ComboFix 12-02-27.02 - cAst0r 2012-02-28 19:28:29.1.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1250.48.1045.18.8175.7150 [GMT 1:00] Uruchomiony z: c:\users\cAst0r\Desktop\ComboFix.exe AV: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5} SP: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Utworzono nowy punkt przywracania . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\ESET\EGUI.exe c:\programdata\ntuser.dat c:\users\cAst0r\AppData\Local\6585a94a c:\users\cAst0r\AppData\Local\6585a94a\@ c:\users\cAst0r\AppData\Local\6585a94a\U\80000000.@ c:\users\cAst0r\AppData\Local\6585a94a\U\800000cb.@ c:\users\cAst0r\AppData\Local\6585a94a\U\800000cf.@ c:\users\cAst0r\AppData\Local\6585a94a\X c:\users\cAst0r\AppData\Roaming\cfosspeed-x64-v660.exe c:\users\cAst0r\AppData\Roaming\chrtmp c:\users\cAst0r\AppData\Roaming\EurekaLog c:\windows\assembly\GAC_32\Desktop.ini c:\windows\assembly\GAC_64\Desktop.ini c:\windows\assembly\tmp\U c:\windows\assembly\tmp\U\00000001.@ c:\windows\assembly\tmp\U\000000c0.@ c:\windows\assembly\tmp\U\000000cb.@ c:\windows\assembly\tmp\U\000000cf.@ c:\windows\assembly\tmp\U\80000000.@ c:\windows\assembly\tmp\U\800000c0.@ c:\windows\assembly\tmp\U\800000cb.@ c:\windows\assembly\tmp\U\800000cf.@ c:\windows\RazorDOX c:\windows\RazorDOX\RazorDOX.dll c:\windows\system32\consrv.dll c:\windows\system32\dds_log_trash.cmd c:\windows\system32\rt2870.dll c:\windows\SysWow64\tmp13.tmp c:\windows\SysWow64\tmp17A4.tmp c:\windows\SysWow64\tmp17A5.tmp c:\windows\SysWow64\tmp2895.tmp c:\windows\SysWow64\tmp2896.tmp c:\windows\SysWow64\tmp30A2.tmp c:\windows\SysWow64\tmp30B2.tmp c:\windows\SysWow64\tmp906.tmp c:\windows\SysWow64\tmp907.tmp c:\windows\SysWow64\tmpFFF3.tmp c:\windows\Temp\_ex-68.exe . . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_XBCD . . ((((((((((((((((((((((((( Pliki utworzone od 2012-01-28 do 2012-02-28 ))))))))))))))))))))))))))))))) . . 2012-02-28 18:30 . 2012-02-28 18:30 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-02-28 18:30 . 2012-02-28 18:30 -------- d-----w- c:\users\Administrator\AppData\Local\temp 2012-02-27 18:06 . 2012-02-27 18:06 -------- d-----w- c:\windows\system32\Macromed 2012-02-27 17:18 . 2012-02-27 17:18 -------- d-sh--w- c:\windows\system32\%APPDATA% 2012-02-23 19:05 . 2012-02-23 19:05 -------- d-----w- c:\programdata\NVIDIA 2012-02-23 19:00 . 2012-02-10 03:14 6074176 ----a-w- c:\windows\system32\nvcpl.dll 2012-02-23 19:00 . 2012-02-10 03:14 3089728 ----a-w- c:\windows\system32\nvsvc64.dll 2012-02-23 19:00 . 2012-02-10 03:07 2561856 ----a-w- c:\windows\system32\nvsvcr.dll 2012-02-23 19:00 . 2012-02-10 03:07 889664 ----a-w- c:\windows\system32\nvvsvc.exe 2012-02-23 19:00 . 2012-02-10 03:07 63296 ----a-w- c:\windows\system32\nvshext.dll 2012-02-23 19:00 . 2012-02-10 03:07 118080 ----a-w- c:\windows\system32\nvmctray.dll 2012-02-23 19:00 . 2012-02-10 03:05 2497985 ----a-w- c:\windows\system32\nvcoproc.bin 2012-02-16 16:21 . 2012-02-16 21:14 -------- d-----w- c:\programdata\EA Logs 2012-02-07 15:55 . 2012-02-07 21:23 -------- d-----w- c:\users\cAst0r\AppData\Roaming\DMCache . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-02-28 00:17 . 2011-10-16 20:46 282864 ----a-w- c:\windows\SysWow64\PnkBstrB.exe 2012-02-28 00:17 . 2011-10-16 20:46 282864 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr 2012-02-28 00:16 . 2011-10-16 20:46 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0 2012-02-27 19:57 . 2011-09-15 17:40 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-02-16 16:21 . 2011-10-16 20:46 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe 2011-12-20 17:40 . 2011-12-20 17:40 16384 ----a-w- c:\windows\system32\drivers\EIO64.sys . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyœlne, prawidłowe wpisy nie sš pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "XFastUsb"="c:\program files (x86)\XFastUsb\XFastUsb.exe" [2011-09-10 4942336] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2011-10-9 1207312] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "DisableThumbnails"= 0 (0x0) "TaskbarNoNotification"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer5"=wdmaud.drv . