ComboFix 12-08-16.01 - Barbara 8/2012 Sat 11:58:01.2.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.950.852.1033.18.8173.6605 [GMT 10:00]
°õ¦æ¦ì¸m: c:\users\Barbara\Desktop\ComboFix.exe
Command switches used :: c:\users\Barbara\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\drivers\dfljluhi.sys"
.
.
((((((((((((((((((((((((((((((((((((((( ³Q§R°£ªºÀÉ®× )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\dfljluhi.sys
.
.
((((((((((((((((((((((((( 2012-07-18 ¦Ü 2012-08-18 ªº·sªºÀÉ®× )))))))))))))))))))))))))))))))
.
.
2012-08-18 02:00 . 2012-08-18 02:0069000----a-w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AD8AF897-6634-49C7-BB19-E0E0EEA97AAF}\offreg.dll
2012-08-18 01:59 . 2012-08-18 01:59--------d-----w-c:\users\Default\AppData\Local\temp
2012-08-15 08:47 . 2012-08-16 05:40--------d-----w-C:\FRST
2012-08-15 05:33 . 2010-12-20 08:0938224----a-w-c:\windows\SysWow64\drivers\mbamswissarmy.sys
2012-08-15 05:33 . 2012-08-15 05:33--------d-----w-c:\program files (x86)\Malwarebytes' Anti-Malware
2012-08-15 05:33 . 2010-12-20 08:0824152----a-w-c:\windows\system32\drivers\mbam.sys
2012-08-15 05:23 . 2012-08-15 05:23328704----a-w-c:\windows\system32\services.exe.2006DF9D689BC7E8
2012-08-15 05:21 . 2012-08-15 05:21328704----a-w-c:\windows\system32\services.exe.808314829C38CC6D
2012-08-15 05:16 . 2012-07-15 16:409133488----a-w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AD8AF897-6634-49C7-BB19-E0E0EEA97AAF}\mpengine.dll
2012-08-15 05:11 . 2012-08-15 05:11--------d-----w-c:\program files (x86)\Microsoft Security Client
2012-08-15 05:09 . 2012-02-09 04:17927800------w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{77A2A4B2-018F-43F6-A1B5-2FFD867A678C}\gapaengine.dll
2012-08-15 04:51 . 2012-08-15 05:11--------d-----w-c:\program files\Microsoft Security Client
2012-08-15 04:48 . 2012-08-18 01:5478848----a-w-c:\windows\KMSEmulator.exe
2012-08-15 03:59 . 2012-08-15 03:59--------d-----w-c:\users\Barbara\AppData\Roaming\Malwarebytes
2012-08-15 03:59 . 2012-08-15 03:59--------d-----w-c:\programdata\Malwarebytes
2012-08-15 03:44 . 2012-08-15 03:46--------d-----w-c:\programdata\7531CCA916552E1BA2EA5145E56C3425
2012-08-15 03:39 . 2012-08-15 03:39--------d-sh--w-c:\windows\system32\%APPDATA%
2012-08-15 03:36 . 2012-08-15 03:36--------d-----w-c:\users\Barbara\AppData\Local\{4C4C128F-E68A-11E1-8270-B8AC6F996F26}
2012-08-15 03:36 . 2012-08-15 03:36--------d-----w-c:\users\Barbara\AppData\Local\{4C4BD838-E68A-11E1-8270-B8AC6F996F26}
2012-08-15 03:36 . 2012-08-15 03:36--------d-----w-c:\programdata\7531CCA916552E1BA2EA5145F875EF60
.
.
.
