ComboFix 11-10-29.03 - Prezes 2011-10-29 13:42:36.2.2 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1250.48.1045.18.1982.1003 [GMT 2:00] Uruchomiony z: c:\users\Prezes\Desktop\ComboFix.exe Użyto następujących komend :: c:\users\Prezes\Desktop\CFScript.txt SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\windows\SysWow64\hrlorkds.exe" "c:\windows\SysWow64\msezcsokd.dll" "c:\windows\SysWow64\mswznsoke.dll" . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Prezes\AppData\Local\Temp\ae201572-4813-4010-9ed2-ee29ddec066a\CliSecureRT.dll c:\windows\SysWow64\hrlorkds.exe c:\windows\SysWow64\msezcsokd.dll c:\windows\SysWow64\mswznsoke.dll . . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_qacllhjxcqyzlp . . ((((((((((((((((((((((((( Pliki utworzone od 2011-09-28 do 2011-10-29 ))))))))))))))))))))))))))))))) . . 2011-10-28 20:50 . 2011-10-28 20:50 -------- d-----w- c:\program files (x86)\Exifer 2011-10-28 19:42 . 2011-10-28 19:42 -------- d-----w- c:\windows\system32\Macromed 2011-10-28 19:32 . 2011-10-28 19:32 -------- d-----w- c:\users\Prezes\AppData\Local\Rellik_Software 2011-10-28 19:32 . 2011-10-28 19:32 -------- d-----w- c:\users\Prezes\AppData\Roaming\EXIF Date Changer 2011-10-28 19:32 . 2011-10-28 20:37 -------- d-----w- c:\program files (x86)\EXIF Date Changer 2011-10-21 08:51 . 2011-10-21 08:51 -------- d-----w- c:\program files (x86)\Common Files\Java 2011-10-16 23:48 . 2011-10-16 23:48 -------- d-----w- c:\program files (x86)\Microsoft Silverlight 2011-10-14 22:37 . 2011-10-14 22:37 -------- d-----w- c:\users\Prezes\AppData\Roaming\Echo Software 2011-10-14 22:37 . 2011-10-14 22:37 -------- d-----w- c:\program files (x86)\Programmer's Notepad 2011-10-10 17:13 . 2011-10-10 17:13 -------- d-----w- c:\users\Prezes\AppData\Roaming\inkscape 2011-10-10 17:10 . 2011-10-10 17:13 -------- d-----w- c:\program files (x86)\Inkscape 2011-10-09 08:29 . 2011-10-09 08:29 -------- d-----w- c:\windows\SysWow64\Wat 2011-10-09 08:29 . 2011-10-09 08:29 -------- d-----w- c:\windows\system32\Wat 2011-10-09 08:11 . 2011-10-09 08:11 -------- d-----w- c:\program files (x86)\MSXML 4.0 2011-10-08 17:54 . 2011-10-08 17:56 -------- d-----w- c:\users\Prezes\AppData\Local\Nero 2011-10-08 17:49 . 2011-10-08 17:49 -------- d-----w- c:\users\Prezes\AppData\Roaming\Full 2011-10-08 17:49 . 2011-10-08 17:49 -------- d-----w- c:\program files (x86)\Full Video Converter 9 2011-10-08 17:41 . 2011-10-08 17:41 -------- d-----w- c:\program files (x86)\FoxTabMusicConverter 2011-10-08 17:41 . 2011-10-08 17:41 -------- d-----w- c:\users\Prezes\AppData\Local\Babylon 2011-10-08 17:41 . 2011-10-08 17:41 -------- d-----w- c:\users\Prezes\AppData\Roaming\Babylon 2011-10-08 17:41 . 2011-10-08 17:41 -------- d-----w- c:\programdata\Babylon 2011-10-08 08:11 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll 2011-10-08 08:11 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2011-10-08 08:09 . 2011-02-19 12:03 46080 ----a-w- c:\windows\system32\atmlib.dll 2011-10-08 08:07 . 2011-06-23 05:43 5561216 ----a-w- c:\windows\system32\ntoskrnl.exe 2011-10-08 08:07 . 2011-06-23 04:33 3967872 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2011-10-08 08:07 . 2011-06-23 04:33 3912576 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2011-10-08 08:06 . 2011-09-21 07:00 9049936 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E3112F77-7073-4C78-912C-10E601F421BE}\mpengine.dll 2011-10-07 16:32 . 2011-10-07 16:33 -------- d-----w- c:\users\Prezes\AppData\Local\Google 2011-10-07 16:32 . 2011-10-07 16:32 -------- d-----w- c:\program files (x86)\Google 2011-10-07 16:31 . 2011-10-07 16:31 -------- d-----w- c:\windows\pl 2011-10-07 16:24 . 