ComboFix 12-07-18.04 - Mateusz 2012-07-18 17:15:00.3.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.502.101 [GMT 2:00] Uruchomiony z: c:\documents and settings\Mateusz\Pulpit\ComboFix.exe AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D} * Utworzono nowy punkt przywracania . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\data c:\documents and settings\All Users\Dane aplikacji\TEMP c:\windows\Installer\{b0ca8efd-5cf3-b5ad-fd8e-83f08a05f23b}\@ c:\windows\Installer\{b0ca8efd-5cf3-b5ad-fd8e-83f08a05f23b}\n c:\windows\Installer\{b0ca8efd-5cf3-b5ad-fd8e-83f08a05f23b}\U\00000001.@ c:\windows\system32\SET25E.tmp . . ((((((((((((((((((((((((( Pliki utworzone od 2012-06-18 do 2012-07-18 ))))))))))))))))))))))))))))))) . . 2012-07-18 14:08 . 2012-07-18 14:08 -------- d-----w- c:\documents and settings\Mateusz\DoctorWeb 2012-07-18 13:21 . 2012-07-18 13:21 -------- d-----w- c:\documents and settings\Mateusz\Dane aplikacji\Malwarebytes 2012-07-18 13:20 . 2012-07-18 13:20 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Malwarebytes 2012-07-18 13:20 . 2012-07-03 11:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-07-16 11:58 . 2012-07-16 11:58 -------- d-----w- C:\ST_NG_SetupWizard 2012-07-09 13:48 . 2012-07-16 12:00 -------- d-----w- c:\program files\Thomson 2012-07-09 13:37 . 2012-07-09 13:37 -------- d-----w- c:\documents and settings\Mateusz\Ustawienia lokalne\Dane aplikacji\AskToolbar 2012-07-09 13:12 . 2012-07-09 13:12 -------- d--h--w- c:\windows\PIF 2012-07-09 12:51 . 2012-07-09 12:51 32000 ----a-w- c:\windows\system32\drivers\stppp.sys 2012-07-09 12:33 . 2012-07-03 16:21 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2012-07-09 12:33 . 2012-07-03 16:21 353688 ----a-w- c:\windows\system32\drivers\aswSP.sys 2012-07-09 12:33 . 2012-07-03 16:21 113776 ----a-w- c:\windows\system32\drivers\aswFW.sys 2012-07-09 12:33 . 2012-07-03 16:21 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2012-07-09 12:33 . 2012-07-03 16:21 202928 ----a-w- c:\windows\system32\drivers\aswNdis2.sys 2012-07-09 12:33 . 2012-07-03 16:21 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2012-07-09 12:33 . 2012-07-03 16:21 721000 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2012-07-09 12:33 . 2012-07-03 16:21 18544 ----a-w- c:\windows\system32\drivers\aswKbd.sys 2012-07-09 12:32 . 2012-07-03 16:21 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2012-07-09 12:32 . 2012-07-03 16:21 89624 ----a-w- c:\windows\system32\drivers\aswmon.sys 2012-07-09 12:32 . 2012-07-03 16:21 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2012-07-09 12:30 . 2012-06-27 20:33 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys 2012-07-09 12:30 . 2012-07-03 16:21 41224 ----a-w- c:\windows\avastSS.scr 2012-07-09 12:30 . 2012-07-03 16:21 227648 ----a-w- c:\windows\system32\aswBoot.exe 2012-07-09 11:28 . 2012-07-09 11:28 40320 ----a-w- c:\windows\system32\drivers\steth.sys 2012-07-09 11:28 . 2012-07-09 11:28 30464 ----a-w- c:\windows\system32\drivers\st330.sys 2012-07-09 11:28 . 2012-07-09 11:28 12672 ----a-w- c:\windows\system32\drivers\stbus.sys 2012-07-09 11:28 . 2012-07-09 11:28 16128 ----a-w- c:\windows\system32\drivers\lpwdm.sys 2012-07-08 18:22 . 2012-07-08 18:22 5536 ----a-w- c:\windows\system32\d3d9caps.tmp 2012-07-08 18:05 . 2012-07-08 18:06 -------- d-----w- c:\documents and settings\Administrator 2012-07-08 18:03 . 2012-07-08 18:03 -------- d-----w- c:\documents and settings\Rodzice\Dane aplikacji\hellomoto 2012-07-07 06:11 . 