ComboFix 12-01-23.02 - Mateusz 2012-01-24 16:12:07.1.2 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1250.48.1045.18.2812.1682 [GMT 1:00] Uruchomiony z: c:\users\Mateusz\Downloads\ComboFix.exe SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\system32\java.exe . . ((((((((((((((((((((((((( Pliki utworzone od 2011-12-24 do 2012-01-24 ))))))))))))))))))))))))))))))) . . 2012-01-24 15:20 . 2012-01-24 15:20 -------- d-----w- c:\users\Paweł\AppData\Local\temp 2012-01-24 15:20 . 2012-01-24 15:20 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-01-24 15:16 . 2012-01-24 15:16 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2A8D3485-0474-4587-AC56-666D595DB7E8}\offreg.dll 2012-01-24 07:08 . 2012-01-24 07:08 -------- d-----w- c:\users\Paweł\AppData\Roaming\IObit 2012-01-23 19:35 . 2012-01-24 14:59 -------- d-----w- c:\users\Mateusz\AppData\Local\CrashDumps 2012-01-23 15:28 . 2011-12-30 16:02 23896 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe 2012-01-23 15:21 . 2012-01-23 15:21 -------- d-----w- c:\programdata\IObit 2012-01-23 15:21 . 2012-01-23 15:21 -------- d-----w- c:\users\Mateusz\AppData\Roaming\IObit 2012-01-23 15:21 . 2012-01-23 15:21 -------- d-----w- c:\program files (x86)\IObit 2012-01-22 20:25 . 2012-01-23 19:13 -------- d-----w- C:\AeriaGames 2012-01-22 18:49 . 2012-01-22 18:49 -------- d-sh--w- c:\windows\BitLockerDiscoveryVolumeContents 2012-01-22 18:49 . 2012-01-22 18:49 -------- d-----w- c:\windows\RemotePackages 2012-01-22 14:03 . 2012-01-24 15:06 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared 2012-01-22 13:57 . 2012-01-24 15:06 -------- d-----w- c:\program files (x86)\Norton Internet Security 2012-01-22 13:57 . 2012-01-24 15:06 -------- d-----w- c:\programdata\Norton 2012-01-20 12:11 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2A8D3485-0474-4587-AC56-666D595DB7E8}\mpengine.dll 2012-01-11 08:38 . 2011-10-26 05:25 1572864 ----a-w- c:\windows\system32\quartz.dll 2012-01-11 08:38 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\SysWow64\quartz.dll 2012-01-11 08:38 . 2011-10-26 05:25 366592 ----a-w- c:\windows\system32\qdvd.dll 2012-01-11 08:38 . 2011-10-26 04:32 514560 ----a-w- c:\windows\SysWow64\qdvd.dll 2012-01-11 08:38 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll 2012-01-11 08:38 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll 2012-01-11 08:38 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll 2012-01-11 08:38 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll 2012-01-01 13:19 . 2011-08-01 16:24 3889424 ----a-w- c:\windows\SysWow64\GameMon.des 2012-01-01 13:18 . 2005-01-01 09:43 4682 ----a-w- c:\windows\SysWow64\npptNT2.sys 2012-01-01 13:18 . 2003-07-17 18:17 5174 ----a-w- c:\windows\SysWow64\nppt9x.vxd 2012-01-01 13:18 . 2012-01-01 13:18 -------- d-----w- c:\program files\Common Files\INCA Shared 2012-01-01 10:41 . 2012-01-01 10:42 -------- d-----w- c:\users\Mateusz\AppData\Local\Akamai 2012-01-01 10:37 . 2012-01-24 15:10 -------- d-----w- c:\program files (x86)\Common Files\Akamai 2011-12-26 13:33 . 2012-01-01 10:28 -------- d-----w- c:\users\Mateusz\AppData\Roaming\ipla 2011-12-26 13:33 . 2011-12-26 13:33 -------- d-----w- c:\programdata\ipla 2011-12-26 13:33 . 2011-12-26 13:33 -------- d-----w- c:\programdata\RDRM 2011-12-26 13:33 . 2012-01-01 12:07 -------- d-----w- c:\program files (x86)\ipla 2011-12-26 13:33 . 2011-12-26 13:33 1700352 ----a-w- c:\windows\SysWow64\gdiplus.dll 2011-12-25 17:59 . 2011-12-25 17:59 -------- d-----w- c:\users\Mateusz\AppData\Roaming\AnvSoft 2011-12-25 17:58 . 2011-12-25 17:58 -------- d-----w- c:\program files (x86)\AnvSoft 2011-12-25 17:50 . 2011-12-25 17:50 -------- d-----w- c:\program files (x86)\Movie Maker 2.6 . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-12-20 17:01 . 2011-12-20 17:01 22 --sha-w- c:\users\Paweł\AppData\Roaming\Sys2662.Config.Repository.bin 2011-12-20 17:01 . 2011-12-20 17:01 22 --sha-w- c:\users\Paweł\AppData\Roaming\Sys2662.Config.Repository.bin 2011-12-20 16:17 . 2011-12-20 16:17 22 --sha-w- c:\users\Mateusz\AppData\Roaming\Sys2662.Config.Repository.bin 2011-12-17 17:57 . 2011-12-17 17:57 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll 2011-12-14 18:19 . 2011-12-14 18:19 686416 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll 2011-11-28 18:01 . 2011-10-20 13:47 256960 ----a-w- c:\windows\system32\aswBoot.exe 2011-11-24 04:52 . 