Log z ComboFixu:
ComboFix 13-04-27.04 - Acer 28.04.2013 8:10.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.1980.1293 [GMT 2:00]
Spuštěný z: c:\users\Acer\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Acer\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Enabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-03-28 do 2013-04-28 )))))))))))))))))))))))))))))))
.
.
2013-04-28 06:18 . 2013-04-28 06:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-04-28 06:04 . 2013-04-28 06:04 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7200CEEC-9AD7-42B0-9116-DD38529C473F}\MpKsl9b00f19a.sys
2013-04-26 18:13 . 2013-04-10 03:08 6906960 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7200CEEC-9AD7-42B0-9116-DD38529C473F}\mpengine.dll
2013-04-25 17:22 . 2013-04-10 03:08 6906960 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-04-24 16:44 . 2013-04-28 06:20 -------- d-----w- c:\users\Acer\AppData\Local\temp
2013-04-24 16:12 . 2013-04-12 13:45 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-23 17:18 . 2013-04-23 17:18 -------- d-----w- c:\programdata\Malwarebytes
2013-04-23 17:12 . 2013-04-23 17:12 15616 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2013-04-23 16:51 . 2013-04-23 16:50 706640 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{58155773-EB60-4F83-86C8-4B2AC611B012}\gapaengine.dll
2013-04-23 15:22 . 2013-04-23 15:52 -------- d-----w- c:\program files\trend micro
2013-04-23 15:22 . 2013-04-23 15:22 -------- d-----w- C:\rsit
2013-04-22 16:26 . 2013-04-22 16:26 -------- d-----w- c:\program files\PC Tools
2013-04-22 16:22 . 2012-11-01 13:35 202280 ----a-w- c:\windows\system32\drivers\PCTSD.sys
2013-04-22 16:22 . 2013-04-25 17:11 -------- d-----w- c:\program files\Common Files\PC Tools
2013-04-22 15:24 . 2013-04-25 17:09 -------- d-----w- c:\programdata\PC Tools
2013-04-22 15:24 . 2013-04-22 15:24 -------- d-----w- c:\users\Acer\AppData\Roaming\TestApp
2013-04-15 19:51 . 2013-04-15 19:51 -------- d-----w- C:\FloraHolland
2013-04-11 14:47 . 2012-08-21 11:01 26840 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2013-04-11 14:46 . 2013-04-11 14:46 -------- d-----w- c:\program files\iPod
2013-04-11 14:46 . 2013-04-11 14:47 -------- d-----w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-04-11 14:46 . 2013-04-11 14:47 -------- d-----w- c:\program files\iTunes
2013-04-11 14:42 . 2013-04-11 14:42 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2013-04-11 14:42 . 2013-04-11 14:42 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2013-04-11 14:42 . 2013-04-11 14:42 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-04-11 14:42 . 2013-04-11 14:42 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-04-11 14:42 . 2013-04-11 14:42 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-04-11 14:42 . 2013-04-11 14:42 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-04-11 14:42 . 2013-04-11 14:42 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-04-11 14:42 . 2013-04-11 14:42 -------- d-----w- c:\program files\QuickTime
2013-04-10 15:35 . 2013-03-01 03:09 2347008 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 15:35 . 2013-01-24 04:47 196328 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-10 15:35 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 15:35 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-04-10 15:35 . 2013-03-19 04:48 38912 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 15:35 . 2013-03-19 02:49 69632 ----a-w- c:\windows\system32\smss.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-28 06:20 . 2013-04-28 06:20 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7200CEEC-9AD7-42B0-9116-DD38529C473F}\MpKsl4ae70575.sys
2013-04-02 10:33 . 2012-09-03 16:08 237088 ------w- c:\windows\system32\MpSigStub.exe
2013-03-13 20:04 . 2012-09-03 17:52 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-13 20:04 . 2012-09-03 17:52 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-02-12 04:48 . 2013-03-14 19:09 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-14 19:09 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-02-12 03:32 . 2013-03-26 07:34 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-04-13 11:10 . 2013-04-13 11:09 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"T-Mobile CManager"="c:\program files\T-Mobile\Web'n'walk Manager\Manager.exe" [2013-03-11 2038552]
"ISUSPM"="c:\programdata\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-07-12 226904]
"iCloudServices"="c:\program files\Common Files\Apple\Internet Services\iCloudServices.exe" [2012-12-17 59872]
"ApplePhotoStreams"="c:\program files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2012-12-17 59872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VodafoneVMCLiteLauncher"="c:\program files\Vodafone\VMCLite\\VodafoneVMCLiteLauncher.exe" [2008-04-01 102400]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-04 98304]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-04 151064]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2009-08-18 1157640]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-04 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-04 174104]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Vodafone VMC Lite Launcher.lnk - c:\windows\Installer\{36DA8767-9BE9-4ACF-8679-958D6379F22C}\NewShortcut1_5E3003BD8B2446E5BEDC66B4435E8637.exe [2012-11-4 65536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [x]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 32bitový systém Windows Vista;c:\windows\system32\DRIVERS\netw5v32.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 MpKsl4ae70575;MpKsl4ae70575;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7200CEEC-9AD7-42B0-9116-DD38529C473F}\MpKsl4ae70575.sys [x]
S1 MpKsl9b00f19a;MpKsl9b00f19a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7200CEEC-9AD7-42B0-9116-DD38529C473F}\MpKsl9b00f19a.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S2 MbnExt;Mobile Broadband Extension Service;c:\windows\system32\svchost.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd32.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x86.sys [x]
S3 NETw5s32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows 7 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [x]
S3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MPKSL4AE70575
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc Mcx2Svc SensrSvc
GPSvcGroup REG_MULTI_SZ GPSvc
MbnExt REG_MULTI_SZ MbnExt
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
.
Obsah adresáře 'Naplánované úlohy'
.
2013-04-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-03 20:04]
.
2013-04-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-137119653-3956785414-4148604313-1000Core.job
- c:\users\Acer\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-03 17:49]
.
2013-04-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-137119653-3956785414-4148604313-1000UA.job
- c:\users\Acer\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-03 17:49]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://
www.seznam.cz/
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.100.1
TCP: Interfaces\{CC8BCD6F-3FCD-8FF4-3E67-6D55A2AD1275}: NameServer = 93.153.117.33 93.153.117.1
FF - ProfilePath - c:\users\Acer\AppData\Roaming\Mozilla\Firefox\Profiles\axgs9o1k.default\
FF - ExtSQL: 2013-04-22 18:29; {cb84136f-9c44-433a-9048-c5cd9df1dc16}; c:\program files\PC Tools\PC Tools Security\BDT\Firefox
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\atieclxx.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Vodafone\VMCLite\VodafoneVMCLiteLauncher.exe
c:\windows\system32\sppsvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2013-04-28 08:24:28 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-04-28 06:24
ComboFix2.txt 2013-04-24 16:44
.
Před spuštěním: Volných bajtů: 121 237 569 536
Po spuštění: Volných bajtů: 121 054 834 688
.
- - End Of File - - 5C336EEDCC1CAAEC9BDC30C2C584D060