2012-07-07 06:11 -------- d-----w- c:\documents and settings\Mateusz\Dane aplikacji\hellomoto 2012-07-04 09:16 . 2012-07-04 10:56 -------- d-----w- c:\program files\Google 2012-06-27 12:31 . 2012-06-27 12:31 -------- d-----w- c:\documents and settings\Rodzice\Dane aplikacji\IObit 2012-06-27 06:48 . 2012-06-27 06:48 -------- d-----w- c:\documents and settings\NetworkService\Ustawienia lokalne\Dane aplikacji\ant.com 2012-06-27 06:46 . 2012-06-27 06:46 -------- d-----w- c:\windows\system32\config\systemprofile\Dane aplikacji\IObit 2012-06-26 18:29 . 2012-02-23 12:25 21336 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe 2012-06-26 18:08 . 2012-06-26 18:08 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\IObit 2012-06-26 18:08 . 2012-06-29 15:11 -------- d-----w- c:\documents and settings\Mateusz\Dane aplikacji\IObit 2012-06-25 14:04 . 2012-06-25 14:04 1394248 ----a-w- c:\windows\system32\msxml4.dll 2012-06-23 21:37 . 2012-06-23 21:37 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache 2012-06-23 21:35 . 2012-06-23 21:43 -------- d-----w- c:\program files\TuneUp Utilities 2012 2012-06-23 20:36 . 2012-06-23 20:36 -------- d--h--w- c:\documents and settings\All Users\Dane aplikacji\Common Files . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-16 08:37 . 2012-04-02 20:13 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-07-16 08:37 . 2011-06-03 12:02 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-06-13 13:55 . 2009-03-22 22:44 1875328 ----a-w- c:\windows\system32\win32k.sys 2012-06-05 15:48 . 2009-01-30 14:29 1172480 ----a-w- c:\windows\system32\msxml3.dll 2012-06-05 15:48 . 2009-01-30 14:29 1447936 ----a-w- c:\windows\system32\msxml6.dll 2012-06-04 04:31 . 2009-03-22 22:45 153088 ----a-w- c:\windows\system32\schannel.dll 2012-06-02 13:19 . 2011-04-16 15:44 329240 ----a-w- c:\windows\system32\wucltui.dll 2012-06-02 13:19 . 2011-04-16 15:44 219160 ----a-w- c:\windows\system32\wuaucpl.cpl 2012-06-02 13:19 . 2011-04-16 15:44 210968 ----a-w- c:\windows\system32\wuweb.dll 2012-06-02 13:19 . 2009-08-06 14:54 15896 ----a-w- c:\windows\system32\wuapi.dll.mui 2012-06-02 13:19 . 2009-08-06 14:54 24088 ----a-w- c:\windows\system32\wucltui.dll.mui 2012-06-02 13:19 . 2011-04-16 15:44 53784 ----a-w- c:\windows\system32\wuauclt.exe 2012-06-02 13:19 . 2011-04-16 15:44 35864 ----a-w- c:\windows\system32\wups.dll 2012-06-02 13:19 . 2009-08-06 14:54 45080 ----a-w- c:\windows\system32\wups2.dll 2012-06-02 13:19 . 2008-04-14 16:50 97304 ----a-w- c:\windows\system32\cdm.dll 2012-06-02 13:19 . 2009-08-06 14:54 16408 ----a-w- c:\windows\system32\wuaucpl.cpl.mui 2012-06-02 13:19 . 2011-04-16 15:44 577048 ----a-w- c:\windows\system32\wuapi.dll 2012-06-02 13:19 . 2011-04-16 15:44 1933848 ----a-w- c:\windows\system32\wuaueng.dll 2012-06-02 13:19 . 2009-08-06 14:53 18968 ----a-w- c:\windows\system32\wuaueng.dll.mui 2012-06-02 13:18 . 2011-04-18 14:23 275696 ----a-w- c:\windows\system32\mucltui.dll 2012-06-02 13:18 . 2011-04-18 14:23 214256 ----a-w- c:\windows\system32\muweb.dll 2012-06-02 13:18 . 2011-04-18 14:23 18160 ----a-w- c:\windows\system32\mucltui.dll.mui 2012-05-31 13:22 . 2008-04-14 16:50 602624 ----a-w- c:\windows\system32\crypt32.dll 2012-05-16 15:09 . 2008-10-16 17:33 916992 ----a-w- c:\windows\system32\wininet.dll 2012-05-11 14:44 . 2008-10-16 17:33 1469440 ----a-w- c:\windows\system32\inetcpl.cpl 2012-05-11 14:44 . 2008-05-08 14:01 43520 ----a-w- c:\windows\system32\licmgr10.dll 2012-05-11 11:39 . 2008-05-08 14:01 385024 ----a-w- c:\windows\system32\html.iec 2012-05-05 03:14 . 