2011-12-15 07:12 3145216 ----a-w- c:\windows\system32\win32k.sys 2011-11-15 13:29 . 2011-10-20 14:16 270720 ------w- c:\windows\system32\MpSigStub.exe 2011-11-12 21:18 . 2011-10-30 18:53 183112 ----a-w- c:\windows\SysWow64\PnkBstrB.exe 2011-11-10 20:56 . 2011-11-10 20:56 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll 2011-11-09 08:10 . 2011-11-09 08:10 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll 2011-11-09 08:10 . 2011-11-09 08:10 686400 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2011-11-05 05:41 . 2011-12-15 07:13 1188864 ----a-w- c:\windows\system32\wininet.dll 2011-11-05 05:32 . 2011-12-15 07:11 2048 ----a-w- c:\windows\system32\tzres.dll 2011-11-05 04:35 . 2011-12-15 07:13 981504 ----a-w- c:\windows\SysWow64\wininet.dll 2011-11-05 04:26 . 2011-12-15 07:11 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2011-11-05 03:32 . 2011-12-15 07:13 1638912 ----a-w- c:\windows\system32\mshtml.tlb 2011-11-05 02:48 . 2011-12-15 07:13 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb 2011-10-31 15:44 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll 2011-10-31 15:44 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll 2011-10-30 18:53 . 2011-10-30 18:53 66872 ----a-w- c:\windows\SysWow64\PnkBstrA.exe . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Akamai NetSession Interface"="c:\users\Mateusz\AppData\Local\Akamai\netsession_win.exe" [2011-12-12 3305760] "Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2011-12-29 620376] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 dump_wmimmc;dump_wmimmc;c:\aeriagames\WolfTeam-PL\GameGuard\dump_wmimmc.sys [x] S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [x] S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [x] S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2011-12-29 497496] S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_58afa5ca50c7b5e7\AESTSr64.exe [2010-03-17 89600] S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] S3 BcmVWL;Broadcom Virtual Wireless;c:\windows\system32\DRIVERS\bcmvwl64.sys [x] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x] S4 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1302000.00A\ccSetx64.sys [x] . . --- Inne Usługi/Sterowniki w Pamięci --- . *NewlyCreated* - WOLF . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] Akamai REG_MULTI_SZ Akamai . Zawartość folderu 'Zaplanowane zadania' . 2012-01-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3973818434-600768593-831492662-1001Core.job - c:\users\Mateusz\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-31 18:53] . 2012-01-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3973818434-600768593-831492662-1001UA.job - c:\users\Mateusz\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-31 18:53] . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ------- Skan uzupełniający ------- . uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678 uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm IE: Wyślij obraz do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Wyślij stronę do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm Trusted Zone: samsungsetup.com\www TCP: DhcpNameServer = 192.168.99.2 DPF: {682C59F5-478C-4421-9070-AD170D143B77} - hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab . - - - - USUNIĘTO PUSTE WPISY - - - - . URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file) . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai] "ServiceDll"="C:/Program Files (x86)/Common Files/Akamai/netsession_win_b427739.dll" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai] "ServiceDll"="C:/Program Files (x86)/Common Files/Akamai/netsession_win_b427739.dll" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0] "ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms" . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_USERS\S-1-5-21-3973818434-600768593-831492662-1001\Software\SecuROM\License information*] "datasecu"=hex:5d,2a,fc,07,37,27,0b,23,89,58,c5,e0,b0,20,c8,8b,d6,7b,1c,c9,10, 39,a3,3c,b9,37,6f,a5,d3,30,cc,2a,08,01,4c,1a,bb,4e,df,3f,ea,ba,41,f8,f3,5e,\ "rkeysecu"=hex:b8,88,3d,63,14,c8,c9,1d,0c,ac,f0,69,1d,d5,a2,0d . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Czas ukończenia: 2012-01-24 16:30:43 ComboFix-quarantined-files.txt 2012-01-24 15:30 . Przed: 264 746 381 312 bajtów wolnych Po: 264 432 189 440 bajtów wolnych . - - End Of File - - 1DDAE0034527531C94064CA822339D43