ComboFix 12-10-24.02 - qba 2012-10-25   9:43.1.2 - x64 MINIMAL
Microsoft Windows 7 Ultimate   6.1.7601.1.1250.48.1045.18.4095.3076 [GMT 2:00]
Uruchomiony z: K:\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Utworzono nowy punkt przywracania
.
.
(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\qba\AppData\Local\Microsoft\Windows\233\wevtutil.exe
c:\users\qba\cddbcontrol.dll
c:\users\qba\cddblink.dll
c:\users\qba\cddbmusicid.dll
c:\users\qba\convert.exe
c:\users\qba\dbghelp.dll
c:\users\qba\dunzip32.dll
c:\users\qba\fixrjb.exe
c:\users\qba\hxaudiodevicehook.dll
c:\users\qba\ierjplug.dll
c:\users\qba\mc_enc_mp4v.dll
c:\users\qba\mmcdda32.dll
c:\users\qba\rdsf3260.dll
c:\users\qba\realconverter.exe
c:\users\qba\realjbox.exe
c:\users\qba\realplay.exe
c:\users\qba\realshare.exe
c:\users\qba\realtrimmer.exe
c:\users\qba\recordingmanager.exe
c:\users\qba\rjbres.dll
c:\users\qba\rjdlg.dll
c:\users\qba\rjprog.dll
c:\users\qba\rjwmapln.dll
c:\users\qba\rndevicedbbuilder.exe
c:\users\qba\rpau3260.dll
c:\users\qba\rphelperapp.exe
c:\users\qba\rpplugprot.dll
c:\users\qba\rpshell.dll
c:\users\qba\rpwa3260.dll
c:\users\qba\tnetdtct.dll
c:\users\qba\tpasdk.dll
c:\users\qba\tsasdk.dll
c:\users\qba\wmdmhelper.dll
c:\windows\msxml4-KB954430-enu.LOG
c:\windows\msxml4-KB973688-enu.LOG
.
.
(((((((((((((((((((((((((   Pliki utworzone od 2012-09-25 do 2012-10-25  )))))))))))))))))))))))))))))))
.
.
2012-10-25 07:47 . 2012-10-25 07:47	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-10-25 07:06 . 2012-10-25 07:06	--------	d-----w-	c:\users\qba\AppData\Roaming\hellomoto
2012-10-24 09:22 . 2012-10-12 07:19	9291768	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{740B9EF4-E225-4F82-BDF9-3B21F2487A40}\mpengine.dll
2012-10-22 20:37 . 2012-10-12 07:19	9291768	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-10-21 11:48 . 2012-10-02 10:10	972192	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AAB9AA6B-7E13-4A44-996C-F23B6FF64CCA}\gapaengine.dll
2012-10-19 04:40 . 2012-10-19 04:40	--------	d-----w-	c:\windows\pl
2012-10-19 04:37 . 2012-10-19 04:37	5659096	-c--a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\745eec411cdadb301\skydrivesetup.exe
2012-10-14 11:08 . 2012-10-14 11:08	48648	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2012-10-10 21:36 . 2012-09-14 19:19	2048	----a-w-	c:\windows\system32\tzres.dll
2012-10-10 21:36 . 2012-09-14 18:28	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2012-10-10 21:36 . 2012-08-11 00:56	715776	----a-w-	c:\windows\system32\kerberos.dll
2012-10-10 21:36 . 2012-08-10 23:56	542208	----a-w-	c:\windows\SysWow64\kerberos.dll
2012-10-10 21:36 . 2012-06-02 05:41	1464320	----a-w-	c:\windows\system32\crypt32.dll
2012-10-10 21:36 . 2012-06-02 04:36	1159680	----a-w-	c:\windows\SysWow64\crypt32.dll
2012-10-10 21:36 . 2012-06-02 05:41	184320	----a-w-	c:\windows\system32\cryptsvc.dll
2012-10-10 21:36 . 2012-06-02 05:41	140288	----a-w-	c:\windows\system32\cryptnet.dll
2012-10-10 21:36 . 2012-06-02 04:36	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2012-10-10 21:36 . 2012-06-02 04:36	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
2012-10-02 10:11 . 2012-10-02 10:10	972192	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-10-01 09:59 . 2012-10-01 09:59	--------	d-----w-	c:\program files (x86)\MSXML 4.0