2011-10-07 16:24 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition 2011-10-07 16:19 . 2011-10-07 16:23 -------- d-----w- c:\program files (x86)\Windows Live 2011-10-07 16:18 . 2009-09-04 15:44 69464 ----a-w- c:\windows\SysWow64\XAPOFX1_3.dll 2011-10-07 16:18 . 2009-09-04 15:44 515416 ----a-w- c:\windows\SysWow64\XAudio2_5.dll 2011-10-07 16:18 . 2009-09-04 15:29 453456 ----a-w- c:\windows\SysWow64\d3dx10_42.dll 2011-10-07 16:18 . 2009-09-04 15:29 523088 ----a-w- c:\windows\system32\d3dx10_42.dll 2011-10-07 16:17 . 2006-11-29 11:06 4398360 ----a-w- c:\windows\system32\d3dx9_32.dll 2011-10-07 16:17 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\SysWow64\d3dx9_32.dll 2011-10-07 16:16 . 2011-10-08 19:58 -------- d-----w- c:\users\Prezes\AppData\Local\Windows Live 2011-10-07 16:16 . 2011-10-07 16:16 -------- d-----w- c:\program files (x86)\Common Files\Windows Live 2011-10-03 11:09 . 2011-10-03 11:09 -------- d-----w- C:\Temp 2011-10-03 11:08 . 2011-10-03 11:08 -------- d-----w- c:\users\Prezes\AppData\Local\Samsung 2011-10-03 11:06 . 2010-12-21 05:55 18944 ----a-w- c:\windows\system32\drivers\sscemdfl.sys 2011-10-03 11:05 . 2011-10-03 11:05 -------- d-----w- c:\users\Prezes\AppData\Local\Downloaded Installations 2011-10-02 20:33 . 2011-10-17 13:36 -------- d-----w- c:\users\Prezes\AppData\Roaming\PLAY ONLINE . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-28 19:42 . 2011-06-11 20:07 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-10-09 23:04 . 2010-11-21 03:24 14848 ----a-w- c:\windows\system32\slwga.dll 2011-10-09 23:04 . 2010-11-21 03:24 419840 ----a-w- c:\windows\system32\systemcpl.dll 2011-10-09 23:04 . 2010-11-21 03:23 13824 ----a-w- c:\windows\SysWow64\slwga.dll 2011-10-09 23:04 . 2010-11-21 03:24 833024 ----a-w- c:\windows\SysWow64\user32.dll 2011-10-09 23:04 . 2010-11-21 03:24 1008640 ----a-w- c:\windows\system32\user32.dll 2011-10-07 16:19 . 2011-03-28 16:36 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-10-03 03:06 . 2011-07-25 17:18 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll 2011-09-16 09:54 . 2011-09-16 09:54 90112 ----a-w- c:\windows\MAMCityDownload.ocx 2011-09-16 09:54 . 2011-09-16 09:54 325552 ----a-w- c:\windows\MASetupCaller.dll 2011-09-16 09:54 . 2011-09-16 09:54 30568 ----a-w- c:\windows\MusiccityDownload.exe 2011-09-16 09:54 . 2011-09-16 09:54 974848 ----a-w- c:\windows\SysWow64\cis-2.4.dll 2011-09-16 09:54 . 2011-09-16 09:54 81920 ----a-w- c:\windows\SysWow64\issacapi_bs-2.3.dll 2011-09-16 09:54 . 2011-09-16 09:54 65536 ----a-w- c:\windows\SysWow64\issacapi_pe-2.3.dll 2011-09-16 09:54 . 2011-09-16 09:54 57344 ----a-w- c:\windows\SysWow64\MTXSYNCICON.dll 2011-09-16 09:54 . 2011-09-16 09:54 57344 ----a-w- c:\windows\SysWow64\MK_Lyric.dll 2011-09-16 09:54 . 2011-09-16 09:54 57344 ----a-w- c:\windows\SysWow64\issacapi_se-2.3.dll 2011-09-16 09:54 . 2011-09-16 09:54 569344 ----a-w- c:\windows\SysWow64\muzdecode.ax 2011-09-16 09:54 . 2011-09-16 09:54 491520 ----a-w- c:\windows\SysWow64\muzapp.dll 2011-09-16 09:54 . 2011-09-16 09:54 49152 ----a-w- c:\windows\SysWow64\MaJGUILib.dll 2011-09-16 09:54 . 2011-09-16 09:54 45056 ----a-w- c:\windows\SysWow64\MaXMLProto.dll 2011-09-16 09:54 . 2011-09-16 09:54 45056 ----a-w- c:\windows\SysWow64\MACXMLProto.dll 2011-09-16 09:54 . 2011-09-16 09:54 40960 ----a-w- c:\windows\SysWow64\MTTELECHIP.dll 2011-09-16 09:54 . 2011-09-16 09:54 40960 ----a-w- c:\windows\SysWow64\MAMACExtract.dll 2011-09-16 09:54 . 2011-09-16 09:54 352256 ----a-w- c:\windows\SysWow64\MSLUR71.dll 2011-09-16 09:54 . 2011-09-16 09:54 258048 ----a-w- c:\windows\SysWow64\muzoggsp.ax 2011-09-16 09:54 . 