ComboFix 12-02-27.02 - cAst0r 2012-02-28 20:14:38.3.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1250.48.1045.18.8175.6944 [GMT 1:00] Uruchomiony z: c:\users\cAst0r\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Pliki utworzone od 2012-01-28 do 2012-02-28 ))))))))))))))))))))))))))))))) . . 2012-02-28 19:16 . 2012-02-28 19:16 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-02-28 19:16 . 2012-02-28 19:16 -------- d-----w- c:\users\Administrator\AppData\Local\temp 2012-02-27 18:06 . 2012-02-27 18:06 -------- d-----w- c:\windows\system32\Macromed 2012-02-27 17:18 . 2012-02-27 17:18 -------- d-sh--w- c:\windows\system32\%APPDATA% 2012-02-23 19:05 . 2012-02-23 19:05 -------- d-----w- c:\programdata\NVIDIA 2012-02-23 19:00 . 2012-02-10 03:14 6074176 ----a-w- c:\windows\system32\nvcpl.dll 2012-02-23 19:00 . 2012-02-10 03:14 3089728 ----a-w- c:\windows\system32\nvsvc64.dll 2012-02-23 19:00 . 2012-02-10 03:07 2561856 ----a-w- c:\windows\system32\nvsvcr.dll 2012-02-23 19:00 . 2012-02-10 03:07 889664 ----a-w- c:\windows\system32\nvvsvc.exe 2012-02-23 19:00 . 2012-02-10 03:07 63296 ----a-w- c:\windows\system32\nvshext.dll 2012-02-23 19:00 . 2012-02-10 03:07 118080 ----a-w- c:\windows\system32\nvmctray.dll 2012-02-23 19:00 . 2012-02-10 03:05 2497985 ----a-w- c:\windows\system32\nvcoproc.bin 2012-02-16 16:21 . 2012-02-16 21:14 -------- d-----w- c:\programdata\EA Logs 2012-02-07 15:55 . 2012-02-07 21:23 -------- d-----w- c:\users\cAst0r\AppData\Roaming\DMCache . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-02-28 00:17 . 2011-10-16 20:46 282864 ----a-w- c:\windows\SysWow64\PnkBstrB.exe 2012-02-28 00:17 . 2011-10-16 20:46 282864 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr 2012-02-28 00:16 . 2011-10-16 20:46 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0 2012-02-27 19:57 . 2011-09-15 17:40 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-02-16 16:21 . 2011-10-16 20:46 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe 2011-12-20 17:40 . 2011-12-20 17:40 16384 ----a-w- c:\windows\system32\drivers\EIO64.sys . . ((((((((((((((((((((((((((((( SnapShot@2012-02-28_18.32.10 ))))))))))))))))))))))))))))))))))))))))) . - 2011-09-10 15:07 . 2011-11-21 18:03 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-09-10 15:07 . 2012-02-28 19:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-09-10 15:07 . 2011-11-21 18:03 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-09-10 15:07 . 2012-02-28 19:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2012-02-28 18:31 . 2012-02-28 18:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-02-28 19:17 . 2012-02-28 19:17 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-07-14 05:01 . 2012-02-28 19:16 364596 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-02-28 18:31 364596 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2011-09-15 22:30 . 2012-02-28 19:16 26331280 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-179643350-3452753548-535153788-1000-12288.dat - 2011-09-15 22:30 . 2012-02-28 18:25 26331280 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-179643350-3452753548-535153788-1000-12288.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyœlne, prawidłowe wpisy nie sč pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "XFastUsb"="c:\program files (x86)\XFastUsb\XFastUsb.exe" [2011-09-10 4942336] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2011-10-9 1207312] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "DisableThumbnails"= 0 (0x0) "TaskbarNoNotification"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer5"=wdmaud.drv . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 Sentinel64;Sentinel64;c:\windows\System32\Drivers\Sentinel64.sys [x] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x] R3 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-09-29 1431888] R3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [x] R3 IOMap;IOMap;c:\windows\system32\drivers\IOMap64.sys [x] R3 kxwdmdrv;kX WDM Driver Service;c:\windows\system32\drivers\kx.sys [x] R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [x] R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R4 Autodesk Content Service;Autodesk Content Service;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2011-02-02 18656] R4 ekrn;ESET Service;c:\program files\ESET\x86\ekrn.exe [2011-01-12 810144] R4 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x] S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [x] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x] S1 EIO64;EIO Driver;c:\windows\system32\DRIVERS\EIO64.sys [x] S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [x] S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x] S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [x] S3 cmudaxp;ASUS Xonar D1 Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [x] S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys [x] S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys [x] S3 hidusbf;USB Mouse Rate Adjuster Lower Filter by SweetLow;c:\windows\system32\DRIVERS\hidusbf.sys [x] S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] . . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="c:\program files\ESET\egui.exe" [BU] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs XBCD . ------- Skan uzupełniajčcy ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://onet.pl/ mLocal Page = c:\windows\SysWOW64\blank.htm IE: ????3?? IE: ????3?????? IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 IE: Pobierz FlashGetem3 - c:\users\cAst0r\AppData\Roaming\FlashGetBHO\GetUrl.htm IE: Pobierz wszystko FlashGetem3 - c:\users\cAst0r\AppData\Roaming\FlashGetBHO\GetAllUrl.htm IE: Œcičgnij przy pomocy FlashGet'a - c:\program files (x86)\FlashGet\jc_link.htm IE: Œcičgnij wszystko przy pomocy FlashGet'a - c:\program files (x86)\FlashGet\jc_all.htm IE: ????3?? - c:\users\cAst0r\AppData\Roaming\FlashGetBHO\GetUrl.htm IE: ????3?????? - c:\users\cAst0r\AppData\Roaming\FlashGetBHO\GetAllUrl.htm TCP: DhcpNameServer = 62.179.1.62 62.179.1.63 0.0.0.0 FF - ProfilePath - c:\users\cAst0r\AppData\Roaming\Mozilla\Firefox\Profiles\hkjgvmq5.default\ FF - prefs.js: browser.startup.homepage - www.onet.pl . . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b0,b4,09,7b,bc,f9,a8,42,be,73,55,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b0,b4,09,7b,bc,f9,a8,42,be,73,55,\ . [HKEY_USERS\S-1-5-21-179643350-3452753548-535153788-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f3* N}] @="c:\\Users\\cAst0r\\AppData\\Roaming\\FlashGetBHO\\GetUrl.htm" "contexts"=dword:00000022 . [HKEY_USERS\S-1-5-21-179643350-3452753548-535153788-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f3* N}hQèț”„c] @="c:\\Users\\cAst0r\\AppData\\Roaming\\FlashGetBHO\\GetAllUrl.htm" "contexts"=dword:000000f3 . [HKEY_USERS\S-1-5-21-179643350-3452753548-535153788-1000\Software\SecuROM\License information*] "datasecu"=hex:96,f1,67,05,a5,03,b0,77,a7,33,fc,cd,fe,fa,31,94,79,7e,44,0e,b8, a9,73,18,98,95,6d,50,66,69,b8,d4,49,d7,0e,d8,29,1b,c9,06,fb,b6,de,9d,d5,53,\ "rkeysecu"=hex:5e,46,55,01,e2,42,07,3e,77,e3,4a,43,3a,5b,d9,f2 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\SysWOW64\ASDR.exe c:\windows\SysWOW64\PnkBstrA.exe . ************************************************************************** . Czas ukończenia: 2012-02-28 20:19:14 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2012-02-28 19:19 ComboFix2.txt 2012-02-28 19:07 ComboFix3.txt 2012-02-28 18:34 . Przed: 46 247 567 360 bajtów wolnych Po: 45 938 774 016 bajtów wolnych . - - End Of File - - 70F75E91747F8BB5FBF2A8574D61AE35