ComboFix 11-01-21.03 - Rafał 2011-01-22  12:10:35.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7600.0.1250.48.1045.18.2934.1812 [GMT 1:00]
Uruchomiony z: c:\users\Rafał\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\RAFA~1\AppData\Local\Temp\8F73.tmp
c:\users\Rafał\AppData\Local\Temp\8F73.tmp
c:\windows\system32\twunk_32.exe
c:\windows\SysWow64\twunk_32.exe

.
(((((((((((((((((((((((((   Pliki utworzone od 2010-12-22 do 2011-01-22  )))))))))))))))))))))))))))))))
.

2011-01-22 11:15 . 2011-01-22 11:15	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-01-21 16:41 . 2011-01-21 16:41	521448	----a-w-	c:\windows\system32\deployJava1.dll
2011-01-21 16:41 . 2011-01-21 16:41	--------	d-----w-	c:\program files\Java
2011-01-21 14:51 . 2010-09-01 07:30	94208	----a-w-	c:\program files (x86)\Internet Explorer\pl\iediag.resources.dll
2011-01-21 09:46 . 2011-01-13 10:20	7844688	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{14FE351F-0170-45A6-8454-059B4BB9C42C}\mpengine.dll
2011-01-21 00:31 . 2011-01-21 00:31	--------	d-----w-	c:\program files (x86)\Microsoft Visual Studio 8
2011-01-21 00:31 . 2011-01-21 00:31	--------	d-----w-	c:\users\Rafał\AppData\Local\Microsoft Help
2011-01-16 12:33 . 2011-01-16 12:33	--------	d-----w-	c:\program files\CCleaner
2011-01-15 11:12 . 2011-01-13 08:47	237168	----a-w-	c:\windows\system32\aswBoot.exe
2011-01-12 07:33 . 2010-10-16 05:17	720896	----a-w-	c:\windows\system32\odbc32.dll
2011-01-12 07:33 . 2010-10-16 05:16	1425408	----a-w-	c:\program files\Common Files\System\ado\msado15.dll
2011-01-12 07:33 . 2010-10-16 04:34	573440	----a-w-	c:\windows\SysWow64\odbc32.dll
2011-01-12 07:33 . 2010-10-16 05:16	495616	----a-w-	c:\program files\Common Files\System\ado\msadox.dll
2011-01-12 07:33 . 2010-10-16 05:16	466944	----a-w-	c:\program files\Common Files\System\ado\msadomd.dll
2011-01-12 07:33 . 2010-10-16 05:16	258048	----a-w-	c:\program files\Common Files\System\msadc\msadco.dll
2011-01-12 07:33 . 2010-10-16 04:33	372736	----a-w-	c:\program files (x86)\Common Files\System\ado\msadox.dll
2011-01-12 07:33 . 2010-10-16 04:33	352256	----a-w-	c:\program files (x86)\Common Files\System\ado\msadomd.dll
2011-01-12 07:33 . 2010-10-16 04:33	987136	----a-w-	c:\program files (x86)\Common Files\System\ado\msado15.dll
2011-01-12 07:33 . 2010-10-16 04:33	208896	----a-w-	c:\program files (x86)\Common Files\System\msadc\msadco.dll
2011-01-08 06:39 . 2011-01-08 06:39	--------	d-----w-	c:\programdata\Recovery
2011-01-05 23:50 . 2011-01-16 12:33	--------	d-----w-	c:\users\Rafał\Tracing
2010-12-26 20:02 . 2010-12-26 20:02	--------	d-----w-	c:\users\Rafał\AppData\Roaming\DVDVideoSoftIEHelpers
2010-12-26 20:01 . 2011-01-21 14:21	--------	d-----w-	c:\program files (x86)\Common Files\DVDVideoSoft
2010-12-26 20:01 . 2011-01-16 12:30	--------	d-----w-	c:\program files (x86)\DVDVideoSoft
2010-12-23 14:55 . 2010-12-23 14:55	834544	----a-w-	c:\windows\system32\drivers\sptd.sys
2010-12-23 14:54 . 2010-12-23 14:59	--------	d-----w-	c:\users\Rafał\AppData\Roaming\DAEMON Tools Lite
2010-12-23 14:53 . 2010-12-23 14:54	--------	d-----w-	c:\programdata\DAEMON Tools Lite

