ComboFix 12-11-14.01 - Samsung 14.11.2012 14:02:41.1.4 - x64 MINIMAL Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.2933.1786 [GMT 1:00] Spuštěný z: c:\users\Samsung\Desktop\Combofix\aaa.exe AV: AVG Anti-Virus 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Vytvořen nový Bod Obnovení . . ((((((((((((((((((((((((((((((((((((((( Ostatní výmazy ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\Autorun.exe C:\autorun.inf c:\program files (x86)\Setup.exe c:\programdata\FullRemove.exe C:\setup.exe c:\windows\pkunzip.pif c:\windows\pkzip.pif c:\windows\SysWow64\UNWISE.EXE c:\windows\SysWow64\URTTemp c:\windows\SysWow64\URTTemp\regtlib.exe . . ((((((((((((((((((((((((( Soubory vytvořené od 2012-10-14 do 2012-11-14 ))))))))))))))))))))))))))))))) . . 2012-11-14 13:07 . 2012-11-14 13:07 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-11-14 12:35 . 2012-11-14 12:35 -------- d-----w- c:\programdata\Spyware Terminator 2012-11-13 12:39 . 2012-11-13 12:50 -------- d-----w- C:\_email 2012-11-13 10:04 . 2012-11-13 10:04 51496 ----a-w- c:\windows\system32\drivers\stflt.sys 2012-11-13 10:04 . 2012-11-14 12:37 -------- d-----w- c:\program files (x86)\Spyware Terminator 2012-11-13 09:45 . 2012-11-13 09:45 -------- d-----w- c:\programdata\GFI Software 2012-11-13 09:23 . 2012-11-13 09:23 -------- d-----w- c:\programdata\Lavasoft 2012-11-13 09:23 . 2012-11-13 09:45 -------- d-----w- c:\program files (x86)\Ad-Aware Antivirus 2012-11-13 09:22 . 2012-11-13 09:22 -------- d-----w- c:\users\Samsung\AppData\Local\Downloaded Installations 2012-11-13 09:22 . 2012-11-13 09:37 -------- d-----w- c:\users\Samsung\AppData\Roaming\Ad-Aware Antivirus 2012-11-12 14:29 . 2012-11-12 14:29 -------- d-----w- c:\program files (x86)\ESET . . . (((((((((((((((((((((((((((((((((((((((( Find3M výpis )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-10 19:50 . 2011-03-24 11:28 65309168 ----a-w- c:\windows\system32\MRT.exe 2012-10-09 15:48 . 2012-08-10 14:17 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-10-09 15:48 . 2011-08-21 16:51 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-09-14 19:23 . 2012-10-10 18:18 2048 ----a-w- c:\windows\system32\tzres.dll 2012-09-14 18:30 . 2012-10-10 18:18 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2012-08-31 18:02 . 2012-10-10 18:18 1656688 ----a-w- c:\windows\system32\drivers\ntfs.sys 2012-08-30 18:11 . 2012-10-10 18:18 5505904 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-08-30 17:18 . 2012-10-10 18:18 3958128 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-08-30 17:18 . 2012-10-10 18:18 3902832 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-08-24 18:05 . 2012-10-10 18:18 220160 ----a-w- c:\windows\system32\wintrust.dll 2012-08-24 18:05 . 2012-09-22 05:22 1197568 ----a-w- c:\windows\system32\wininet.dll 2012-08-24 18:05 . 2012-09-22 05:22 1501696 ----a-w- c:\windows\system32\urlmon.dll 2012-08-24 18:05 . 2012-09-22 05:22 134144 ----a-w- c:\windows\system32\url.dll 2012-08-24 18:03 . 2012-09-22 05:22 1026560 ----a-w- c:\windows\system32\mstime.dll 2012-08-24 18:02 . 2012-09-22 05:23 9375744 ----a-w- c:\windows\system32\mshtml.dll 2012-08-24 18:02 . 2012-09-22 05:22 97792 ----a-w- c:\windows\system32\mshtmled.dll 2012-08-24 18:02 . 2012-09-22 05:22 736256 ----a-w- c:\windows\system32\msfeeds.dll 2012-08-24 18:02 . 2012-09-22 05:22 82944 ----a-w- c:\windows\system32\msfeedsbs.dll 2012-08-24 18:02 . 2012-09-22 05:22 57856 ----a-w- c:\windows\system32\licmgr10.dll 2012-08-24 18:02 . 2012-09-22 05:22 64512 ----a-w- c:\windows\system32\jsproxy.dll 2012-08-24 18:01 . 2012-09-22 05:22 247808 ----a-w- c:\windows\system32\ieui.dll 2012-08-24 18:01 . 2012-09-22 05:22 2458624 ----a-w- c:\windows\system32\iertutil.dll 2012-08-24 18:01 . 