(((((((((((((((((((((((((((((((((((((((( ¦b¤TӤ뤺³Qק諸ÀÉ®× ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-04 10:59 . 2012-04-09 00:37426184----a-w-c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-04 10:59 . 2012-02-22 09:3870344----a-w-c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-06-23 06:10 . 2011-03-28 08:3619736----a-w-c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-06-13 16:36 . 2012-02-20 15:0058957832----a-w-c:\windows\system32\MRT.exe
2012-06-11 18:59 . 2012-06-11 18:5910248192----a-w-c:\windows\system32\drivers\atikmdag.sys
2012-06-11 18:35 . 2012-06-11 18:3570144----a-w-c:\windows\system32\coinst_8.98.dll
2012-06-11 18:29 . 2012-06-11 18:2924826368----a-w-c:\windows\system32\atio6axx.dll
2012-06-11 18:00 . 2012-06-11 18:0020467712----a-w-c:\windows\SysWow64\atioglxx.dll
2012-06-11 17:25 . 2012-06-11 17:25163840----a-w-c:\windows\system32\atiapfxx.exe
2012-06-11 17:24 . 2011-12-06 03:17924160----a-w-c:\windows\SysWow64\aticfx32.dll
2012-06-11 17:23 . 2011-12-06 03:161090560----a-w-c:\windows\system32\aticfx64.dll
2012-06-11 17:20 . 2012-06-11 17:20442368----a-w-c:\windows\system32\ATIDEMGX.dll
2012-06-11 17:19 . 2012-06-11 17:19532992----a-w-c:\windows\system32\atieclxx.exe
2012-06-11 17:19 . 2012-06-11 17:19239616----a-w-c:\windows\system32\atiesrxx.exe
2012-06-11 17:17 . 2012-06-11 17:17120320----a-w-c:\windows\system32\atitmm64.dll
2012-06-11 17:17 . 2012-06-11 17:1721504----a-w-c:\windows\system32\atimuixx.dll
2012-06-11 17:17 . 2012-06-11 17:1759392----a-w-c:\windows\system32\atiedu64.dll
2012-06-11 17:17 . 2012-06-11 17:1743520----a-w-c:\windows\SysWow64\ati2edxx.dll
2012-06-11 17:16 . 2012-06-11 17:166301696----a-w-c:\windows\SysWow64\atidxx32.dll
2012-06-11 17:01 . 2011-12-06 02:516914560----a-w-c:\windows\system32\atidxx64.dll
2012-06-11 16:51 . 2012-06-11 16:514246528----a-w-c:\windows\system32\atiumd6a.dll
2012-06-11 16:45 . 2012-06-11 16:4551200----a-w-c:\windows\system32\aticalrt64.dll
2012-06-11 16:45 . 2012-06-11 16:4546080----a-w-c:\windows\SysWow64\aticalrt.dll
2012-06-11 16:45 . 2012-04-06 01:345480448----a-w-c:\windows\SysWow64\atiumdag.dll
2012-06-11 16:45 . 2012-06-11 16:4544544----a-w-c:\windows\system32\aticalcl64.dll
2012-06-11 16:45 . 2012-06-11 16:4544032----a-w-c:\windows\SysWow64\aticalcl.dll
2012-06-11 16:45 . 2012-06-11 16:4515703040----a-w-c:\windows\system32\aticaldd64.dll
2012-06-11 16:43 . 2012-04-06 01:224729344----a-w-c:\windows\SysWow64\atiumdva.dll
2012-06-11 16:40 . 2012-06-11 16:4013277696----a-w-c:\windows\SysWow64\aticaldd.dll
2012-06-11 16:36 . 2012-06-11 16:366605824----a-w-c:\windows\system32\atiumd64.dll
2012-06-11 16:27 . 2012-06-11 16:27539136----a-w-c:\windows\system32\atiadlxx.dll
2012-06-11 16:26 . 2012-06-11 16:26368640----a-w-c:\windows\SysWow64\atiadlxy.dll
2012-06-11 16:26 . 2012-06-11 16:2617920----a-w-c:\windows\system32\atig6pxx.dll
2012-06-11 16:26 . 2012-06-11 16:2614848----a-w-c:\windows\SysWow64\atiglpxx.dll
2012-06-11 16:26 . 2012-06-11 16:2614848----a-w-c:\windows\system32\atiglpxx.dll
2012-06-11 16:26 . 2012-06-11 16:2641984----a-w-c:\windows\system32\atig6txx.dll
2012-06-11 16:26 . 2012-06-11 16:2633280----a-w-c:\windows\SysWow64\atigktxx.dll
2012-06-11 16:26 . 2012-06-11 16:26367616----a-w-c:\windows\system32\drivers\atikmpag.sys
2012-06-11 16:25 . 2011-12-06 02:1154784----a-w-c:\windows\system32\atiuxp64.dll
2012-06-11 16:25 . 2012-06-11 16:2542496----a-w-c:\windows\SysWow64\atiuxpag.dll
2012-06-11 16:25 . 2012-06-11 16:2545056----a-w-c:\windows\system32\atiu9p64.dll
2012-06-11 16:24 . 2011-12-06 02:1132768----a-w-c:\windows\SysWow64\atiu9pag.dll
2012-06-11 16:24 . 2012-06-11 16:2453248----a-w-c:\windows\system32\drivers\ati2erec.dll