2011-09-16 09:54 245760 ----a-w- c:\windows\SysWow64\MSCLib.dll 2011-09-16 09:54 . 2011-09-16 09:54 24576 ----a-w- c:\windows\SysWow64\MASetupCleaner.exe 2011-09-16 09:54 . 2011-09-16 09:54 200704 ----a-w- c:\windows\SysWow64\muzwmts.dll 2011-09-16 09:54 . 2011-09-16 09:54 155648 ----a-w- c:\windows\SysWow64\MSFLib.dll 2011-09-16 09:54 . 2011-09-16 09:54 143360 ----a-w- c:\windows\SysWow64\3DAudio.ax 2011-09-16 09:54 . 2011-09-16 09:54 135168 ----a-w- c:\windows\SysWow64\muzaf1.dll 2011-09-16 09:54 . 2011-09-16 09:54 131072 ----a-w- c:\windows\SysWow64\muzmpgsp.ax 2011-09-16 09:54 . 2011-09-16 09:54 122880 ----a-w- c:\windows\SysWow64\muzeffect.ax 2011-09-16 09:54 . 2011-09-16 09:54 118784 ----a-w- c:\windows\SysWow64\MaDRM.dll 2011-09-16 09:54 . 2011-09-16 09:54 110592 ----a-w- c:\windows\SysWow64\muzmp4sp.ax . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [7] 2010-11-21 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll [-] 2011-10-09 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll . [-] 2011-10-09 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll [7] 2010-11-21 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll . ((((((((((((((((((((((((((((( SnapShot@2011-10-29_07.58.43 ))))))))))))))))))))))))))))))))))))))))) . + 2010-11-21 03:09 . 2011-10-29 08:45 36722 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin - 2009-07-14 05:10 . 2011-10-29 07:25 41638 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2011-10-29 08:45 41638 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin - 2011-06-11 20:38 . 2011-10-29 07:24 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-06-11 20:38 . 2011-10-29 08:44 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-06-11 20:38 . 2011-10-29 07:24 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2011-06-11 20:38 . 2011-10-29 08:44 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-06-11 20:38 . 2011-10-29 07:24 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-06-11 20:38 . 2011-10-29 08:44 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-06-11 20:38 . 2011-10-29 07:29 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-06-11 20:38 . 2011-10-29 11:28 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-06-11 20:38 . 2011-10-29 07:29 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-06-11 20:38 . 2011-10-29 11:28 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-06-11 20:39 . 2011-10-29 08:45 9738 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1655922889-1840272266-2703523318-1001_UserData.bin + 2011-10-29 11:49 . 2011-10-29 11:49 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-10-29 07:58 . 2011-10-29 07:58 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-10-29 07:58 . 2011-10-29 07:58 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-10-29 11:49 . 2011-10-29 11:49 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-06-11 23:41 . 2011-10-29 11:26 235220 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin - 2011-06-11 23:41 . 2011-10-28 15:51 235220 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin + 2011-06-26 20:16 . 2011-10-29 11:48 824704 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat - 2011-06-26 20:16 . 2011-10-29 07:57 824704 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2009-07-14 05:01 . 2011-10-29 11:48 346228 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2011-10-29 07:57 346228 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2011-06-11 20:22 . 2011-10-29 07:57 8356684 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1655922889-1840272266-2703523318-1001-8192.dat + 2011-06-11 20:22 . 2011-10-29 11:48 8356684 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1655922889-1840272266-2703523318-1001-8192.