ComboFix 12-07-08.01 - Jerzy Leszczyński 2012-07-09 12:36:58.1.2 - x86 MINIMAL Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1250.48.1045.18.1788.1217 [GMT 2:00] Uruchomiony z: c:\users\Jerzy Leszczyński\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Utworzono nowy punkt przywracania . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\13447FC33F.sys c:\programdata\F4D55F3E6CB579685EF0D544EEC1FB6E c:\programdata\F4D55F3E6CB579685EF0D544EEC1FB6E\F4D55F3E6CB579685EF0D544EEC1FB6E c:\programdata\F4D55F3E6CB579685EF0D544EEC1FB6E\F4D55F3E6CB579685EF0D544EEC1FB6E.exe c:\windows\IsUn0415.exe c:\windows\Mplayer.exe c:\windows\system32\drivers\etc\hosts.ics c:\windows\system32\SET28DC.tmp . . ((((((((((((((((((((((((( Pliki utworzone od 2012-06-09 do 2012-07-09 ))))))))))))))))))))))))))))))) . . 2012-07-09 10:41 . 2012-07-09 10:41 -------- d-----w- c:\users\Jerzy Leszczyński\AppData\Local\temp 2012-07-09 10:41 . 2012-07-09 10:41 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-07-09 10:28 . 2012-07-09 10:28 -------- d-----r- c:\users\Jerzy Leszczyński\Videos 2012-07-03 08:42 . 2012-07-03 08:42 -------- d-----w- c:\users\Jerzy Leszczyński\AppData\Roaming\hellomoto 2012-07-03 07:37 . 2012-07-03 07:37 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FD1C9A9D-92B7-4C9C-96D2-D6E13AE375BA}\offreg.dll 2012-07-03 07:33 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FD1C9A9D-92B7-4C9C-96D2-D6E13AE375BA}\mpengine.dll 2012-07-03 02:52 . 2012-07-03 02:52 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll 2012-07-03 02:52 . 2012-07-03 02:52 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll 2012-06-29 17:17 . 2012-06-29 17:17 -------- d-----w- c:\users\Jerzy Leszczyński\AppData\Local\Macromedia . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-23 02:43 . 2012-03-28 14:40 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-06-23 02:43 . 2012-03-28 14:40 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-07-03 02:52 . 2011-10-24 00:12 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-05-16 213936] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "WinSyncMetastore"="c:\users\Jerzy Leszczyński\AppData\Local\Microsoft\Windows\4924\WinSyncMetastore.exe" [2012-07-03 96256] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-10 869936] "RtHDVCpl"="RtHDVCpl.exe" [2007-08-09 4702208] "SiSTray"="c:\program files\SiS VGA Utilities\SiSTray.exe" [2007-09-18 552960] "TouchPadHotKey"="c:\program files\FSC\TouchPad HotKey Utility\TouchPad_HotKey.exe" [2007-08-13 364544] "Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2008-05-07 524288] "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424] "NBAgent"="d:\nero\Nero BackItUp\NBAgent.exe" [2010-03-26 1234216] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] WirelessSelector.lnk - c:\program files\FSC\Wireless Utility\WirelessSelector.exe [2008-12-22 650752] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) "EnableLinkedConnections"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux5"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x] . . --- Inne Usługi/Sterowniki w Pamięci --- . *NewlyCreated* - ECACHE . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc . Zawartość folderu 'Zaplanowane zadania' . 2012-07-06 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-28 02:43] . 2012-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-18 07:39] . 2012-07-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-18 07:39] . 2012-07-09 c:\windows\Tasks\User_Feed_Synchronization-{8E36CD02-D2AA-4D60-B430-3CD5EBC462FF}.job - c:\windows\system32\msfeedssync.exe [2011-06-17 04:32] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://search.babylon.com/?AF=109805&babsrc=HP_ss&mntrId=e8cf9390000000000000001644ed164c uInternet Settings,ProxyOverride = *.local IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 83.168.104.66 192.168.0.1 FF - ProfilePath - c:\users\Jerzy Leszczyński\AppData\Roaming\Mozilla\Firefox\Profiles\e5tkbkkw.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2417076&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - gry Customized Web Search FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2417076&SearchSource=2&q= FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109805 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.id - e8cf9390000000000000001644ed164c FF - user.js: extensions.BabylonToolbar_i.hardId - e8cf9390000000000000001644ed164c FF - user.js: extensions.BabylonToolbar_i.instlDay - 15423 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1719:28 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - base FF - user.js: extensions.BabylonToolbar_i.instlRef - sst . - - - - USUNIĘTO PUSTE WPISY - - - - . URLSearchHooks-{8532a8b7-c06a-41bb-936a-8ce73e4711ed} - (no file) WebBrowser-{8532A8B7-C06A-41BB-936A-8CE73E4711ED} - (no file) SafeBoot-WudfPf SafeBoot-WudfRd AddRemove-LANGMaster 4.0 LM_DJ - d:\anglik\DeIsL1.isu . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-07-09 12:41 Windows 6.0.6001 Service Pack 1 NTFS . skanowanie ukrytych procesów ... . skanowanie ukrytych wpisów autostartu ... . skanowanie ukrytych plików ... . . c:\users\JERZYL~1\AppData\Local\Temp\catchme.dll 53248 bytes executable . skanowanie pomyślnie ukończone ukryte pliki: 1 . ************************************************************************** . Czas ukończenia: 2012-07-09 12:42:52 ComboFix-quarantined-files.txt 2012-07-09 10:42 . Przed: 285 106 176 bajtów wolnych Po: 226 902 016 bajtów wolnych . - - End Of File - - 4460FA7FEF3A0DC54572FB54EC0FC02A