2012-06-11 16:23 . 2012-06-11 16:2356320----a-w-c:\windows\system32\atimpc64.dll
2012-06-11 16:23 . 2012-06-11 16:2356320----a-w-c:\windows\system32\amdpcom64.dll
2012-06-11 16:23 . 2012-06-11 16:2356832----a-w-c:\windows\SysWow64\atimpc32.dll
2012-06-11 16:23 . 2012-06-11 16:2356832----a-w-c:\windows\SysWow64\amdpcom32.dll
2012-06-11 03:50 . 2012-06-11 03:50187392----a-w-c:\windows\system32\clinfo.exe
2012-06-11 03:50 . 2012-06-11 03:5075264----a-w-c:\windows\system32\OpenVideo64.dll
2012-06-11 03:50 . 2012-06-11 03:5065024----a-w-c:\windows\SysWow64\OpenVideo.dll
2012-06-11 03:50 . 2012-06-11 03:5063488----a-w-c:\windows\system32\OVDecode64.dll
2012-06-11 03:50 . 2012-06-11 03:5056320----a-w-c:\windows\SysWow64\OVDecode.dll
2012-06-11 03:50 . 2012-06-11 03:5016457728----a-w-c:\windows\system32\amdocl64.dll
2012-06-11 03:49 . 2012-06-11 03:4913008896----a-w-c:\windows\SysWow64\amdocl.dll
2012-06-02 22:19 . 2012-06-21 01:3038424----a-w-c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-21 01:302428952----a-w-c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-21 01:3057880----a-w-c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-21 01:3044056----a-w-c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-21 01:30701976----a-w-c:\windows\system32\wuapi.dll
2012-06-02 22:15 . 2012-06-21 01:302622464----a-w-c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-21 01:3099840----a-w-c:\windows\system32\wudriver.dll
2012-06-02 05:19 . 2012-06-21 01:30186752----a-w-c:\windows\system32\wuwebv.dll
2012-06-02 05:15 . 2012-06-21 01:3036864----a-w-c:\windows\system32\wuapp.exe
2012-05-31 02:25 . 2010-11-21 03:27279656------w-c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-08-17_01.18.36 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2012-08-17 01:1816384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-08-18 02:0016384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-08-17 01:1832768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-08-18 02:0032768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-08-17 01:1816384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-08-18 02:0016384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-11-21 03:09 . 2012-08-18 01:5645220 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-08-18 01:5633948 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2012-02-20 14:21 . 2012-08-18 01:568772 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-287257994-3657308481-2990875451-1000_UserData.bin
+ 2012-08-18 02:00 . 2012-08-18 02:002048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-08-17 01:18 . 2012-08-17 01:182048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:36 . 2012-08-17 01:11616080 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-08-18 01:59616080 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-08-17 01:11109106 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2012-08-18 01:59109106 c:\windows\system32\perfc009.dat
- 2009-07-14 05:01 . 2012-08-17 01:18468724 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-08-18 01:59468724 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-02-20 14:28 . 2012-08-18 01:591591888 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
- 2012-02-20 14:28 . 2012-08-17 01:181591888 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2012-02-22 12:10 . 2012-08-18 01:599754004 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-287257994-3657308481-2990875451-1000-12288.dat
- 2012-02-22 12:10 . 2012-08-17 01:189754004 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-287257994-3657308481-2990875451-1000-12288.dat
.
