ComboFix 14-06-13.01 - Adrian 2014-06-14 12:31:08.1.1 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1250.48.1045.18.2047.1266 [GMT 2:00] Uruchomiony z: c:\users\Adrian\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Utworzono nowy punkt przywracania . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Adrian\AppData\Roaming\dclogs c:\users\Adrian\AppData\Roaming\dclogs\2014-05-17-7.dc c:\windows\7Loader.TAG c:\windows\security\Database\tmp.edb . . ((((((((((((((((((((((((( Pliki utworzone od 2014-05-14 do 2014-06-14 ))))))))))))))))))))))))))))))) . . 2014-06-14 10:36 . 2014-06-14 10:36 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-06-13 20:54 . 2014-06-13 20:54 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5F4EFA9C-1FCC-4613-ACAC-0E5B6474CAC7}\offreg.dll 2014-06-11 15:55 . 2014-06-11 16:50 -------- d-sh--w- c:\windows\SysWow64\ITXWDS 2014-06-09 18:25 . 2014-06-10 17:23 -------- d-----w- c:\users\Adrian\AppData\Local\Google 2014-06-02 05:15 . 2014-06-02 05:15 -------- d-----w- C:\NVIDIA Corporation 2014-05-16 18:00 . 2014-05-16 18:00 -------- d-----w- c:\users\Adrian\AppData\Roaming\City Interactive . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-05-14 14:17 . 2013-07-25 11:26 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2014-05-14 14:17 . 2013-07-25 11:26 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2014-04-14 18:13 . 2014-04-22 19:25 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2014-04-02 13:27 . 2013-10-28 21:16 1081112 ----a-w- c:\windows\SysWow64\nvspcap.dll 2014-04-02 13:27 . 2013-10-28 21:16 1225920 ----a-w- c:\windows\system32\nvspcap64.dll 2014-03-21 19:43 . 2014-04-20 21:23 40392 ----a-w- c:\windows\system32\drivers\nvvad64v.sys 2014-03-21 19:43 . 2014-04-20 21:23 33568 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll 2014-03-21 19:43 . 2013-09-02 15:37 37320 ----a-w- c:\windows\system32\nvaudcap64v.dll . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "V0350Mon.exe"="c:\windows\V0350Mon.exe" [2007-08-22 28672] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 0 (0x0) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "EnableVirtualization"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"="0" "UpdatesDisableNotify"="0" . R1 fixsrzjn;fixsrzjn;c:\windows\system32\drivers\fixsrzjn.sys;c:\windows\SYSNATIVE\drivers\fixsrzjn.sys [x] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R3 AndNetDiag;LGE AndroidNet USB Serial Port;c:\windows\system32\DRIVERS\lgandnetdiag64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetdiag64.sys [x] R3 ANDNetModem;LGE AndroidNet USB Modem;c:\windows\system32\DRIVERS\lgandnetmodem64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetmodem64.sys [x] R3 andnetndis;LGE AndroidNet NDIS Ethernet Adapter;c:\windows\system32\DRIVERS\lgandnetndis64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetndis64.sys [x] R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys;c:\windows\SYSNATIVE\drivers\nmwcdnsux64.sys [x] R3 Ph3xIB64;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB64.sys;c:\windows\SYSNATIVE\DRIVERS\Ph3xIB64.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x] S2 CSHelper;CopySafe Helper Service;c:\program files\Common Files\ArtistScope\CSHelper64.exe;c:\program files\Common Files\ArtistScope\CSHelper64.exe [x] S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x] S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x] S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x] S3 VF0350Vfx;VF0350 Video FX;c:\windows\system32\DRIVERS\V0350VFx.sys;c:\windows\SYSNATIVE\DRIVERS\V0350VFx.sys [x] S3 VF0350Vid;Live! Cam Video IM (VF0350);c:\windows\system32\DRIVERS\V0350Vid.sys;c:\windows\SYSNATIVE\DRIVERS\V0350Vid.sys [x] . . Zawartość folderu 'Zaplanowane zadania' . 2014-06-14 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-25 14:17] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-03-29 13513288] "ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-04-02 1225920] "NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-04-02 2201032] . ------- Skan uzupełniający ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com mLocal Page = c:\windows\SysWOW64\blank.htm TCP: Interfaces\{125C4FAF-8776-4E90-A306-1BB7AC348470}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1 FF - ProfilePath - c:\users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\k2d45yrp.default-1388411162753\ . - - - - USUNIĘTO PUSTE WPISY - - - - . Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start AddRemove-{AF7A6A13-0D22-878C-4487-B305B29BFB90} - c:\progra~3\INSTAL~1\{3B423~1\Setup.exe AddRemove-MKLOL - c:\program files (x86)\MKJogo\MKLOL\MKuInst.exe AddRemove-UnityWebPlayer - c:\users\Adrian\AppData\Local\Unity\WebPlayer\Uninstall.exe . . . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_USERS\S-1-5-21-1644617884-16204230-2921145980-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3531A543-B57D-3BC6-DCA3-B9E41B275812}*] "maildnacpdpeldolcojpcadfnp"=hex:6f,61,62,65,67,6b,67,64,66,6e,61,62,66,6d,66, 6f,6b,64,61,63,68,70,65,6d,68,62,6e,63,6e,63,00,70 . [HKEY_USERS\S-1-5-21-1644617884-16204230-2921145980-1000\Software\SecuROM\License information*] "datasecu"=hex:be,2f,d6,7f,b8,72,cc,ba,10,8b,29,e5,cb,de,d0,12,87,07,92,d7,2d, 9e,ab,78,0d,e8,17,c3,73,89,1d,36,98,9d,5f,10,58,ba,fd,66,09,db,77,5b,10,6d,\ "rkeysecu"=hex:60,99,90,f8,43,8b,2a,15,6e,c8,78,64,19,3d,fb,6f . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Czas ukończenia: 2014-06-14 12:38:47 ComboFix-quarantined-files.txt 2014-06-14 10:38 . Przed: 11 077 242 880 bajtów wolnych Po: 10 913 710 080 bajtów wolnych . - - End Of File - - F89D37A11A0CC022AEAC4D0B4F7E4844 A36C5E4F47E84449FF07ED3517B43A31