ComboFix 12-07-08.01 - Pioterk 2012-07-09  16:11:21.1.2 - x86 MINIMAL
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1250.48.1045.18.3069.2549 [GMT 2:00]
Uruchomiony z: c:\users\Pioterk\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *Enabled/Outdated* {CB0F8167-5331-BA19-698E-64816B6801A5}
SP: ESET NOD32 Antivirus 4.0 *Enabled/Outdated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Utworzono nowy punkt przywracania
.
.
(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\kyvydhksnzrcjem
c:\programdata\tfzfwziw.exe
c:\windows\msxml4-KB954430-enu.LOG
c:\windows\msxml4-KB973688-enu.LOG
.
.
(((((((((((((((((((((((((   Pliki utworzone od 2012-06-09 do 2012-07-09  )))))))))))))))))))))))))))))))
.
.
2012-07-09 14:16 . 2012-07-09 14:18	--------	d-----w-	c:\users\Pioterk\AppData\Local\temp
2012-07-09 14:16 . 2012-07-09 14:16	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-07-07 21:59 . 2012-07-07 21:59	--------	d-----w-	c:\users\Pioterk\AppData\Roaming\hellomoto
2012-07-07 21:58 . 2012-07-07 21:58	--------	d-----w-	c:\programdata\eivngdrbblfxxuy
2012-07-07 16:40 . 2012-07-07 16:40	--------	d-----w-	c:\program files\MSXML 4.0
2012-07-06 20:42 . 2012-07-06 20:42	--------	d-----w-	c:\programdata\WEBREG
2012-07-06 20:42 . 2012-07-06 20:46	--------	d-----w-	c:\users\Pioterk\AppData\Roaming\HP
2012-07-06 20:42 . 2012-07-06 20:42	--------	d-----w-	c:\users\Pioterk\AppData\Local\HP
2012-07-06 20:41 . 2009-06-08 23:43	316928	----a-w-	c:\windows\system32\Spool\prtprocs\w32x86\hpfpp092.dll
2012-07-06 20:34 . 2012-07-06 20:34	--------	d-----w-	c:\programdata\HP Product Assistant
2012-07-06 20:31 . 2012-07-06 20:31	--------	d-----w-	c:\program files\Common Files\HP
2012-07-06 20:31 . 2012-07-06 20:31	--------	d-----w-	c:\program files\Common Files\Hewlett-Packard
2012-07-06 20:30 . 2012-07-06 20:30	--------	d-----w-	c:\windows\hpoj4500g510n-z
2012-07-06 20:29 . 2009-05-26 17:32	716288	----a-w-	c:\windows\system32\hpwwiax9.dll
2012-07-06 20:29 . 2009-05-18 21:49	372736	----a-w-	c:\windows\system32\hppldcoi.dll
2012-07-06 20:29 . 2009-05-26 17:32	593920	----a-w-	c:\windows\system32\hpwtscl5.dll
2012-07-06 20:29 . 2009-05-26 17:32	315392	----a-w-	c:\windows\system32\hpwvst01.dll
2012-07-06 20:29 . 2009-05-21 13:14	452408	----a-w-	c:\windows\system32\hpzids01.dll
2012-07-06 20:29 . 2009-06-08 23:43	122880	----a-w-	c:\windows\system32\hpf3l092.dll
2012-07-06 20:28 . 2012-07-06 20:35	--------	d-----w-	c:\program files\HP
2012-07-06 20:26 . 2012-07-06 20:42	--------	d-----w-	c:\programdata\HP
2012-07-06 13:49 . 2012-05-31 03:41	6762896	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{E4922D9F-659B-4D0D-92BE-FC40B928D06F}\mpengine.dll
2012-06-22 05:10 . 2012-06-02 22:19	53784	----a-w-	c:\windows\system32\wuauclt.exe
2012-06-22 05:10 . 2012-06-02 22:19	45080	----a-w-	c:\windows\system32\wups2.dll
2012-06-22 05:10 . 2012-06-02 22:19	1933848	----a-w-	c:\windows\system32\wuaueng.dll
2012-06-22 05:10 . 2012-06-02 22:12	2422272	----a-w-	c:\windows\system32\wucltux.dll
2012-06-22 05:09 . 2012-06-02 22:19	35864	----a-w-	c:\windows\system32\wups.dll
2012-06-22 05:09 . 2012-06-02 22:19	577048	----a-w-	c:\windows\system32\wuapi.dll
2012-06-22 05:09 . 2012-06-02 22:12	88576	----a-w-	c:\windows\system32\wudriver.dll
2012-06-22 05:09 . 2012-06-02 13:19	171904	----a-w-	c:\windows\system32\wuwebv.dll
2012-06-22 05:09 . 2012-06-02 13:12	33792	----a-w-	c:\windows\system32\wuapp.exe
2012-06-18 14:35 . 2012-06-18 14:35	--------	d-----w-	c:\users\Pioterk\AppData\Roaming\ZWSoft
2012-06-18 14:28 . 2012-06-18 14:28	6656	----a-w-	c:\windows\system32\Ry4CoInst.dll
2012-06-18 14:28 . 2012-06-18 14:28	20648	----a-w-	c:\windows\system32\drivers\Rockey4USB.sys
