ComboFix 15-08-18.01 - Administrator 2015-08-18 20:19:33.1.2 - x86 NETWORK Microsoft® Windows Vista™ Business 6.0.6001.1.1250.48.1045.18.2045.1661 [GMT 2:00] Uruchomiony z: c:\users\Administrator\Downloads\ComboFix.exe SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Utworzono nowy punkt przywracania . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\system32\drivers\e100b325.sys . . . . nie udało się usunąć c:\windows\system32\drivers\f19352234bf42685.sys . . . . nie udało się usunąć . Zainfekowana kopia c:\windows\system32\drivers\cdrom.sys została znaleziona. Problem naprawiono Plik odzyskano z - c:\windows\System32\DriverStore\FileRepository\cdrom.inf_a29e71c6\cdrom.sys . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_f19352234bf42685 -------\Service_f19352234bf42685 . . ((((((((((((((((((((((((( Pliki utworzone od 2015-07-18 do 2015-08-18 ))))))))))))))))))))))))))))))) . . 2015-08-18 18:24 . 2015-08-18 18:24 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp 2015-08-18 18:24 . 2015-08-18 18:24 -------- d-----w- c:\users\Gość\AppData\Local\temp 2015-08-18 18:24 . 2015-08-18 18:24 -------- d-----w- c:\users\Default\AppData\Local\temp 2015-08-18 09:15 . 2015-08-18 09:15 -------- d-----w- c:\program files\HD Tune 2015-08-18 09:14 . 2015-08-18 09:14 -------- d-----w- c:\users\Administrator\AppData\Local\Mozilla 2015-08-18 09:13 . 2015-08-18 09:13 -------- d-----w- c:\program files\Mozilla Maintenance Service 2015-08-18 08:49 . 2015-08-18 08:49 4 ----a-w- c:\users\Administrator\AppData\Roaming\appdataFr2.bin 2015-08-07 17:51 . 2015-08-07 17:51 -------- d-----w- c:\users\Administrator\AppData\Local\Google 2015-08-06 17:09 . 2015-08-06 17:09 -------- d-----w- c:\users\Administrator\AppData\Local\CEF 2015-08-06 17:09 . 2015-08-06 17:09 -------- d-----w- c:\users\Administrator\AppData\Local\Steam 2015-08-04 15:27 . 2015-08-04 15:27 -------- d-----w- c:\users\Administrator\AppData\Local\Adobe 2015-08-04 15:22 . 2015-08-04 15:22 0 ----a-w- c:\windows\prleth.sys 2015-08-04 15:22 . 2015-08-04 15:22 0 ----a-w- c:\windows\hgfs.sys 2015-08-04 15:18 . 2015-08-04 15:18 -------- d-----w- c:\users\Administrator\AppData\Local\Skype 2015-08-04 15:17 . 2015-08-04 15:17 -------- d-----w- c:\users\Administrator\AppData\Local\Opera Software 2015-07-30 19:19 . 2015-08-18 10:27 98520 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2015-07-30 19:18 . 2015-07-30 19:18 -------- d-----w- c:\program files\Malwarebytes Anti-Malware 2015-07-30 19:18 . 2015-07-30 19:18 -------- d-----w- c:\programdata\Malwarebytes 2015-07-30 19:18 . 2015-06-18 06:41 51928 ----a-w- c:\windows\system32\drivers\mwac.sys 2015-07-30 19:18 . 2015-06-18 06:41 94936 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2015-07-30 19:18 . 2015-06-18 06:41 23256 ----a-w- c:\windows\system32\drivers\mbam.sys . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2015-08-18 08:46 . 2014-11-28 12:47 780488 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2015-08-18 08:46 . 2014-11-28 12:47 142536 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2014-12-19 11:08 723976 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="c:\program files\Steam\Steam.exe" [2015-07-23 2895552] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2015-03-25 31682144] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 1628208] "InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 1057328] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928] "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-19 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-19 154136] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-19 129560] "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-12-19 5227112] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) "SoftwareSASGeneration"= 1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk \0autocheck autochk /k:C * . --- Inne Usługi/Sterowniki w Pamięci --- . *NewlyCreated* - F19352234BF42685 *Deregistered* - f19352234bf42685 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc . Zawartość folderu 'Zaplanowane zadania' . 2015-08-18 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-28 08:46] . . ------- Skan uzupełniający ------- . uStart Page = about:blank uDefault_Search_URL = www.google.com mStart Page = www.google.com IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 192.168.1.1 FF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\o08ovlcu.default\ . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2015-08-18 20:26 Windows 6.0.6001 Service Pack 1 NTFS . skanowanie ukrytych procesów ... . skanowanie ukrytych wpisów autostartu ... . skanowanie ukrytych plików ... . skanowanie pomyślnie ukończone ukryte pliki: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\f19352234bf42685] "ImagePath"="\SystemRoot\System32\Drivers\f19352234bf42685.sys" . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AIFF" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AIFF" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AIFF" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.ASF" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.ASX" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AU" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.avi" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.CDA" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crx\UserChoice] @Denied: (2) (Administrator) "Progid"="OperaStable" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.M3U" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MIDI" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MIDI" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MP3" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nex\UserChoice] @Denied: (2) (Administrator) "Progid"="OperaStable" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MIDI" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AU" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WAV" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WAX" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.ASF" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMA" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMD" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMS" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMV" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.ASX" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMZ" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WPL" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WVX" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-2511829651-333839240-3277264240-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\nvvsvc.exe c:\program files\NVIDIA Corporation\Display\nvxdsync.exe c:\windows\system32\nvvsvc.exe c:\program files\Nero\Nero 7\InCD\InCDsrv.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe c:\program files\CyberLink\Shared Files\RichVideo.exe c:\program files\NVIDIA Corporation\Display\nvtray.exe c:\windows\system32\conime.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\\?\c:\windows\system32\wbem\WMIADAP.EXE . ************************************************************************** . Czas ukończenia: 2015-08-18 20:30:25 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2015-08-18 18:30 ComboFix2.txt 2015-08-18 11:02 . Przed: 117 223 706 624 bajtów wolnych Po: 115 055 042 560 bajtów wolnych . - - End Of File - - 35F5A923F4139F8A6E67C35A58A6742E 5C616939100B85E558DA92B899A0FC36