ComboFix 12-05-06.01 - user 2012-05-06 12:30:17.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.48.1045.18.3036.1955 [GMT 2:00] Uruchomiony z: c:\users\user\Desktop\ComboFix.exe SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Pliki utworzone od 2012-04-06 do 2012-05-06 ))))))))))))))))))))))))))))))) . . 2012-05-05 19:17 . 2012-05-05 19:17 335504 ----a-w- c:\windows\system32\drivers\TrufosAlt.sys 2012-05-05 19:09 . 2012-05-05 19:09 -------- d-----w- c:\users\user\AppData\Roaming\Malwarebytes 2012-05-05 19:09 . 2012-05-05 19:09 -------- d-----w- c:\programdata\Malwarebytes 2012-05-05 19:09 . 2012-05-05 19:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2012-05-05 19:09 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-05-05 17:44 . 2012-05-05 17:44 -------- d-----w- c:\users\user\AppData\Roaming\QuickScan 2012-05-05 17:00 . 2012-05-05 17:15 -------- d-----w- c:\users\user\AppData\Roaming\ArcaVirMicroScan 2012-05-05 16:40 . 2012-05-05 16:40 -------- d-----w- c:\windows\Sun 2012-05-05 12:11 . 2012-05-05 12:11 -------- d-----w- c:\program files\ESET 2012-05-04 07:19 . 2012-04-13 07:36 6734704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{98EB2938-3B44-4A52-B7F8-2A1FFC6F40B4}\mpengine.dll 2012-04-11 06:32 . 2012-03-01 11:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-02-23 08:18 . 2009-10-30 18:22 237072 ------w- c:\windows\system32\MpSigStub.exe 2012-02-15 10:01 . 2012-02-15 10:01 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll 2012-02-15 10:01 . 2012-02-15 10:01 43520 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2012-02-14 15:45 . 2012-03-14 07:55 219648 ----a-w- c:\windows\system32\d3d10_1core.dll 2012-02-14 15:45 . 2012-03-14 07:55 160768 ----a-w- c:\windows\system32\d3d10_1.dll 2012-02-13 14:12 . 2012-03-14 07:55 1172480 ----a-w- c:\windows\system32\d3d10warp.dll 2012-02-13 13:47 . 2012-03-14 07:55 683008 ----a-w- c:\windows\system32\d2d1.dll 2012-02-13 13:44 . 2012-03-14 07:55 1068544 ----a-w- c:\windows\system32\DWrite.dll . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LManager"="c:\program files\Launch Manager\LManager.exe" [2009-03-05 805384] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-03-05 1434920] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-04-22 7420448] "Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-04-22 1833504] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-28 13797920] "DataCardMonitor"="c:\program files\blueconnect\DataCardMonitor.exe" [2011-11-14 253952] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer] c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2012-01-02 09:07 843712 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2012-03-27 12:41 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALLUpdate] 2009-06-04 21:56 869888 ----a-w- c:\program files\ALLPlayer\ALLUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon] 2012-02-20 20:28 59240 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2007-05-08 14:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HW_OPENEYE_OUC_blueconnect] 2009-12-31 13:13 110592 ----a-w- c:\program files\blueconnect\UpdateDog\ouc.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2012-03-27 03:09 421736 ----a-w- c:\program files\iTunes\iTunesHelper.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2011-10-24 13:28 421888 ----a-w- c:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2011-01-07 11:12 253672 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . --- Inne Usługi/Sterowniki w Pamięci --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 HPService REG_MULTI_SZ HPSLPSVC hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.onet.pl/ uInternet Settings,ProxyOverride = *.local IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.1 . . ------- Skojarzenia plików ------- . .scr=AutoCADScriptFile . - - - - USUNIĘTO PUSTE WPISY - - - - . SafeBoot-WudfPf SafeBoot-WudfRd MSConfigStartUp-AlcoholAutomount - c:\program files\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe MSConfigStartUp-AppleSyncNotifier - c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe MSConfigStartUp-egui - c:\program files\ESET\ESET NOD32 Antivirus\egui.exe MSConfigStartUp-EzPrint - c:\program files\Lexmark Pro200-S500 Series\ezprint.exe MSConfigStartUp-lxebmon - c:\program files\Lexmark Pro200-S500 Series\lxebmon.exe MSConfigStartUp-NokiaOviSuite2 - c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe MSConfigStartUp-PC Suite Tray - c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe MSConfigStartUp-Steam - d:\_priv\GRY\Steam\Steam.exe AddRemove-Agere Systems Soft Modem - c:\windows\agrsmdel . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-05-06 12:45 Windows 6.0.6002 Service Pack 2 NTFS . skanowanie ukrytych procesów ... . skanowanie ukrytych wpisów autostartu ... . HKLM\Software\Microsoft\Windows\CurrentVersion\Run DataCardMonitor = c:\program files\blueconnect\DataCardMonitor.exe?S;.JSE;.WSF;.WSH;.MSC?P????;????9??p???CTURE=x86?PROCESSOR_IDENQ??Q?????9??????y 6 Model 23 Stepping 10, GenuineIntel?PROCESSOR_LEVEL=6?PROCESSOR_REVISION=170a?ProgramData=c:\programdata?programfiles=c:\Prog . skanowanie ukrytych plików ... . skanowanie pomyślnie ukończone ukryte pliki: 0 . ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_USERS\S-1-5-21-530722816-3797544453-1258293311-1000\Software\SecuROM\License information*] "datasecu"=hex:90,9c,bb,68,f7,58,67,b1,f7,00,e4,50,4f,63,b0,03,aa,32,bb,1b,b1, 51,9b,4e,11,c1,c5,ba,fc,c0,60,19,64,9f,d5,6c,05,04,86,85,8d,f9,15,25,1e,4e,\ "rkeysecu"=hex:6f,13,59,64,5d,15,36,67,cd,a0,46,68,75,e4,07,bf . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- . - - - - - - - > 'Explorer.exe'(3856) c:\program files\WinSCP\DragExt.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\nvvsvc.exe c:\program files\LSI SoftModem\agrsmsvc.exe c:\programdata\DatacardService\DCService.exe c:\windows\system32\nvvsvc.exe c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe c:\windows\servicing\TrustedInstaller.exe c:\windows\system32\conime.exe c:\windows\ehome\ehmsas.exe . ************************************************************************** . Czas ukończenia: 2012-05-06 12:48:49 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2012-05-06 10:48 . Przed: 7 100 448 768 bajtów wolnych Po: 6 890 422 272 bajtów wolnych . - - End Of File - - 1A3517CD146B1729269C19709E71EB17