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-24 08:00 . 2010-11-27 16:51	108032	----a-w-	c:\windows\SysWow64\ff_vfw.dll
2010-11-15 16:59 . 2010-09-19 19:09	411368	----a-w-	c:\windows\SysWow64\deployJava1.dll
2010-11-03 19:08 . 2010-11-27 16:51	237568	----a-w-	c:\windows\SysWow64\yv12vfw.dll
2010-11-02 05:18 . 2010-12-16 22:11	524288	----a-w-	c:\windows\system32\wmicmiplugin.dll
2010-11-02 05:17 . 2010-12-16 22:11	1169408	----a-w-	c:\windows\system32\taskschd.dll
2010-11-02 05:17 . 2010-12-16 22:11	473600	----a-w-	c:\windows\system32\taskcomp.dll
2010-11-02 05:16 . 2010-12-16 22:11	1114624	----a-w-	c:\windows\system32\schedsvc.dll
2010-11-02 05:10 . 2010-12-16 22:11	464384	----a-w-	c:\windows\system32\taskeng.exe
2010-11-02 05:10 . 2010-12-16 22:11	285696	----a-w-	c:\windows\system32\schtasks.exe
2010-11-02 04:40 . 2010-12-16 22:11	496128	----a-w-	c:\windows\SysWow64\taskschd.dll
2010-11-02 04:40 . 2010-12-16 22:11	305152	----a-w-	c:\windows\SysWow64\taskcomp.dll
2010-11-02 04:34 . 2010-12-16 22:11	192000	----a-w-	c:\windows\SysWow64\taskeng.exe
2010-11-02 04:34 . 2010-12-16 22:11	179712	----a-w-	c:\windows\SysWow64\schtasks.exe
2010-10-27 05:06 . 2010-12-16 22:11	2048	----a-w-	c:\windows\system32\tzres.dll
2010-10-27 04:32 . 2010-12-16 22:11	2048	----a-w-	c:\windows\SysWow64\tzres.dll
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mobile Partner"="c:\program files (x86)\PLAY ONLINE\PLAY ONLINE.exe" [2010-09-19 114688]
"ccleaner"="c:\program files\CCleaner\CCleaner64.exe" [2010-12-21 3391288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2009-09-02 60464]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)

[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-02-25 227896]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-09-04 216576]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-07-24 114560]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-09-23 225280]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-20 1255736]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-23 834544]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-10-01 2320920]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 IntcDAud;Intel(R) Audio dla ekranów;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-10-30 244736]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-06-23 344680]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]


HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
ezSharedSvc

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-10-16 11:49	451872	----a-w-	c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Zawartość folderu 'Zaplanowane zadania'

2011-01-18 c:\windows\Tasks\HPCeeScheduleForRafał.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07 03:22]
.

--------- x86-64 -----------


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2009-12-22 5977600]
"RtkOSD"="c:\program files (x86)\Realtek\Audio\OSD\RtVOsd64.exe" [2009-10-13 995840]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Skan uzupełniający -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.pl/
mLocal Page = c:\windows\system32\blank.htm
IE: Free YouTube to MP3 Converter - c:\users\Rafał\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: {67C476FC-45BD-4D08-AE43-9C2B81B17F6F} = 89.108.195.20 217.17.34.10
TCP: {9AC2EA35-3F75-44C7-8A4F-07BF303D4D1B} = 89.108.195.20 217.17.34.10
TCP: {AD8EC5FD-0998-4CEF-A5D6-7B0A22ED9463} = 89.108.195.20 89.108.195.21
TCP: {D47930C1-CE4D-41E3-826B-7D9F6D9EFB6B} = 89.108.195.20 217.17.34.10
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
.
- - - - USUNIĘTO PUSTE WPISY - - - -

Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe


.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\CyberLink\Shared files\RichVideo.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
.
**************************************************************************
.
Czas ukończenia: 2011-01-22  12:20:47 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2011-01-22 11:20

Przed: 213 093 978 112 bajtów wolnych
Po: 212 684 304 384 bajtów wolnych

- - End Of File - - 61C513D8D177858761A5DF6B82BB86D2