2012-09-22 05:23 12404736 ----a-w- c:\windows\system32\ieframe.dll 2012-08-24 18:01 . 2012-09-22 05:22 256000 ----a-w- c:\windows\system32\iepeers.dll 2012-08-24 18:01 . 2012-09-22 05:22 445952 ----a-w- c:\windows\system32\iedkcs32.dll 2012-08-24 17:59 . 2012-09-22 05:22 12288 ----a-w- c:\windows\system32\msfeedssync.exe 2012-08-24 17:10 . 2012-10-10 18:18 172544 ----a-w- c:\windows\SysWow64\wintrust.dll 2012-08-24 17:10 . 2012-09-22 05:22 981504 ----a-w- c:\windows\SysWow64\wininet.dll 2012-08-24 17:08 . 2012-09-22 05:22 44544 ----a-w- c:\windows\SysWow64\licmgr10.dll 2012-08-24 16:45 . 2012-09-22 05:22 482816 ----a-w- c:\windows\system32\html.iec 2012-08-24 16:02 . 2012-09-22 05:22 1638912 ----a-w- c:\windows\system32\mshtml.tlb 2012-08-24 16:01 . 2012-09-22 05:22 386048 ----a-w- c:\windows\SysWow64\html.iec 2012-08-24 15:27 . 2012-09-22 05:22 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb 2012-08-24 13:43 . 2012-08-24 13:43 384352 ----a-w- c:\windows\system32\drivers\avgtdia.sys 2012-08-18 15:43 . 2012-10-10 18:18 243200 ----a-w- c:\windows\system32\wow64.dll 2012-08-18 15:43 . 2012-10-10 18:18 362496 ----a-w- c:\windows\system32\wow64win.dll 2012-08-18 15:43 . 2012-10-10 18:18 13312 ----a-w- c:\windows\system32\wow64cpu.dll 2012-08-18 15:42 . 2012-10-10 18:18 215040 ----a-w- c:\windows\system32\winsrv.dll 2012-08-18 15:40 . 2012-10-10 18:18 16384 ----a-w- c:\windows\system32\ntvdm64.dll 2012-08-18 15:37 . 2012-10-10 18:18 425984 ----a-w- c:\windows\system32\KernelBase.dll 2012-08-18 15:37 . 2012-10-10 18:18 1162240 ----a-w- c:\windows\system32\kernel32.dll 2012-08-18 15:34 . 2012-10-10 18:18 338432 ----a-w- c:\windows\system32\conhost.exe 2012-08-18 15:22 . 2012-10-10 18:18 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2012-08-18 15:22 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2012-08-18 11:22 . 2012-10-10 18:18 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll 2012-08-18 11:19 . 2012-10-10 18:18 44032 ----a-w- c:\windows\apppatch\acwow64.dll 2012-08-18 11:19 . 2012-10-10 18:18 25600 ----a-w- c:\windows\SysWow64\setup16.exe 2012-08-18 11:17 . 2012-10-10 18:18 274944 ----a-w- c:\windows\SysWow64\KernelBase.dll 2012-08-18 11:17 . 2012-10-10 18:18 5120 ----a-w- c:\windows\SysWow64\wow32.dll 2012-08-18 11:09 . 2012-10-10 18:18 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 5120 ---ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll 2012-08-18 11:09 . 2012-10-10 18:18 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll 2012-08-18 09:12 . 2012-10-10 18:18 7680 ----a-w- c:\windows\SysWow64\instnm.exe . . (((((((((((((((((((((((((((((((((( Spouštěcí body v registru ))))))))))))))))))))))))))))))))))))))))))))) . . *Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny. REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872] "Boxoft Tools"="c:\programdata\Boxtools\Boxofttoolbox.exe" [2010-11-19 2590208] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504] "Print2PDF Print Monitor"="c:\program files (x86)\Software602\Print2PDF\Print2PDF.exe" [2011-10-04 220992] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576] "AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux3"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart . R1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-07-26 291680] R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-12-23 47696] R1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-08-24 384352] R1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2010-03-31 13824] R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [x] R2 602XML Updater;602Updater;c:\program files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [2011-10-10 