-11-26 c:\windows\Tasks\TrustPort Updater.job
- c:\program files\Common Files\TrustPort\bin\tpupdate.exe [2012-04-07 10:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://
www.google.com
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\documents and settings\Owner\Data aplikací\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-PC-Checkup - c:\pc-checkup\PCCheckUp.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2012-11-26 21:38
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwOpenKey, ZwOpenFile
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1116)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Celkový čas: 2012-11-26 21:41:06
ComboFix-quarantined-files.txt 2012-11-26 20:41
.
Před spuštěním: Volných bajtů: 29 018 001 408
Po spuštění: Volných bajtů: 28 966 141 952
.
- - End Of File - - 539910528A4D5C94848E8E5C6E3BFF68