2012-09-30 15:00 . 2012-09-30 15:00	--------	d-----w-	c:\users\qba\AppData\Roaming\Nokia
2012-09-30 15:00 . 2012-09-30 15:00	--------	d-----w-	c:\users\qba\AppData\Roaming\Nokia Suite
2012-09-30 14:56 . 2012-09-30 14:59	--------	d-----w-	c:\users\qba\AppData\Roaming\PC Suite
2012-09-30 14:56 . 2012-09-30 14:57	--------	d-----w-	c:\users\qba\AppData\Local\Nokia
2012-09-30 14:56 . 2012-09-30 14:56	--------	d-----w-	c:\programdata\PC Suite
2012-09-30 14:56 . 2012-09-30 14:56	--------	d-----w-	c:\programdata\Nokia
2012-09-30 14:56 . 2012-09-30 14:56	--------	d-----w-	c:\program files (x86)\Common Files\Nokia
2012-09-30 14:56 . 2012-09-30 14:56	--------	d-----w-	c:\program files\DIFX
2012-09-30 14:56 . 2012-06-27 13:18	26112	----a-w-	c:\windows\system32\drivers\pccsmcfdx64.sys
2012-09-30 14:56 . 2012-09-30 14:56	--------	d-----w-	c:\program files (x86)\PC Connectivity Solution
2012-09-30 14:55 . 2012-01-09 15:28	57856	----a-w-	c:\windows\system32\nmwcdclsX64.dll
2012-09-30 14:54 . 2012-09-30 14:56	--------	d-----w-	c:\program files (x86)\Nokia
2012-09-26 10:22 . 2012-08-21 21:01	245760	----a-w-	c:\windows\system32\OxpsConverter.exe
.
.
.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-13 18:49 . 2012-08-24 10:04	73656	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-13 18:49 . 2012-08-24 10:04	696760	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-10-10 21:53 . 2012-08-27 19:26	65309168	----a-w-	c:\windows\system32\MRT.exe
2012-09-21 19:51 . 2012-09-21 19:51	16296	----a-w-	c:\users\qba\realtfon.fon
2012-09-21 19:50 . 2012-09-21 19:50	499712	----a-w-	c:\windows\SysWow64\msvcp71.dll
2012-09-21 19:50 . 2012-09-21 19:50	348160	----a-w-	c:\windows\SysWow64\msvcr71.dll
2012-09-18 20:57 . 2012-09-18 20:56	7207866	----a-w-	c:\program files (x86)\fdminst.exe
2012-09-12 13:57 . 2012-09-12 13:57	322048	----a-w-	c:\windows\WLXPGSS.SCR
2012-09-10 07:01 . 2012-09-10 07:01	48648	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2012-09-10 07:00 . 2012-09-10 07:00	686416	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-08-30 20:03 . 2012-08-30 20:03	228768	----a-w-	c:\windows\system32\drivers\MpFilter.sys
2012-08-30 20:03 . 2012-03-20 18:44	128456	----a-w-	c:\windows\system32\drivers\NisDrvWFP.sys
2012-08-30 13:46 . 2012-08-30 13:46	71680	----a-w-	c:\windows\system32\frapsv64.dll
2012-08-30 13:46 . 2012-08-30 13:46	65536	----a-w-	c:\windows\SysWow64\frapsvid.dll
2012-08-29 14:23 . 2012-08-29 14:23	108008	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2012-08-29 14:23 . 2012-08-29 14:23	289768	----a-w-	c:\windows\system32\javaws.exe
2012-08-29 14:23 . 2012-08-29 14:23	189416	----a-w-	c:\windows\system32\javaw.exe
2012-08-29 14:23 . 2012-08-29 14:23	188904	----a-w-	c:\windows\system32\java.exe
2012-08-29 14:23 . 2012-08-29 14:23	916456	----a-w-	c:\windows\system32\deployJava1.dll
2012-08-29 14:23 . 2012-08-29 14:23	1034216	----a-w-	c:\windows\system32\npDeployJava1.dll
2012-08-29 14:10 . 2012-08-25 10:04	821736	----a-w-	c:\windows\SysWow64\npDeployJava1.dll
2012-08-29 14:10 . 2012-08-25 10:04	746984	----a-w-	c:\windows\SysWow64\deployJava1.dll
2012-08-27 19:46 . 2009-07-14 02:36	152576	----a-w-	c:\windows\SysWow64\msclmd.dll