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-06-15 17093512] "Gadu-Gadu 10"="c:\program files (x86)\Gadu-Gadu 10\gg.exe" [2011-06-01 13349472] "HW_OPENEYE_OUC_PLAY ONLINE"="c:\program files (x86)\PLAY ONLINE\UpdateDog\ouc.exe" [2009-04-14 110592] "KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-09-29 20880] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "CTStartup"="c:\program files (x86)\Creative\Splash Screen\CTEaxSpl.EXE" [2001-12-19 28672] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "NBAgent"="c:\program files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2010-04-02 1234216] "E-Color Registration"="c:\program files (x86)\E-Color\Registration\SonnReg.exe" [2000-02-17 118784] "EasyDownloads"="c:\program files (x86)\Easy Downloads\easydownloads.exe" [2011-09-02 849944] "KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2011-09-29 929680] "KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2011-09-29 3508112] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] . c:\users\Prezes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ restart_vs.lnk - G:\Viewsonic.exe [N/A] TB-Tray.lnk - c:\program files (x86)\Thunderbird-Tray\TBTray.exe [2005-11-8 38912] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Colorific.lnk - c:\program files (x86)\E-Color\Colorific\hgcctl95.exe [2011-8-2 65536] SonnReg.lnk - c:\program files (x86)\E-Color\Registration\SonnReg.exe [2011-8-2 118784] TB-Tray.lnk - c:\program files (x86)\Thunderbird-Tray\TBTray.exe [2005-11-8 38912] True Internet Color Icon.lnk - c:\program files (x86)\E-Color\True Internet Color\TICIcon.exe [2011-8-2 221184] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "EnableLinkedConnections"= 1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x] R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x] R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [x] R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [x] R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [x] R3 ssceserd;SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM);c:\windows\system32\DRIVERS\ssceserd.sys [x] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [2010-11-16 339456] S2 MSSQL$INSERTGT;SQL Server (INSERTGT);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408] S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-03-25 490280] S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x] S3 RTL8167;Sterownik Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] . . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "combofix"="c:\combofix\CF28762.3XE" [2010-11-21 345088] . ------- Skan uzupełniający ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://search.babylon.com/?babsrc=HP_ss&affID=100474&mntrId=1c30bc75000000000000f46d04024a35 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 TCP: DhcpNameServer = 194.204.152.34 194.204.159.1 FF - ProfilePath - c:\users\Prezes\AppData\Roaming\Mozilla\Firefox\Profiles\ubmp83he.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/ . . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files (x86)\Bonjour\mDNSResponder.exe c:\windows\SysWOW64\CTsvcCDA.EXE c:\program files (x86)\Mozilla Thunderbird\thunderbird.exe c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe . ************************************************************************** . Czas ukończenia: 2011-10-29 13:53:34 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2011-10-29 11:53 ComboFix2.txt 2011-10-29 08:02 . Przed: 74 961 002 496 bajtów wolnych Po: 74 665 435 136 bajtów wolnych . - - End Of File - - 8E78273983048199F9E1C192923F376E