ComboFix 11-10-30.03 - Aguś 2011-10-30 23:39:06.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.48.1045.18.1013.386 [GMT 1:00] Uruchomiony z: c:\users\Aguť\Desktop\ComboFix.exe AV: Panda Cloud Antivirus *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59} SP: Panda Cloud Antivirus *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\$NtUninstallKB13607$ c:\windows\$NtUninstallKB13607$\1152157745 c:\windows\$NtUninstallKB13607$\2098116566\@ c:\windows\$NtUninstallKB13607$\2098116566\L\qnbwvoto c:\windows\$NtUninstallKB13607$\2098116566\loader.tlb c:\windows\$NtUninstallKB13607$\2098116566\U\@00000001 c:\windows\$NtUninstallKB13607$\2098116566\U\@000000c0 c:\windows\$NtUninstallKB13607$\2098116566\U\@000000cb c:\windows\$NtUninstallKB13607$\2098116566\U\@000000cf c:\windows\$NtUninstallKB13607$\2098116566\U\@80000000 c:\windows\$NtUninstallKB13607$\2098116566\U\@800000c0 c:\windows\$NtUninstallKB13607$\2098116566\U\@800000cb c:\windows\$NtUninstallKB13607$\2098116566\U\@800000cf c:\windows\system32\ c:\windows\system32\odbcad32.exe . . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_RelevantKnowledge -------\Service_usnjsvc . . ((((((((((((((((((((((((( Pliki utworzone od 2011-09-28 do 2011-10-30 ))))))))))))))))))))))))))))))) . . 2011-10-30 23:09 . 2011-10-30 23:09 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DBEEFC41-1B6C-47BE-8266-182962476FCA}\offreg.dll 2011-10-30 23:06 . 2011-10-30 23:13 -------- d-----w- c:\users\Aguś\AppData\Local\temp 2011-10-30 23:06 . 2011-10-30 23:06 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-10-30 23:06 . 2011-10-30 23:06 -------- d-----w- c:\users\AGU~2\AppData\Local\temp 2011-10-28 18:21 . 2011-10-28 19:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-10-28 18:21 . 2011-08-31 15:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-10-27 00:25 . 2011-10-29 04:49 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0 2011-10-25 23:02 . 2011-10-25 23:02 -------- d-----w- c:\users\Aguś\AppData\Roaming\Malwarebytes 2011-10-25 23:01 . 2011-10-25 23:01 -------- d-----w- c:\programdata\Malwarebytes 2011-10-25 21:23 . 2011-10-25 21:23 -------- d-----w- c:\users\Aguś\DoctorWeb 2011-10-23 15:20 . 2011-10-23 15:20 -------- d-----w- c:\users\Aguś\AppData\Roaming\Panda Security 2011-10-23 15:18 . 2011-10-23 15:18 -------- d-----w- c:\program files\Toolbar Cleaner 2011-10-23 15:18 . 2011-10-23 15:42 -------- d-----w- c:\users\Aguś\AppData\Local\panda2_0dn 2011-10-23 15:18 . 2011-10-28 19:23 -------- d-----w- c:\programdata\Panda Security URL Filtering 2011-10-23 15:16 . 2011-10-23 15:17 -------- d-----w- c:\program files\Panda Security 2011-10-23 15:16 . 2011-10-23 15:16 -------- d-----w- c:\programdata\Panda Security 2011-10-23 15:15 . 2011-10-23 15:15 -------- d-----w- C:\temp 2011-10-23 10:54 . 2011-10-23 13:27 -------- d-----w- c:\program files\Norton Internet Security 2011-10-23 09:45 . 2011-10-23 10:15 -------- d-----w- c:\program files\Norton AntiVirus 2011-10-23 09:45 . 2011-10-23 13:27 -------- d-----w- c:\programdata\Norton 2011-10-23 09:20 . 2011-10-18 00:28 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DBEEFC41-1B6C-47BE-8266-182962476FCA}\mpengine.dll 2011-10-22 17:09 . 2011-10-27 22:18 -------- d-sh--w- c:\users\Aguś\AppData\Local\7d0eb7d6 2011-10-10 08:58 . 2011-10-10 08:58 -------- d-----w- c:\programdata\RDRM . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-09-29 07:30 . 2011-10-23 09:41 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [7] 2009-08-07 . 62BB79160F86CD962F312C68C6239BFD . 53472 . . [7.4.7600.226] . . c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.4.7600.226_none_e979223d5b9c821b\wuauclt.exe [7] 2008-10-16 . E654B78D2F1D791B30D0ED9A8195EC22 . 51224 . . [7.2.6001.788] . . c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.2.6001.788_none_2a6539a96682e474\wuauclt.exe [7] 2008-01-18 . 8E93CDF0EA8EDBA63F07E2898A9B2147 . 43008 . . [7.0.6001.18000] . . c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.0.6001.18000_none_a052d92e34802200\wuauclt.exe [7] 2007-07-31 . F3E9065EB617A7E3A832A7976BFA021B . 53080 . . [7.0.6000.381] . . c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.0.6000.381_none_981d19142bc9942c\wuauclt.exe [7] 2006-11-02 . FF81090B6EF1A42A19DF226632711D25 . 