2012-08-27 19:46 . 2009-07-14 02:36	175616	----a-w-	c:\windows\system32\msclmd.dll
2012-08-25 23:52 . 2012-08-25 23:52	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-08-25 23:52 . 2012-08-25 23:52	161792	----a-w-	c:\windows\SysWow64\msls31.dll
2012-08-25 23:52 . 2012-08-25 23:52	86528	----a-w-	c:\windows\SysWow64\iesysprep.dll
2012-08-25 23:52 . 2012-08-25 23:52	76800	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2012-08-25 23:52 . 2012-08-25 23:52	63488	----a-w-	c:\windows\SysWow64\tdc.ocx
2012-08-25 23:52 . 2012-08-25 23:52	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2012-08-25 23:52 . 2012-08-25 23:52	367104	----a-w-	c:\windows\SysWow64\html.iec
2012-08-25 23:52 . 2012-08-25 23:52	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2012-08-25 23:52 . 2012-08-25 23:52	74752	----a-w-	c:\windows\SysWow64\iesetup.dll
2012-08-25 23:52 . 2012-08-25 23:52	23552	----a-w-	c:\windows\SysWow64\licmgr10.dll
2012-08-25 23:52 . 2012-08-25 23:52	152064	----a-w-	c:\windows\SysWow64\wextract.exe
2012-08-25 23:52 . 2012-08-25 23:52	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2012-08-25 23:52 . 2012-08-25 23:52	89088	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2012-08-25 23:52 . 2012-08-25 23:52	35840	----a-w-	c:\windows\SysWow64\imgutil.dll
2012-08-25 23:52 . 2012-08-25 23:52	222208	----a-w-	c:\windows\system32\msls31.dll
2012-08-25 23:52 . 2012-08-25 23:52	197120	----a-w-	c:\windows\system32\msrating.dll
2012-08-25 23:52 . 2012-08-25 23:52	11776	----a-w-	c:\windows\SysWow64\mshta.exe
2012-08-25 23:52 . 2012-08-25 23:52	101888	----a-w-	c:\windows\SysWow64\admparse.dll
2012-08-25 23:52 . 2012-08-25 23:52	91648	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2012-08-25 23:52 . 2012-08-25 23:52	65024	----a-w-	c:\windows\system32\pngfilt.dll
2012-08-25 23:52 . 2012-08-25 23:52	55296	----a-w-	c:\windows\system32\msfeedsbs.dll
2012-08-25 23:52 . 2012-08-25 23:52	49664	----a-w-	c:\windows\system32\imgutil.dll
2012-08-25 23:52 . 2012-08-25 23:52	48640	----a-w-	c:\windows\system32\mshtmler.dll
2012-08-25 23:52 . 2012-08-25 23:52	267776	----a-w-	c:\windows\system32\ieaksie.dll
2012-08-25 23:52 . 2012-08-25 23:52	163840	----a-w-	c:\windows\system32\ieakui.dll
2012-08-25 23:52 . 2012-08-25 23:52	160256	----a-w-	c:\windows\system32\ieakeng.dll
2012-08-25 23:52 . 2012-08-25 23:52	149504	----a-w-	c:\windows\system32\occache.dll
2012-08-25 23:52 . 2012-08-25 23:52	145920	----a-w-	c:\windows\system32\iepeers.dll
2012-08-25 23:52 . 2012-08-25 23:52	135168	----a-w-	c:\windows\system32\IEAdvpack.dll
2012-08-25 23:52 . 2012-08-25 23:52	12288	----a-w-	c:\windows\system32\mshta.exe
2012-08-25 23:52 . 2012-08-25 23:52	114176	----a-w-	c:\windows\system32\admparse.dll
2012-08-25 23:52 . 2012-08-25 23:52	111616	----a-w-	c:\windows\system32\iesysprep.dll
2012-08-25 23:52 . 2012-08-25 23:52	10752	----a-w-	c:\windows\system32\msfeedssync.exe
2012-08-25 23:52 . 2012-08-25 23:52	76800	----a-w-	c:\windows\system32\tdc.ocx
2012-08-25 23:52 . 2012-08-25 23:52	89088	----a-w-	c:\windows\system32\ie4uinit.exe
2012-08-25 23:52 . 2012-08-25 23:52	85504	----a-w-	c:\windows\system32\iesetup.dll
2012-08-25 23:52 . 2012-08-25 23:52	82432	----a-w-	c:\windows\system32\icardie.dll
2012-08-25 23:52 . 2012-08-25 23:52	534528	----a-w-	c:\windows\system32\ieapfltr.dll