2012-06-18 14:28 . 2012-06-18 14:28	26976	----a-w-	c:\windows\system32\drivers\Rockey4.sys
2012-06-18 14:27 . 2012-06-18 14:27	--------	d-----w-	c:\programdata\FLEXnet
2012-06-18 14:27 . 2012-06-18 14:27	--------	d-----w-	c:\program files\Common Files\Macrovision Shared
2012-06-18 14:27 . 2012-06-18 14:27	--------	d-----w-	c:\program files\Common Files\ZWSoft Shared
2012-06-18 14:27 . 2012-06-26 17:15	--------	d-----w-	c:\program files\ZWCAD 2012 Plk
2012-06-12 19:51 . 2012-04-23 16:00	984064	----a-w-	c:\windows\system32\crypt32.dll
2012-06-12 19:51 . 2012-04-23 16:00	98304	----a-w-	c:\windows\system32\cryptnet.dll
2012-06-12 19:51 . 2012-04-23 16:00	133120	----a-w-	c:\windows\system32\cryptsvc.dll
2012-06-12 19:51 . 2012-05-01 14:03	180736	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-06-12 19:51 . 2012-05-15 19:51	2045440	----a-w-	c:\windows\system32\win32k.sys
.
.
.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-19 21:45 . 2012-04-27 09:55	426184	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-06-19 21:45 . 2011-08-18 19:43	70344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 430080]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Akamai NetSession Interface"="c:\users\Pioterk\AppData\Local\Akamai\netsession_win.exe" [2012-05-26 4327744]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"NDSTray.exe"="NDSTray.exe" [BU]
"Google EULA Launcher"="c:\program files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-08 6037504]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-04-29 417792]
"HDMICtrlMan"="c:\program files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe" [2008-04-26 716800]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 716800]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2008-01-11 574864]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"TSWorkspace"="c:\users\Pioterk\AppData\Local\Microsoft\Windows\1150\TSWorkspace.exe" [2012-07-07 50176]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\Toshiba\TRDCReminder\TRDCReminder.exe [2008-3-5 393216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
.
.
--- Inne Usługi/Sterowniki w Pamięci ---
.
*NewlyCreated* - ECACHE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
HPService	REG_MULTI_SZ   	HPSLPSVC
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Zawartość folderu 'Zaplanowane zadania'
.
2012-07-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-27 21:45]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://onet.pl/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
uInternet Settings,ProxyOverride = <local>
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 217.28.150.195 217.28.150.157
.
- - - - USUNIĘTO PUSTE WPISY - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-tfzfwziwgqmqrpy - c:\programdata\tfzfwziw.exe
HKLM-Run-cfFncEnabler.exe - cfFncEnabler.exe
HKLM-Run-tfzfwziwgqmqrpy - c:\programdata\tfzfwziw.exe
AddRemove-PIT Format 2011_is1 - g:\pit format 2011\unins000.exe
AddRemove-WolfTeam-PL - c:\users\Pioterk\Desktop\Wolfteam-PL\Uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-07-09 16:18
Windows 6.0.6002 Service Pack 2 NTFS
.
skanowanie ukrytych procesów ...  
.
skanowanie ukrytych wpisów autostartu ... 
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i??????7?w?A??P?[?x?[???[???[??  
.
skanowanie ukrytych plików ...  
.
skanowanie pomyślnie ukończone
ukryte pliki: 0
.
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Czas ukończenia: 2012-07-09  16:20:26
ComboFix-quarantined-files.txt  2012-07-09 14:20
.
Przed: 142 127 079 424 bajtów wolnych
Po: 145 133 309 952 bajtów wolnych
.
- - End Of File - - 4112FDABD874B27AB822F8172EA3F90F