2009-01-30 14:29 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-05-05 03:14 . 2008-08-14 13:57 2028032 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-05-02 13:47 . 2011-04-16 15:42 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-03-17 13:15 . 2012-02-03 08:40 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2008-05-08 . 9F02C1CF7C3100E4AEA7DD8B6A86A01B . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2012-07-03 16:21 121528 ----a-w- d:\programy\avastinternetsecurity\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="c:\program files\AutoConnect\AutoConnect.exe" [2006-12-02 310784] "AQQ"="d:\programy\WAPSTE~1\AQQ.exe" [2012-07-16 10354176] "Advanced SystemCare 5"="d:\programy\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "VirtualCloneDrive"="d:\programy\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "lxdxmon.exe"="c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe" [2008-06-13 668328] "lxdxamon"="c:\program files\Lexmark 3600-4600 Series\lxdxamon.exe" [2008-06-13 16040] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-06-06 1564872] "HTC Sync Loader"="c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2012-04-17 651264] "Sage Komunikator"="c:\program files\Sage\Komunikator\SageUpdt.exe" [2010-11-15 247008] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296] "QuickTime Task"="d:\programy\quicktime\QTTask.exe" [2012-04-18 421888] "avast"="d:\programy\avastinternetsecurity\avastUI.exe" [2012-07-03 4273976] "diagnostics"="c:\program files\Thomson\ST330\diagnostics\diagnostics.exe" [2012-07-16 557149] "Malwarebytes' Anti-Malware"="d:\programy\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="c:\documents and settings\All Users\Dane aplikacji\TuneUp Software\TuneUp Utilities 2012\WinStyler\tu_logonui.exe" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" "lxdxamon"="c:\program files\Lexmark 3600-4600 Series\lxdxamon.exe" "igfxhkcmd"=c:\windows\system32\hkcmd.exe "igfxpers"=c:\windows\system32\igfxpers.exe "CloneCDTray"="c:\program files\CloneCD\CloneCDTray.exe" /s . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "FirewallOverride"=dword:00000001 . R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [2012-07-09 12112] R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [2012-07-09 202928] R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [2012-07-09 113776] R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [2012-07-09 18544] R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-07-09 721000] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-07-09 353688] R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;d:\programy\Advanced SystemCare 5\ASCService.exe [2012-06-26 913792] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-07-09 21256] R2 avast! Firewall;avast! Firewall;d:\programy\avastinternetsecurity\afwServ.exe [2012-07-09 133912] R2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?] R2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdxserv.exe [2011-07-18 98984] R2 MBAMService;MBAMService;d:\programy\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-18 655944] R2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [2011-09-15 88576] R2 PStrip;PSTRIP;c:\windows\system32\drivers\pstrip.sys [2007-07-15 27992] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-18 22344] R3 ST330;ST330;c:\windows\system32\drivers\st330.sys [2012-07-09 30464] R3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [2012-07-09 