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 Sentinel64;Sentinel64;c:\windows\System32\Drivers\Sentinel64.sys [x] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x] R3 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-09-29 1431888] R3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [x] R3 IOMap;IOMap;c:\windows\system32\drivers\IOMap64.sys [x] R3 kxwdmdrv;kX WDM Driver Service;c:\windows\system32\drivers\kx.sys [x] R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x] R3 tizekdrv;tizekdrv;c:\users\cAst0r\AppData\Roaming\TZAC\tizek64.sys [2011-09-20 241848] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [x] R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R4 Autodesk Content Service;Autodesk Content Service;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2011-02-02 18656] R4 ekrn;ESET Service;c:\program files\ESET\x86\ekrn.exe [2011-01-12 810144] R4 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x] S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [x] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x] S1 EIO64;EIO Driver;c:\windows\system32\DRIVERS\EIO64.sys [x] S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [x] S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x] S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [x] S3 cmudaxp;ASUS Xonar D1 Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [x] S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys [x] S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys [x] S3 hidusbf;USB Mouse Rate Adjuster Lower Filter by SweetLow;c:\windows\system32\DRIVERS\hidusbf.sys [x] S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] . . --- Inne Usługi/Sterowniki w Pamięci --- . *NewlyCreated* - WS2IFSL . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "combofix"="c:\combofix\CF25448.3XE" [2010-11-21 345088] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs XBCD . ------- Skan uzupełniajšcy ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://onet.pl/ mLocal Page = c:\windows\SysWOW64\blank.htm IE: ????3?? IE: ????3?????? IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 IE: Pobierz FlashGetem3 - c:\users\cAst0r\AppData\Roaming\FlashGetBHO\GetUrl.htm IE: Pobierz wszystko FlashGetem3 - c:\users\cAst0r\AppData\Roaming\FlashGetBHO\GetAllUrl.htm IE: Œcišgnij przy pomocy FlashGet'a - c:\program files (x86)\FlashGet\jc_link.htm IE: Œcišgnij wszystko przy pomocy FlashGet'a - c:\program files (x86)\FlashGet\jc_all.htm IE: ????3?? - c:\users\cAst0r\AppData\Roaming\FlashGetBHO\GetUrl.htm IE: ????3?????? - c:\users\cAst0r\AppData\Roaming\FlashGetBHO\GetAllUrl.htm TCP: DhcpNameServer = 62.179.1.62 62.179.1.63 0.0.0.0 FF - ProfilePath - c:\users\cAst0r\AppData\Roaming\Mozilla\Firefox\Profiles\hkjgvmq5.default\ FF - prefs.js: browser.startup.homepage - www.onet.pl . - - - - USUNIĘTO PUSTE WPISY - - - - . HKLM-Run-egui - c:\program files\ESET\egui.exe . . . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b0,b4,09,7b,bc,f9,a8,42,be,73,55,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b0,b4,09,7b,bc,f9,a8,42,be,73,55,\ . [HKEY_USERS\S-1-5-21-179643350-3452753548-535153788-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f3* N}] @="c:\\Users\\cAst0r\\AppData\\Roaming\\FlashGetBHO\\GetUrl.htm" "contexts"=dword:00000022 . [HKEY_USERS\S-1-5-21-179643350-3452753548-535153788-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f3* N}hQčţ”Ľc] @="c:\\Users\\cAst0r\\AppData\\Roaming\\FlashGetBHO\\GetAllUrl.htm" "contexts"=dword:000000f3 . [HKEY_USERS\S-1-5-21-179643350-3452753548-535153788-1000\Software\SecuROM\License information*] "datasecu"=hex:96,f1,67,05,a5,03,b0,77,a7,33,fc,cd,fe,fa,31,94,79,7e,44,0e,b8, a9,73,18,98,95,6d,50,66,69,b8,d4,49,d7,0e,d8,29,1b,c9,06,fb,b6,de,9d,d5,53,\ "rkeysecu"=hex:5e,46,55,01,e2,42,07,3e,77,e3,4a,43,3a,5b,d9,f2 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\SysWOW64\ASDR.exe c:\windows\SysWOW64\PnkBstrA.exe . ************************************************************************** . Czas ukończenia: 2012-02-28 19:34:00 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2012-02-28 18:34 . Przed: 46 875 754 496 bajtów wolnych Po: 46 425 088 000 bajtów wolnych . - - End Of File - - C79036DD075BF3E2C05ACDA40B81385E