ComboFix 12-03-04.02 - AMD 2012-03-06 19:30:13.1.4 - x64 NETWORK Microsoft Windows 7 Ultimate 6.1.7600.0.1250.48.1045.18.2046.1366 [GMT 1:00] Uruchomiony z: c:\users\AMD\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Utworzono nowy punkt przywracania . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\WebScout FileBulldog Toolbar\tbHElper.dll c:\users\AMD\AppData\Local\aceac5ab\U c:\users\AMD\AppData\Local\aceac5ab\U\80000000.@ c:\users\AMD\AppData\Local\aceac5ab\U\800000cb.@ c:\users\AMD\AppData\Local\aceac5ab\U\800000cf.@ c:\users\AMD\AppData\Local\TempDIR c:\users\AMD\AppData\Local\TempDIR\BetterInstaller.exe c:\users\AMD\AppData\Roaming\EurekaLog c:\users\AMD\AppData\Roaming\Microsoft\~DFK1a5022.tmp c:\users\AMD\AppData\Roaming\Microsoft\1eaadjc.dll c:\users\AMD\AppData\Roaming\Microsoft\bass.dll c:\users\AMD\AppData\Roaming\Microsoft\kfgresk.dll c:\users\AMD\AppData\Roaming\Microsoft\mjcriu.dll c:\users\AMD\AppData\Roaming\Microsoft\peaadje.dll c:\users\AMD\AppData\Roaming\Microsoft\qwadjb.dll c:\users\AMD\AppData\Roaming\Microsoft\rsaadjd.dll c:\windows\assembly\GAC_32\Desktop.ini c:\windows\assembly\GAC_64\Desktop.ini c:\windows\assembly\tmp\U c:\windows\DPINST.LOG c:\windows\IsUn0804.exe c:\windows\system32\{eda5f5d3-9e0f-4f4d-8a13-1d1cf469c9cc}.dll c:\windows\system32\consrv.dll c:\windows\system32\dds_log_trash.cmd c:\windows\System64 c:\windows\SysWow64\tmp16CB.tmp c:\windows\SysWow64\tmp3523.tmp c:\windows\SysWow64\tmp3544.tmp . . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_AFPAnsi -------\Service_pnmsrv . . ((((((((((((((((((((((((( Pliki utworzone od 2012-02-06 do 2012-03-06 ))))))))))))))))))))))))))))))) . . 2012-03-06 18:34 . 2012-03-06 18:34 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-03-06 14:54 . 2012-03-06 14:54 -------- d-----w- c:\program files (x86)\Common Files\Java 2012-03-06 08:13 . 2012-03-06 15:07 -------- d-----w- c:\users\AMD\DoctorWeb 2012-03-04 17:25 . 2012-03-04 17:25 -------- d-----w- c:\users\AMD\AppData\Roaming\Malwarebytes 2012-03-04 17:25 . 2012-03-04 17:25 -------- d-----w- c:\programdata\Malwarebytes 2012-03-04 17:25 . 2011-12-10 14:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-03-01 09:26 . 2012-03-01 09:26 -------- d-----w- c:\windows\3F5C371F8EA24F259D3DD0B4526E3AEA.TMP 2012-02-29 09:41 . 2012-02-29 09:41 -------- d-----w- c:\programdata\Codemasters 2012-02-19 14:35 . 2012-02-19 14:37 -------- d-----w- c:\users\AMD\AppData\Local\Skyrim 2012-02-11 12:58 . 2012-02-11 12:58 -------- d-----w- c:\windows\8AAB4176A747493AA42CB63CFADFD8E3.TMP 2012-02-11 12:58 . 2012-03-01 09:38 466456 ----a-w- c:\windows\system32\wrap_oal.dll 2012-02-11 12:58 . 2012-03-01 09:38 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll 2012-02-11 12:58 . 2012-03-01 09:38 122904 ----a-w- c:\windows\system32\OpenAL32.dll 2012-02-11 12:58 . 2012-03-01 09:38 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll 2012-02-11 12:58 . 2012-02-11 12:58 -------- d-----w- c:\program files (x86)\OpenAL 2012-02-07 13:33 . 2012-02-07 13:33 -------- d-----w- c:\users\AMD\Nowy folder (2) . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-03-06 14:54 . 2011-10-17 13:51 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-01-28 09:11 . 2012-01-28 09:11 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-12-19 14:40 . 2011-12-19 14:41 750488 ----a-w- c:\windows\system32\npdeployJava1.dll 2011-12-19 14:40 . 2011-12-19 14:41 660368 ----a-w- c:\windows\system32\deployJava1.dll . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Wisdom-soft AutoScreenRecorder 3.1 Free"="0" [X] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Malwarebytes' Anti-Malware"="d:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 MBAMService;MBAMService;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360] R3 FlashUSB;FlashUSB;c:\windows\system32\DRIVERS\FlashUSB_x64.sys [2009-05-12 20480] R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [x] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x] R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x] R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [x] R3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [x] R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-06-29 155344] R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x] S1 nltdi;nltdi;d:\program files\NetLimiter 3\nltdi.sys [2011-03-21 88200] S3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x] S3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x] S3 PCWinSoft;ScreenCamera Video Camera;c:\windows\system32\DRIVERS\scrcamhrdrv_x64.sys [x] S3 RTL8167;Sterownik Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] . . --- Inne Usługi/Sterowniki w Pamięci --- . *NewlyCreated* - WS2IFSL . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "combofix"="c:\combofix\CF1847.3XE" [2009-07-14 344576] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs pnmsrv . ------- Skan uzupełniający ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.pl/ mLocal Page = c:\windows\SysWOW64\blank.htm . - - - - USUNIĘTO PUSTE WPISY - - - - . WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) AddRemove-{A9DA5CA9-5576-4E77-8D83-5FCA5DF9ACF1}_is1 - d:\program files (x86)\Shadow Era\unins000.exe AddRemove-WinImage - d:\lg\Win Image\winimage.exe . . . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_USERS\S-1-5-21-1396035045-3181242471-1236992741-1000\Software\SecuROM\License information*] "datasecu"=hex:8e,09,05,f7,28,b0,87,7a,5c,ad,96,6a,3f,f5,0d,3f,55,db,e5,78,f7, 63,c8,17,43,76,fe,50,fa,b3,4f,61,63,93,24,11,03,8c,6e,dc,b7,98,1f,58,e7,9f,\ "rkeysecu"=hex:2b,76,63,e3,79,a5,cc,06,3a,27,34,3f,78,ee,98,29 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\SysWOW64\PnkBstrA.exe . ************************************************************************** . Czas ukończenia: 2012-03-06 19:38:48 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2012-03-06 18:38 . Przed: 10 911 490 048 bajtów wolnych Po: 11 989 172 224 bajtów wolnych . - - End Of File - - BD8D0D54EBFE394D0DB039AB34348BF5