((((((((((((((((((((((((((((((((((((( «nµn¤JÂI ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*ª`·N* ªÅ¥Õ»P¦Xªk¯Ê¬Ùµn¿ý±N¤£·|³QÅã¥Ü
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:5894208----a-w-c:\users\Barbara\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:5894208----a-w-c:\users\Barbara\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:5894208----a-w-c:\users\Barbara\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HideWindowPlus"="d:\pp\HWinPlus.exe" [2009-04-08 784384]
"Sidebar"="c:\program files (x86)\Windows Sidebar\sidebar.exe" [2010-11-21 1174016]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2012-05-12 880496]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17418928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-06-11 641704]
"PlusService"="c:\program files (x86)\Yuna Software\Messenger Plus!\PlusService.exe" [2012-07-23 801792]
.
c:\users\Barbara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
AutoHotkey.ahk.lnk - d:\dropbox\RAWWRSS !! x]\AutoHotkey.ahk [2012-2-22 5839]
Dropbox.lnk - c:\users\Barbara\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-25 27112840]
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2011-9-2 245120]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security PackagesREG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804]
Ime FileREG_SZ JJ.IME
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-04 250056]
R3 athur;Wireless Network Adapter Service;c:\windows\system32\DRIVERS\athurx.sys [2011-04-19 1930240]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-11-02 33736]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [2010-06-25 36928]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-26 113120]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2012-02-20 48416]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620.sys [2012-02-20 32360]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2012-02-20 48416]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 VLAN;Realtek Virtual Miniport Driver for VLAN (NDIS 6.2);c:\windows\system32\DRIVERS\RtVLAN620.sys [2012-02-20 32360]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-02-22 1255736]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464]
R3 X6va008;X6va008;c:\windows\SysWOW64\Drivers\X6va008 [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-06-11 239616]
S2 HTCMonitorService;HTCMonitorService;c:\program files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [2012-06-08 87368]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2011-12-08 607456]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2011-12-16 161560]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2012-04-13 88576]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2012-02-20 32544]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-03-19 2666880]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2012-06-11 10248192]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2012-06-11 367616]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-11-03 130536]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-11-03 395752]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-02-23 95760]
S3 MEIx64;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECIx64.sys [2011-11-09 60184]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-09 539240]
.
.
¡¥p¹º¥ô°È¡¦ ¤å¥ó§¨ ¸Ìªº¤º®e
.
2012-08-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-09 10:59]
.
2012-08-18 c:\windows\Tasks\AutoKMS.job
- c:\windows\AutoKMS.exe [2012-02-23 05:37]
.
2012-08-18 c:\windows\Tasks\AutoKMSDaily.job
- c:\windows\AutoKMS.exe [2012-02-23 05:37]
.
2012-08-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-287257994-3657308481-2990875451-1000Core.job
- c:\users\Barbara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-28 04:17]
.
2012-08-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-287257994-3657308481-2990875451-1000UA.job
- c:\users\Barbara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-28 04:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:5897792----a-w-c:\users\Barbara\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:5897792----a-w-c:\users\Barbara\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:5897792----a-w-c:\users\Barbara\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:5897792----a-w-c:\users\Barbara\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-02-20 7560296]
"ndhuig"="c:\users\Barbara\AppData\Roaming\ndhuig.dll" [BU]
"psfcer"="c:\users\Barbara\AppData\Roaming\psfcer.dll" [BU]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files (x86)\Stardock\Fences\FencesMenu64.dll" [2010-06-22 253288]
.
------- ¦Ó¥~ªº±½´y -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Download with Mipony - file://c:\program files (x86)\MiPony\Browser\IEContext.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\07sxyaf5.alternate\
FF - prefs.js: browser.startup.homepage - hxxp://
www.mousehuntgame.com/
FF - user.js: extensions.autoDisableScopes - 14
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va008]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va008"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ ¨ä¥L¹B¦æ¶Iµ{ ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
.
**************************************************************************
.
§¹¦¨®É¶¡: 2012-08-18 12:01:16 - ¹q¸£¤w«·s±Ò°Ê
ComboFix-quarantined-files.txt 2012-08-18 02:01
ComboFix2.txt 2012-08-17 01:19
.
Pre-Run: 63,851,266,048 bytes free
Post-Run: 63,406,157,824 bytes free
.
- - End Of File - - 01D353B554C29302F711EEBDC839A24D