85344] R2 ABBYY.Licensing.PDFTransformer.Classic.3.0;Aktivace aplikace ABBYY PDF Transformer 3.0 – Licenční služba;c:\program files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [2010-02-01 759048] R2 aksdf;aksdf;c:\windows\system32\DRIVERS\aksdf.sys [2006-12-13 65024] R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2012-08-13 5167736] R2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-02-14 193288] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-01-30 123960] R2 hasplms;HASP License Manager;c:\windows\system32\hasplms.exe [2010-09-27 4180576] R2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2011-12-23 124496] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfiltera.sys [2011-12-23 29776] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-27 158976] R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-02-03 271872] R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-02-18 51712] R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-24 1255736] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-09-28 395264] S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-04-19 28480] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-01-31 36944] S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2010-04-01 136192] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Obsah adresáře 'Naplánované úlohy' . 2012-11-14 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-10 15:48] . 2012-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-10 08:32] . 2012-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-10 08:32] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-07 10144288] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-23 166424] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-23 391192] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-23 413720] . ------- Doplňkový sken ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.seznam.cz/ mStart Page = hxxp://samsung.msn.com mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.2.1 . - - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - - . URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file) URLSearchHooks-{5a089bcd-c7f1-4064-8702-f58d8bd5d61f} - (no file) BHO-{5a089bcd-c7f1-4064-8702-f58d8bd5d61f} - (no file) Toolbar-Locked - (no file) Toolbar-{5a089bcd-c7f1-4064-8702-f58d8bd5d61f} - (no file) SafeBoot-mcmscsvc SafeBoot-MCODS Toolbar-Locked - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file) WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) WebBrowser-{5A089BCD-C7F1-4064-8702-F58D8BD5D61F} - (no file) HKLM-Run-ETDWare - c:\program files (x86)\Elantech\ETDCtrl.exe AddRemove-HASP Device Drivers - c:\windows\system32\UNWISE.EXE AddRemove-HASP4 Device Drivers - c:\windows\System32\UNWISE.EXE AddRemove-Oxford Studijní slovník - c:\program files (x86)\Setup.exe AddRemove-{F0A209B7-7F85-4BDD-8F1F-B98EEAD9E04B} - c:\program files (x86)\InstallShield Installation Information\{F0A209B7-7F85-4BDD-8F1F-B98EEAD9E04B}\setup.exe . . . --------------------- ZAMKNUTÉ KLÍČE V REGISTRU --------------------- . [HKEY_USERS\S-1-5-21-395732706-3271692416-3045027566-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] @Allowed: (Read) (RestrictedCode) "??"=hex:71,e5,dc,21,b9,70,e0,fb,8b,2b,1a,f3,cd,54,90,7f,30,ee,c6,07,fc,41,5f, 5c,fd,32,68,98,5f,5f,4f,89,b4,86,65,e7,74,1d,10,70,ed,9b,25,e6,32,b1,7a,b5,\ "??"=hex:9d,f9,78,34,8b,54,3b,b2,fc,7e,85,bb,69,dd,b5,84 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Celkový čas: 2012-11-14 14:09:26 ComboFix-quarantined-files.txt 2012-11-14 13:09 . Před spuštěním: Volných bajtů: 32 783 220 736 Po spuštění: Volných bajtů: 32 603 283 456 . - - End Of File - - 7F19E14633D3CB8F6D86AF8861DA9435