ComboFix 13-09-02.02 - czeslaw 2013-09-02  21:28:32.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1250.48.1045.18.2933.1995 [GMT 2:00]
Uruchomiony z: c:\users\czeslaw\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\czeslaw\AppData\Roaming\mfc40u.dll
c:\users\czeslaw\AppData\Roaming\mfc71.dll
c:\users\czeslaw\AppData\Roaming\MFC71u.dll
c:\users\czeslaw\AppData\Roaming\msvcp60.dll
c:\users\czeslaw\AppData\Roaming\msvcp71.dll
c:\users\czeslaw\AppData\Roaming\msvcr71.dll
c:\users\czeslaw\AppData\Roaming\XMessageBox.dll
D:\hl.exe
.
c:\windows\SysWow64\drivers\ntfs.sys . . . jest zainfekowany!!
.
.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_DCService.exe
.
.
(((((((((((((((((((((((((   Pliki utworzone od 2013-08-02 do 2013-09-02  )))))))))))))))))))))))))))))))
.
.
2013-09-02 19:42 . 2013-09-02 19:42	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-09-01 22:00 . 2010-04-09 13:24	79360	----a-w-	c:\windows\system32\drivers\ew_jucdcacm.sys
2013-09-01 22:00 . 2010-04-09 13:24	27136	----a-w-	c:\windows\system32\drivers\ew_juextctrl.sys
2013-09-01 22:00 . 2010-04-09 13:24	49664	----a-w-	c:\windows\system32\drivers\ew_jucdcecm.sys
2013-09-01 22:00 . 2010-04-09 13:24	76288	----a-w-	c:\windows\system32\drivers\ew_jubusenum.sys
2013-09-01 22:00 . 2010-04-07 15:05	250368	----a-w-	c:\windows\system32\drivers\ewusbnet.sys
2013-09-01 22:00 . 2010-03-25 08:08	120704	----a-w-	c:\windows\system32\drivers\ewusbmdm.sys
2013-09-01 22:00 . 2010-03-20 10:06	13952	----a-w-	c:\windows\system32\drivers\ew_usbenumfilter.sys
2013-09-01 22:00 . 2010-03-17 12:34	1001472	----a-w-	c:\windows\system32\drivers\mod7700.sys
2013-09-01 22:00 . 2010-01-18 16:48	32768	----a-w-	c:\windows\system32\drivers\ewdcsc.sys
2013-09-01 22:00 . 2010-03-20 09:56	114560	----a-w-	c:\windows\system32\drivers\ew_hwusbdev.sys
2013-08-30 16:41 . 2013-08-06 08:58	9515512	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{D6C0D810-550D-464B-85A9-181FFD34383F}\mpengine.dll
2013-08-14 21:49 . 2013-08-14 21:51	--------	d-----w-	c:\windows\system32\MRT
2013-08-14 20:54 . 2013-07-09 05:46	1472512	----a-w-	c:\windows\system32\crypt32.dll
2013-08-14 20:54 . 2013-07-09 05:52	224256	----a-w-	c:\windows\system32\wintrust.dll
2013-08-14 20:54 . 2013-07-09 04:52	175104	----a-w-	c:\windows\SysWow64\wintrust.dll
2013-08-14 20:54 . 2013-07-09 04:46	1166848	----a-w-	c:\windows\SysWow64\crypt32.dll
2013-08-14 20:54 . 2013-07-09 05:46	184320	----a-w-	c:\windows\system32\cryptsvc.dll
2013-08-14 20:54 . 2013-07-09 05:46	139776	----a-w-	c:\windows\system32\cryptnet.dll
2013-08-14 20:54 . 2013-07-09 04:46	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2013-08-14 20:54 . 2013-07-09 04:46	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
2013-08-11 17:34 . 2013-08-11 17:34	--------	d-----w-	c:\programdata\McAfee
2013-08-11 17:31 . 2013-08-11 17:45	--------	d-----w-	c:\users\czeslaw\AppData\Local\Adobe
2013-08-09 16:07 . 2013-04-10 05:48	1732608	----a-w-	c:\program files\Windows Journal\NBDoc.DLL
2013-08-09 16:07 . 2013-04-10 05:46	1367040	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-08-09 16:05 . 2013-06-04 06:00	624128	----a-w-	c:\windows\system32\qedit.dll
2013-08-09 16:05 . 2013-06-04 04:53	509440	----a-w-	c:\windows\SysWow64\qedit.dll
.