2012-08-25 23:52 . 2012-08-25 23:52	452608	----a-w-	c:\windows\system32\dxtmsft.dll
2012-08-25 23:52 . 2012-08-25 23:52	448512	----a-w-	c:\windows\system32\html.iec
2012-08-25 23:52 . 2012-08-25 23:52	403248	----a-w-	c:\windows\system32\iedkcs32.dll
2012-08-25 23:52 . 2012-08-25 23:52	39936	----a-w-	c:\windows\system32\iernonce.dll
2012-08-25 23:52 . 2012-08-25 23:52	3695416	----a-w-	c:\windows\system32\ieapfltr.dat
2012-08-25 23:52 . 2012-08-25 23:52	30720	----a-w-	c:\windows\system32\licmgr10.dll
2012-08-25 23:52 . 2012-08-25 23:52	282112	----a-w-	c:\windows\system32\dxtrans.dll
2012-08-25 23:52 . 2012-08-25 23:52	249344	----a-w-	c:\windows\system32\webcheck.dll
2012-08-25 23:52 . 2012-08-25 23:52	165888	----a-w-	c:\windows\system32\iexpress.exe
2012-08-25 23:52 . 2012-08-25 23:52	160256	----a-w-	c:\windows\system32\wextract.exe
2012-08-25 23:52 . 2012-08-25 23:52	103936	----a-w-	c:\windows\system32\inseng.dll
2012-08-24 11:15 . 2012-09-22 11:32	17810944	----a-w-	c:\windows\system32\mshtml.dll
2012-08-24 10:39 . 2012-09-22 11:32	10925568	----a-w-	c:\windows\system32\ieframe.dll
2012-08-24 10:31 . 2012-09-22 11:33	2312704	----a-w-	c:\windows\system32\jscript9.dll
2012-08-24 10:22 . 2012-09-22 11:33	1346048	----a-w-	c:\windows\system32\urlmon.dll
2012-08-24 10:21 . 2012-09-22 11:33	1392128	----a-w-	c:\windows\system32\wininet.dll
2012-08-24 10:20 . 2012-09-22 11:33	1494528	----a-w-	c:\windows\system32\inetcpl.cpl
2012-08-24 10:18 . 2012-09-22 11:33	237056	----a-w-	c:\windows\system32\url.dll
2012-08-24 10:17 . 2012-09-22 11:33	85504	----a-w-	c:\windows\system32\jsproxy.dll
2012-08-24 10:14 . 2012-09-22 11:33	173056	----a-w-	c:\windows\system32\ieUnatt.exe
2012-08-24 10:14 . 2012-09-22 11:33	816640	----a-w-	c:\windows\system32\jscript.dll
2012-08-24 10:13 . 2012-09-22 11:33	599040	----a-w-	c:\windows\system32\vbscript.dll
2012-08-24 10:12 . 2012-09-22 11:33	2144768	----a-w-	c:\windows\system32\iertutil.dll
2012-08-24 10:11 . 2012-09-22 11:33	729088	----a-w-	c:\windows\system32\msfeeds.dll
2012-08-24 10:10 . 2012-09-22 11:33	96768	----a-w-	c:\windows\system32\mshtmled.dll
2012-08-24 10:09 . 2012-09-22 11:33	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2012-08-24 10:04 . 2012-09-22 11:33	248320	----a-w-	c:\windows\system32\ieui.dll
2012-08-24 06:59 . 2012-09-22 11:33	1800704	----a-w-	c:\windows\SysWow64\jscript9.dll
2012-08-24 06:51 . 2012-09-22 11:33	1129472	----a-w-	c:\windows\SysWow64\wininet.dll
2012-08-24 06:51 . 2012-09-22 11:33	1427968	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2012-08-24 06:47 . 2012-09-22 11:33	142848	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2012-08-24 06:47 . 2012-09-22 11:33	420864	----a-w-	c:\windows\SysWow64\vbscript.dll
2012-08-24 06:43 . 2012-09-22 11:33	2382848	----a-w-	c:\windows\SysWow64\mshtml.tlb
2012-08-22 18:12 . 2012-09-12 09:14	1913200	----a-w-	c:\windows\system32\drivers\tcpip.sys
2012-08-22 18:12 . 2012-09-12 09:14	950128	----a-w-	c:\windows\system32\drivers\ndis.sys
2012-08-22 18:12 . 2012-09-12 09:14	376688	----a-w-	c:\windows\system32\drivers\netio.sys
2012-08-22 18:12 . 2012-09-12 09:14	288624	----a-w-	c:\windows\system32\drivers\FWPKCLNT.SYS
2012-08-20 17:38 . 2012-10-10 21:37	44032	----a-w-	c:\windows\apppatch\acwow64.dll
.