12672] R3 stppp;Speedtouch PPP Adapter Adapter;c:\windows\system32\drivers\stppp.sys [2012-07-09 32000] S2 AntUpdaterService;Ant Toolbar updater service;c:\program files\Ant.com\IE add-on\AntUpdaterService.exe [2011-06-29 520216] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 250056] S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [2012-01-21 24576] S3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\drivers\htcnprot.sys [2011-11-27 21248] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880] S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-02-05 114160] S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000] S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanBZXP.sys [2012-03-22 402432] S3 STETH;SpeedTouch Ethernet Adapter NT Driver;c:\windows\system32\drivers\steth.sys [2012-07-09 40320] . Zawartość folderu 'Zaplanowane zadania' . 2012-07-18 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 08:37] . 2012-07-17 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57] . 2012-07-18 c:\windows\Tasks\ASC5_AutoClean.job - d:\programy\Advanced SystemCare 5\AutoSweep.exe [2012-06-26 08:45] . 2012-07-17 c:\windows\Tasks\ASC5_AutoUpdate.job - d:\programy\Advanced SystemCare 5\AutoUpdate.exe [2012-06-26 16:33] . 2012-07-18 c:\windows\Tasks\ASC5_PerformanceMonitor.job - d:\programy\Advanced SystemCare 5\PMonitor.exe [2012-06-26 08:46] . 2012-07-18 c:\windows\Tasks\avast! Emergency Update.job - d:\programy\avastinternetsecurity\AvastEmUpdate.exe [2012-07-09 16:21] . 2012-07-18 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1606980848-220523388-2146935855-1003.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2011-11-29 15:02] . 2012-07-10 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1606980848-220523388-2146935855-1003.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2011-11-29 15:02] . 2012-07-18 c:\windows\Tasks\User_Feed_Synchronization-{3FC5AB0D-3BF7-443D-9C49-5EE761465E7B}.job - c:\windows\system32\msfeedssync.exe [2008-05-08 02:31] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://pl.v9.com/?utm_source=b&utm_medium=vlt mStart Page = hxxp://pl.v9.com/?utm_source=b&utm_medium=vlt IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000 TCP: Interfaces\{240DC072-24EA-4D0A-B8AA-47F618757AB1}: NameServer = 194.204.152.34 194.204.159.1 FF - ProfilePath - c:\documents and settings\Mateusz\Dane aplikacji\Mozilla\Firefox\Profiles\cmmgyusg.default-1341590226656\ FF - prefs.js: browser.search.selectedEngine - Ask.com FF - prefs.js: browser.startup.homepage - google.pl FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=FF&o=14594&locale=en_US&apn_uid=91d3aba8-3b89-460a-b07d-64e232630fb0&apn_ptnrs=FV&apn_sauid=92AE45EC-9B64-42E6-97CC-4B9147D243ED&apn_dtid=YYYYYYYYPL&&q= . - - - - USUNIĘTO PUSTE WPISY - - - - . URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-07-18 17:26 Windows 5.1.2600 Dodatek Service Pack 3 NTFS . skanowanie ukrytych procesów ... . skanowanie ukrytych wpisów autostartu ... . skanowanie ukrytych plików ... . skanowanie pomyślnie ukończone ukryte pliki: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\st330service] "ImagePath"="C:\Program Files/Thomson/ST330/service/st330service.exe -service" . Czas ukończenia: 2012-07-18 17:28:40 ComboFix-quarantined-files.txt 2012-07-18 15:28 ComboFix2.txt 2012-02-18 11:22 ComboFix3.txt 2011-06-20 15:39 . Przed: 2 370 060 288 bajtów wolnych Po: 2 750 664 704 bajtów wolnych . - - End Of File - - 174169112DCC4BF30791153F8C1B8C10