.
.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-23 15:00 . 2012-08-18 08:48	692104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-23 15:00 . 2011-10-13 20:28	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-14 21:49 . 2011-11-06 10:32	78161360	----a-w-	c:\windows\system32\MRT.exe
2013-07-09 04:45 . 2013-08-14 20:52	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2013-07-08 19:47 . 2013-07-08 19:47	719360	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2013-07-08 19:47 . 2013-07-08 19:47	523264	----a-w-	c:\windows\SysWow64\vbscript.dll
2013-07-08 19:47 . 2013-07-08 19:47	38400	----a-w-	c:\windows\SysWow64\imgutil.dll
2013-07-08 19:47 . 2013-07-08 19:47	226304	----a-w-	c:\windows\system32\elshyph.dll
2013-07-08 19:47 . 2013-07-08 19:47	185344	----a-w-	c:\windows\SysWow64\elshyph.dll
2013-07-08 19:47 . 2013-07-08 19:47	158720	----a-w-	c:\windows\SysWow64\msls31.dll
2013-07-08 19:47 . 2013-07-08 19:47	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2013-07-08 19:47 . 2013-07-08 19:47	138752	----a-w-	c:\windows\SysWow64\wextract.exe
2013-07-08 19:47 . 2013-07-08 19:47	137216	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2013-07-08 19:47 . 2013-07-08 19:47	12800	----a-w-	c:\windows\SysWow64\mshta.exe
2013-07-08 19:47 . 2013-07-08 19:47	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2013-07-08 19:47 . 2013-07-08 19:47	1054720	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2013-07-08 19:47 . 2013-07-08 19:47	97280	----a-w-	c:\windows\system32\mshtmled.dll
2013-07-08 19:47 . 2013-07-08 19:47	905728	----a-w-	c:\windows\system32\mshtmlmedia.dll
2013-07-08 19:47 . 2013-07-08 19:47	81408	----a-w-	c:\windows\system32\icardie.dll
2013-07-08 19:47 . 2013-07-08 19:47	762368	----a-w-	c:\windows\system32\ieapfltr.dll
2013-07-08 19:47 . 2013-07-08 19:47	73728	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2013-07-08 19:47 . 2013-07-08 19:47	61952	----a-w-	c:\windows\SysWow64\tdc.ocx
2013-07-08 19:47 . 2013-07-08 19:47	599552	----a-w-	c:\windows\system32\vbscript.dll
2013-07-08 19:47 . 2013-07-08 19:47	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2013-07-08 19:47 . 2013-07-08 19:47	452096	----a-w-	c:\windows\system32\dxtmsft.dll
2013-07-08 19:47 . 2013-07-08 19:47	441856	----a-w-	c:\windows\system32\html.iec
2013-07-08 19:47 . 2013-07-08 19:47	361984	----a-w-	c:\windows\SysWow64\html.iec
2013-07-08 19:47 . 2013-07-08 19:47	281600	----a-w-	c:\windows\system32\dxtrans.dll
2013-07-08 19:47 . 2013-07-08 19:47	27648	----a-w-	c:\windows\system32\licmgr10.dll