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-10-19 04:38	220632	----a-w-	c:\users\qba\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-10-19 04:38	220632	----a-w-	c:\users\qba\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-10-19 04:38	220632	----a-w-	c:\users\qba\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"TkBellExe"="c:\users\qba\Update\realsched.exe" [2012-09-21 296096]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 McciCMService64;McciCMService64;c:\program files\Common Files\Motive\McciCMService.exe [2012-06-07 441344]
R2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-13 250808]
R3 NisSrv;Inspekcja sieci firmy Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896]
R3 Ph3xIB64;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB64.sys [2009-06-10 1627520]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-08-25 1255736]
.
.
Zawartość folderu 'Zaplanowane zadania'
.
2012-10-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-24 18:49]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-10-19 04:38	244696	----a-w-	c:\users\qba\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-10-19 04:38	244696	----a-w-	c:\users\qba\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-10-19 04:38	244696	----a-w-	c:\users\qba\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GGDriveOverlay1]
@="{E68D0A50-3C40-4712-B90D-DCFA93FF2534}"
[HKEY_CLASSES_ROOT\CLSID\{E68D0A50-3C40-4712-B90D-DCFA93FF2534}]
2012-06-05 09:42	2023936	----a-w-	c:\programdata\GG\ggdrive\ggdrive-overlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GGDriveOverlay2]
@="{E68D0A51-3C40-4712-B90D-DCFA93FF2534}"
[HKEY_CLASSES_ROOT\CLSID\{E68D0A51-3C40-4712-B90D-DCFA93FF2534}]
2012-06-05 09:42	2023936	----a-w-	c:\programdata\GG\ggdrive\ggdrive-overlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GGDriveOverlay3]
@="{E68D0A52-3C40-4712-B90D-DCFA93FF2534}"
[HKEY_CLASSES_ROOT\CLSID\{E68D0A52-3C40-4712-B90D-DCFA93FF2534}]
2012-06-05 09:42	2023936	----a-w-	c:\programdata\GG\ggdrive\ggdrive-overlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GGDriveOverlay4]
@="{E68D0A53-3C40-4712-B90D-DCFA93FF2534}"
[HKEY_CLASSES_ROOT\CLSID\{E68D0A53-3C40-4712-B90D-DCFA93FF2534}]
2012-06-05 09:42	2023936	----a-w-	c:\programdata\GG\ggdrive\ggdrive-overlay.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704]
"TPSA_McciTrayApp"="c:\program files\TPSA\McciTrayApp.exe" [2012-06-07 2655232]
.
------- Skan uzupełniający -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.wp.pl/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Pobierz plik wideo w FDM - file://c:\program files (x86)\Free Download Manager\dlfvideo.htm
IE: Pobierz w FDM - file://c:\program files (x86)\Free Download Manager\dllink.htm
IE: Pobierz wszystkie pliki w FDM - file://c:\program files (x86)\Free Download Manager\dlall.htm
IE: Pobierz zaznaczone pliki w FDM - file://c:\program files (x86)\Free Download Manager\dlselected.htm
TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
.
- - - - USUNIĘTO PUSTE WPISY - - - -
.
Wow6432Node-HKCU-Run-wevtutil - c:\users\qba\AppData\Local\Microsoft\Windows\233\wevtutil.exe
AddRemove-RealPlayer 15.0 - c:\users\qba\Update\r1puninst.exe
.
.
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3779714383-1533058176-1447129429-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3779714383-1533058176-1447129429-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Czas ukończenia: 2012-10-25  09:48:29
ComboFix-quarantined-files.txt  2012-10-25 07:48
.
Przed: 39 151 575 040 bajtów wolnych
Po: 39 619 117 056 bajtów wolnych
.
- - End Of File - - 55CDDB2D664DA4CE36B96D373103008A