ComboFix 12-09-09.02 - Madzia 2012-09-10 9:55.1.2 - x86 MINIMAL Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.48.1033.18.2813.2343 [GMT 2:00] Uruchomiony z: c:\users\Madzia\Desktop\ComboFix.exe AV: ESET Smart Security 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1} FW: ESET Personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA} SP: ESET Smart Security 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\StartSearch plugin c:\program files\StartSearch plugin\IEhelperActiveX.dll c:\program files\StartSearch plugin\startsplg.crx c:\program files\StartSearch plugin\uninst.exe c:\users\Madzia\ms.exe c:\windows\system32\8c500afa.dll c:\windows\system32\aa7d35c6.exe c:\windows\system32\pt c:\windows\system32\pt\smartfacevcp.dll.mui c:\windows\system32\pt\toscdspd.cpl.mui c:\windows\system32\tmp2FB8.tmp c:\windows\system32\tmp2FD8.tmp . . ((((((((((((((((((((((((( Pliki utworzone od 2012-08-10 do 2012-09-10 ))))))))))))))))))))))))))))))) . . 2012-09-10 08:01 . 2012-09-10 08:02 -------- d-----w- c:\users\Madzia\AppData\Local\temp 2012-09-10 08:01 . 2012-09-10 08:01 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-09-09 20:04 . 2012-09-09 20:04 -------- d-----w- c:\programdata\pobiciyxpueaunl 2012-08-16 07:44 . 2012-06-29 00:00 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2012-08-16 07:44 . 2012-06-29 01:00 140920 ----a-w- c:\program files\Internet Explorer\sqmapi.dll 2012-08-16 07:44 . 2012-06-29 00:06 194560 ----a-w- c:\program files\Internet Explorer\ieproxy.dll 2012-08-16 07:44 . 2012-06-29 00:06 194048 ----a-w- c:\program files\Internet Explorer\IEShims.dll 2012-08-16 07:31 . 2012-05-11 15:57 623616 ----a-w- c:\windows\system32\localspl.dll . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-28 18:24 . 2012-06-26 17:28 477168 ----a-w- c:\windows\system32\npdeployJava1.dll 2012-08-28 18:24 . 2012-03-28 15:31 473072 ----a-w- c:\windows\system32\deployJava1.dll . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\prxtbBitT.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}] . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}] 2011-05-09 08:49 176936 ----a-w- c:\program files\BitTorrentBar\prxtbBitT.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\prxtbBitT.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{88C7F2AA-F93F-432C-8F0E-B7D85967A527}"= "c:\program files\BitTorrentBar\prxtbBitT.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 430080] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-25 39408] "Device Doctor"="c:\programy\Device Doctor\DDLauncher.exe" [2012-01-02 80016] "DAEMON Tools Lite"="c:\programy\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872] "BitTorrent"="c:\programy\Bittorent\BitTorrent.exe" [2012-05-26 6380400] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RtHDVCpl.exe" [2008-04-08 6037504] "Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-04-29 417792] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-07 1029416] "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-02-06 431456] "HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-11-01 54608] "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-06-16 448080] "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 716800] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-05-05 29744] "NDSTray.exe"="NDSTray.exe" [BU] "egui"="c:\programy\ESET NOD32\egui.exe" [2011-08-09 3076144] "Skytel"="Skytel.exe" [2007-11-21 1826816] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-11-09 343168] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL . --- Inne Usługi/Sterowniki w Pamięci --- . *NewlyCreated* - ECACHE *NewlyCreated* - PXHELP20 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Zawartość folderu 'Zaplanowane zadania' . 2012-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 16:45] . 2012-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 16:45] . 2012-09-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2556331041-2498041632-3702930944-1000Core.job - c:\users\Madzia\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-25 08:31] . 2012-09-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2556331041-2498041632-3702930944-1000UA.job - c:\users\Madzia\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-25 08:31] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://startsear.ch/?aff=1&cf=bfa7267c-b588-11e1-a0dc-001e33595063 mStart Page = hxxp://startsear.ch/?aff=1&cf=bfa7267c-b588-11e1-a0dc-001e33595063 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Wyślij &do programu OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 172.17.6.73 94.232.216.60 . - - - - USUNIĘTO PUSTE WPISY - - - - . BHO-{a16219f8-febf-d8b0-4315-701197dad7a5} - c:\windows\system32\8c500afa.dll HKCU-Run-wbhokfqxpjxljje - c:\programdata\wbhokfqx.exe HKLM-Run-jswtrayutil - c:\program files\Jumpstart\jswtrayutil.exe HKLM-Run-cfFncEnabler.exe - cfFncEnabler.exe AddRemove-aa7d35c6 - c:\windows\system32\aa7d35c6.exe AddRemove-StartSearch Toolbar - c:\program files\StartSearch plugin\uninst.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-09-10 10:02 Windows 6.0.6002 Service Pack 2 NTFS . skanowanie ukrytych procesów ... . skanowanie ukrytych wpisów autostartu ... . HKCU\Software\Microsoft\Windows\CurrentVersion\Run TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i??????p?IZ???????????????8 ??` . skanowanie ukrytych plików ... . skanowanie pomyślnie ukończone ukryte pliki: 0 . ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_USERS\S-1-5-21-2556331041-2498041632-3702930944-1000\Software\SecuROM\License information*] "datasecu"=hex:fe,49,f3,d8,bf,5c,64,61,71,a0,fd,10,c7,43,77,4a,1d,a5,6d,c1,c7, d6,8d,17,2f,22,b8,d9,43,e4,fd,60,16,fa,55,f7,92,77,a4,d7,5f,a4,0e,61,31,78,\ "rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . Czas ukończenia: 2012-09-10 10:04:05 ComboFix-quarantined-files.txt 2012-09-10 08:04 . Przed: 72 569 925 632 bytes free Po: 73 312 690 176 bytes free . - - End Of File - - E84F01A0B9E457B99015C2E1AB461920