2013-07-08 19:47 . 2013-07-08 19:47	270848	----a-w-	c:\windows\system32\iedkcs32.dll
2013-07-08 19:47 . 2013-07-08 19:47	247296	----a-w-	c:\windows\system32\webcheck.dll
2013-07-08 19:47 . 2013-07-08 19:47	235008	----a-w-	c:\windows\system32\url.dll
2013-07-08 19:47 . 2013-07-08 19:47	23040	----a-w-	c:\windows\SysWow64\licmgr10.dll
2013-07-08 19:47 . 2013-07-08 19:47	216064	----a-w-	c:\windows\system32\msls31.dll
2013-07-08 19:47 . 2013-07-08 19:47	197120	----a-w-	c:\windows\system32\msrating.dll
2013-07-08 19:47 . 2013-07-08 19:47	167424	----a-w-	c:\windows\system32\iexpress.exe
2013-07-08 19:47 . 2013-07-08 19:47	1509376	----a-w-	c:\windows\system32\inetcpl.cpl
2013-07-08 19:47 . 2013-07-08 19:47	144896	----a-w-	c:\windows\system32\wextract.exe
2013-07-08 19:47 . 2013-07-08 19:47	1441280	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2013-07-08 19:47 . 2013-07-08 19:47	1400416	----a-w-	c:\windows\system32\ieapfltr.dat
2013-07-08 19:47 . 2013-07-08 19:47	102912	----a-w-	c:\windows\system32\inseng.dll
2013-07-08 19:47 . 2013-07-08 19:47	92160	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2013-07-08 19:47 . 2013-07-08 19:47	77312	----a-w-	c:\windows\system32\tdc.ocx
2013-07-08 19:47 . 2013-07-08 19:47	62976	----a-w-	c:\windows\system32\pngfilt.dll
2013-07-08 19:47 . 2013-07-08 19:47	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2013-07-08 19:47 . 2013-07-08 19:47	51200	----a-w-	c:\windows\system32\imgutil.dll
2013-07-08 19:47 . 2013-07-08 19:47	48640	----a-w-	c:\windows\system32\mshtmler.dll
2013-07-08 19:47 . 2013-07-08 19:47	173568	----a-w-	c:\windows\system32\ieUnatt.exe
2013-07-08 19:47 . 2013-07-08 19:47	149504	----a-w-	c:\windows\system32\occache.dll
2013-07-08 19:47 . 2013-07-08 19:47	13824	----a-w-	c:\windows\system32\mshta.exe
2013-07-08 19:47 . 2013-07-08 19:47	136192	----a-w-	c:\windows\system32\iepeers.dll
2013-07-08 19:47 . 2013-07-08 19:47	135680	----a-w-	c:\windows\system32\IEAdvpack.dll
2013-07-08 19:47 . 2013-07-08 19:47	12800	----a-w-	c:\windows\system32\msfeedssync.exe
2013-07-04 09:37 . 2013-04-01 19:54	189936	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2013-07-04 09:37 . 2013-04-01 19:54	378944	----a-w-	c:\windows\system32\drivers\aswSP.sys
2013-07-04 09:37 . 2013-04-01 19:54	1030952	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2013-06-27 19:42 . 2012-07-19 07:35	1490656	----a-w-	c:\windows\system32\WdfCoInstaller01007.dll
2013-06-27 19:42 . 2012-07-19 07:35	1490656	----a-w-	c:\windows\system32\drivers\WdfCoInstaller01007.dll
.
