ComboFix 12-03-04.02 - AMD 2012-03-06 21:30:51.3.4 - x64 Microsoft Windows 7 Ultimate 6.1.7600.0.1250.48.1045.18.2046.1118 [GMT 1:00] Uruchomiony z: c:\users\AMD\Desktop\ComboFix.exe Użyto następujących komend :: c:\users\AMD\Desktop\CFScript.txt SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Pliki utworzone od 2012-02-06 do 2012-03-06 ))))))))))))))))))))))))))))))) . . 2012-03-06 20:38 . 2012-03-06 20:38 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-03-06 14:54 . 2012-03-06 14:54 -------- d-----w- c:\program files (x86)\Common Files\Java 2012-03-06 08:13 . 2012-03-06 15:07 -------- d-----w- c:\users\AMD\DoctorWeb 2012-03-04 17:25 . 2012-03-04 17:25 -------- d-----w- c:\users\AMD\AppData\Roaming\Malwarebytes 2012-03-04 17:25 . 2012-03-04 17:25 -------- d-----w- c:\programdata\Malwarebytes 2012-03-04 17:25 . 2011-12-10 14:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-02-29 09:41 . 2012-02-29 09:41 -------- d-----w- c:\programdata\Codemasters 2012-02-19 14:35 . 2012-02-19 14:37 -------- d-----w- c:\users\AMD\AppData\Local\Skyrim 2012-02-11 12:58 . 2012-03-01 09:38 466456 ----a-w- c:\windows\system32\wrap_oal.dll 2012-02-11 12:58 . 2012-03-01 09:38 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll 2012-02-11 12:58 . 2012-03-01 09:38 122904 ----a-w- c:\windows\system32\OpenAL32.dll 2012-02-11 12:58 . 2012-03-01 09:38 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll 2012-02-11 12:58 . 2012-02-11 12:58 -------- d-----w- c:\program files (x86)\OpenAL 2012-02-07 13:33 . 2012-02-07 13:33 -------- d-----w- c:\users\AMD\Nowy folder (2) . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-03-06 14:54 . 2011-10-17 13:51 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-01-28 09:11 . 2012-01-28 09:11 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-12-19 14:40 . 2011-12-19 14:41 750488 ----a-w- c:\windows\system32\npdeployJava1.dll 2011-12-19 14:40 . 2011-12-19 14:41 660368 ----a-w- c:\windows\system32\deployJava1.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-03-06_18.36.01 ))))))))))))))))))))))))))))))))))))))))) . + 2011-05-29 14:52 . 2012-03-06 20:05 46114 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-03-06 20:05 26612 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-05-29 14:32 . 2012-03-06 20:05 15412 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1396035045-3181242471-1236992741-1000_UserData.bin + 2011-05-29 15:02 . 2012-03-06 20:07 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-05-29 15:02 . 2012-03-06 18:08 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-05-29 15:02 . 2012-03-06 18:08 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-05-29 15:02 . 2012-03-06 20:07 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2012-03-06 20:39 . 2012-03-06 20:39 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-03-06 20:39 . 2012-03-06 20:39 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-03-06 18:35 . 2012-03-06 18:35 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Malwarebytes' Anti-Malware"="d:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 FlashUSB;FlashUSB;c:\windows\system32\DRIVERS\FlashUSB_x64.sys [2009-05-12 20480] R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [x] R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x] R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x] R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [x] R3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [x] R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-06-29 155344] R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x] S1 nltdi;nltdi;d:\program files\NetLimiter 3\nltdi.sys [2011-03-21 88200] S2 MBAMService;MBAMService;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360] S3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x] S3 PCWinSoft;ScreenCamera Video Camera;c:\windows\system32\DRIVERS\scrcamhrdrv_x64.sys [x] S3 RTL8167;Sterownik Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] . . . --------- x86-64 ----------- . . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs pnmsrv . ------- Skan uzupełniający ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.pl/ mLocal Page = c:\windows\SysWOW64\blank.htm . - - - - USUNIĘTO PUSTE WPISY - - - - . WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) . . . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_USERS\S-1-5-21-1396035045-3181242471-1236992741-1000\Software\SecuROM\License information*] "datasecu"=hex:8e,09,05,f7,28,b0,87,7a,5c,ad,96,6a,3f,f5,0d,3f,55,db,e5,78,f7, 63,c8,17,43,76,fe,50,fa,b3,4f,61,63,93,24,11,03,8c,6e,dc,b7,98,1f,58,e7,9f,\ "rkeysecu"=hex:2b,76,63,e3,79,a5,cc,06,3a,27,34,3f,78,ee,98,29 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\SysWOW64\PnkBstrA.exe . ************************************************************************** . Czas ukończenia: 2012-03-06 21:50:01 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2012-03-06 20:49 ComboFix2.txt 2012-03-06 20:15 ComboFix3.txt 2012-03-06 18:38 . Przed: 11 600 543 744 bajtów wolnych Po: 11 545 464 832 bajtów wolnych . - - End Of File - - 00EC04C72F71427E358EF60DBDD49EEC