41472 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_6.0.6000.16386_none_acab9aecacae685d\wuauclt.exe . c:\windows\System32\wuauclt.exe ... - brak elementu !! . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}] 2011-06-24 17:37 86696 ----a-w- c:\program files\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}"= "c:\program files\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll" [2011-06-24 86696] . [HKEY_CLASSES_ROOT\clsid\{b821bf60-5c2d-41eb-92dc-3e4ccd3a22e4}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-23 176128] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744] "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776] "WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-04 138008] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-04 154392] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-04 133912] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 827392] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "PSUNMain"="c:\program files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" [2011-04-28 439616] "Panda Security URL Filtering"="c:\programdata\Panda Security URL Filtering\Panda_URL_Filtering.exe" [2011-06-29 217256] "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-11-8 113664] Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-22 734872] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R0 fufhnx;fufhnx;c:\windows\System32\drivers\yofd.sys [x] R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x] R3 qcusbmdm;Qualcomm Proprietary USB Driver (PID 3197);c:\windows\system32\DRIVERS\qcusbmdm.sys [2003-03-10 59632] R3 qcusbser;Qualcomm Diagnostic Port 3197;c:\windows\system32\DRIVERS\qcusbser.sys [2003-03-10 59632] S1 PSINKNC;PSINKNC;c:\windows\system32\DRIVERS\psinknc.sys [2011-04-28 126024] S2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2011-10-25 135168] S2 PSINAflt;PSINAflt;c:\windows\system32\DRIVERS\PSINAflt.sys [2011-07-05 143624] S2 PSINFile;PSINFile;c:\windows\system32\DRIVERS\PSINFile.sys [2011-04-28 99400] S2 PSINProc;PSINProc;c:\windows\system32\DRIVERS\PSINProc.sys [2011-04-28 111176] S2 PSINProt;PSINProt;c:\windows\system32\DRIVERS\PSINProt.sys [2011-04-28 112712] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ . Zawartość folderu 'Zaplanowane zadania' . 2011-10-25 c:\windows\Tasks\HPCeeScheduleForAguś.job - c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2007-09-02 12:23] . 2011-10-30 c:\windows\Tasks\User_Feed_Synchronization-{14CE2A65-BD56-43A3-B8AB-2E453A10DAEB}.job - c:\windows\system32\msfeedssync.exe [2011-01-01 04:25] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ig?hl=pl uSearchURL,(Default) = hxxp://www.searchgateway.net/search/%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 TCP: DhcpNameServer = 192.168.10.1 FF - ProfilePath - c:\users\Aguś\AppData\Roaming\Mozilla\Firefox\Profiles\7uga17fz.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/ig?hl=pl . - - - - USUNIĘTO PUSTE WPISY - - - - . HKCU-Run-ALLUpdate - c:\program files\ALLPlayer\ALLUpdate.exe AddRemove-HDMI - c:\windows\system32\igxpun.exe . . . ************************************************************************** skanowanie ukrytych procesów ... . skanowanie ukrytych wpisów autostartu ... . skanowanie ukrytych plików ... . skanowanie pomyślnie ukończone ukryte pliki: . ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- . - - - - - - - > 'Explorer.exe'(2568) c:\programdata\Panda Security URL Filtering\panda_url_filtering.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe c:\windows\system32\WUDFHost.exe c:\program files\HP\QuickPlay\Kernel\TV\CLSched.exe c:\windows\system32\conime.exe c:\windows\ehome\ehmsas.exe c:\windows\system32\igfxsrvc.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\program files\Hewlett-Packard\Shared\HpqToaster.exe c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe . ************************************************************************** . Czas ukończenia: 2011-10-31 00:21:43 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2011-10-30 23:21 . Przed: 79 656 009 728 bajtów wolnych Po: 79 724 285 952 bajtów wolnych . - - End Of File - - 9FAD1AF4BE09911EF7E0A395B61D75E7