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HW_OPENEYE_OUC_blueconnect"="c:\program files (x86)\blueconnect\UpdateDog\ouc.exe" [2009-12-31 110592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"DataCardMonitor"="c:\program files (x86)\blueconnect\DataCardMonitor.exe" [2013-07-31 253952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ew_hwusbdev.sys [x]
R3 ewusbmbb;HUAWEI USB-WWAN miniport;c:\windows\system32\DRIVERS\ewusbwwan.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbwwan.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbnet.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jucdcacm.sys [x]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbfake.sys [x]
R3 s1039bus;Sony Ericsson Device 1039 driver (WDM);c:\windows\system32\DRIVERS\s1039bus.sys;c:\windows\SYSNATIVE\DRIVERS\s1039bus.sys [x]
R3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1039mdfl.sys;c:\windows\SYSNATIVE\DRIVERS\s1039mdfl.sys [x]
R3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1039mdm.sys;c:\windows\SYSNATIVE\DRIVERS\s1039mdm.sys [x]
R3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1039mgmt.sys;c:\windows\SYSNATIVE\DRIVERS\s1039mgmt.sys [x]
R3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1039nd5.sys;c:\windows\SYSNATIVE\DRIVERS\s1039nd5.sys [x]
R3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1039obex.sys;c:\windows\SYSNATIVE\DRIVERS\s1039obex.sys [x]
R3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1039unic.sys;c:\windows\SYSNATIVE\DRIVERS\s1039unic.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x]
S3 yukonw7;Sterownik miniportu NDIS6.2 dla kontrolera Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Inne Usługi/Sterowniki w Pamięci ---
.
*NewlyCreated* - WS2IFSL
.
Zawartość folderu 'Zaplanowane zadania'
.
2013-09-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-18 15:00]
.
2013-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-13 20:27]
.
2013-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-13 20:27]
.
2013-09-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2632740816-278780761-606621841-1000Core.job
- c:\users\czeslaw\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-16 20:33]
.
2013-09-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2632740816-278780761-606621841-1000UA.job
- c:\users\czeslaw\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-16 20:33]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58	133840	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GGDriveOverlay1]
@="{E68D0A50-3C40-4712-B90D-DCFA93FF2534}"
[HKEY_CLASSES_ROOT\CLSID\{E68D0A50-3C40-4712-B90D-DCFA93FF2534}]
2012-06-05 09:42	2023936	----a-w-	c:\programdata\GG\ggdrive\ggdrive-overlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GGDriveOverlay2]
@="{E68D0A51-3C40-4712-B90D-DCFA93FF2534}"
[HKEY_CLASSES_ROOT\CLSID\{E68D0A51-3C40-4712-B90D-DCFA93FF2534}]
2012-06-05 09:42	2023936	----a-w-	c:\programdata\GG\ggdrive\ggdrive-overlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GGDriveOverlay3]
@="{E68D0A52-3C40-4712-B90D-DCFA93FF2534}"
[HKEY_CLASSES_ROOT\CLSID\{E68D0A52-3C40-4712-B90D-DCFA93FF2534}]
2012-06-05 09:42	2023936	----a-w-	c:\programdata\GG\ggdrive\ggdrive-overlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GGDriveOverlay4]
@="{E68D0A53-3C40-4712-B90D-DCFA93FF2534}"
[HKEY_CLASSES_ROOT\CLSID\{E68D0A53-3C40-4712-B90D-DCFA93FF2534}]
2012-06-05 09:42	2023936	----a-w-	c:\programdata\GG\ggdrive\ggdrive-overlay.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-01-10 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-01-10 392984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-01-10 417560]
.
------- Skan uzupełniający -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.
- - - - USUNIĘTO PUSTE WPISY - - - -
.
URLSearchHooks-{09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - (no file)
URLSearchHooks-{0b1be383-efa8-44d5-a7c2-9a39594575a1} - (no file)
Toolbar-10 - (no file)
Toolbar-!{09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - (no file)
Toolbar-!{F9639E4A-801B-4843-AEE3-03D9DA199E77} - (no file)
Wow6432Node-HKU-Default-Run-HW_OPENEYE_OUC_PLAY ONLINE - c:\program files (x86)\PLAY ONLINE\UpdateDog\ouc.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-10 - (no file)
Toolbar-!{09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
.
**************************************************************************
.
Czas ukończenia: 2013-09-02  21:53:04 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2013-09-02 19:52
.
Przed: 56 586 178 560 bajtów wolnych
Po: 58 014 048 256 bajtów wolnych
.
- - End Of File - - B59C6704C2F6E3BEBAB11E9BEB18D7FE
A36C5E4F47E84449FF07ED3517B43A31