ComboFix 12-11-06.03 - Michał 2012-11-07 22:13:29.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1250.48.1045.18.4010.2730 [GMT 1:00] Uruchomiony z: c:\users\Micha-\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\dsgsdgdsgdsgw.pad c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk . . ((((((((((((((((((((((((( Pliki utworzone od 2012-10-07 do 2012-11-07 ))))))))))))))))))))))))))))))) . . 2012-11-07 21:19 . 2012-11-07 21:19 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp 2012-11-07 21:19 . 2012-11-07 21:19 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-11-07 20:38 . 2012-11-07 20:38 -------- d-----w- c:\users\Michał\AppData\Roaming\Malwarebytes 2012-11-07 20:38 . 2012-11-07 20:38 -------- d-----w- c:\programdata\Malwarebytes 2012-11-07 20:38 . 2012-09-29 18:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-11-07 20:38 . 2012-11-07 20:38 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-11-07 20:29 . 2012-11-07 20:29 -------- d-----w- c:\program files\CCleaner 2012-11-07 20:20 . 2012-11-07 20:20 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C52B239C-11BE-470A-90C1-3F434C1C4D58}\offreg.dll 2012-11-07 20:09 . 2012-10-30 22:50 285328 ----a-w- c:\windows\system32\aswBoot.exe 2012-11-07 20:09 . 2012-11-07 20:57 -------- d-----w- c:\programdata\AVAST Software 2012-11-07 20:09 . 2012-11-07 20:09 -------- d-----w- c:\program files\AVAST Software 2012-11-07 08:11 . 2012-11-07 08:11 -------- d-----w- c:\users\Michał\AppData\Local\{DEF12A45-45CA-4ED4-9B67-22DA4F56634F} 2012-11-06 20:11 . 2012-11-06 20:11 -------- d-----w- c:\users\Michał\AppData\Local\{86AA163D-4EEB-4D6B-BA37-D7DDC300CDE9} 2012-11-06 08:10 . 2012-11-06 08:10 -------- d-----w- c:\users\Michał\AppData\Local\{1E18C5FB-8B43-49F9-978B-59C1AC2344A9} 2012-11-06 08:10 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C52B239C-11BE-470A-90C1-3F434C1C4D58}\mpengine.dll 2012-11-05 08:13 . 2012-11-05 08:13 -------- d-----w- c:\users\Michał\AppData\Local\{CD7ADB7A-7D54-4BAD-93ED-87A56BC24871} 2012-11-03 09:04 . 2012-11-03 09:04 -------- d-----w- c:\users\Michał\AppData\Local\{60D06756-1EA5-46E2-BC7B-F4164587518D} 2012-11-02 07:44 . 2012-11-02 07:44 -------- d-----w- c:\users\Michał\AppData\Local\{D388B48C-578C-47F3-9352-AC78CD09B1F3} 2012-11-01 13:26 . 2012-11-01 13:26 -------- d-----w- c:\users\Michał\AppData\Local\{C7CD1591-AD61-427E-98CA-2D2ACAB44BD7} 2012-10-31 20:34 . 2012-10-31 20:34 -------- d-----w- c:\users\Michał\AppData\Local\{A952328D-9F67-47EE-BC7E-19C8676E8DCB} 2012-10-31 07:50 . 2012-10-31 07:50 -------- d-----w- c:\users\Michał\AppData\Local\{02499468-A829-4F14-8DE7-4654F6DDE464} 2012-10-30 08:13 . 2012-10-30 08:13 -------- d-----w- c:\users\Michał\AppData\Local\{FE516926-26D4-438D-A13E-8F73D5525F2A} 2012-10-29 08:04 . 2012-10-29 08:04 -------- d-----w- c:\users\Michał\AppData\Local\{DB486958-A8E9-46ED-9697-6AEC63CA310F} 2012-10-29 08:02 . 2012-10-29 08:03 -------- d-----w- c:\users\Michał\AppData\Local\{96C8D291-ED96-4F0C-AD5C-77056523C17D} 2012-10-26 07:11 . 2012-10-26 07:11 -------- d-----w- c:\users\Michał\AppData\Local\{52A70113-28AE-4A00-9780-D207CF4720D8} 2012-10-26 07:11 . 2012-10-26 07:11 -------- d-----w- c:\users\Michał\AppData\Local\{5915745B-DD30-4C7A-880F-86782E2656BB} 2012-10-25 06:32 . 2012-10-25 06:33 -------- d-----w- c:\users\Michał\AppData\Local\{5A6A81CE-8BBF-4D02-A890-1798B635541A} 2012-10-24 06:45 . 2012-10-24 06:45 -------- d-----w- c:\users\Michał\AppData\Local\{C6611F92-AD8B-4FCA-83A1-F3C42EF77C26} 2012-10-23 06:49 . 2012-10-23 06:49 -------- d-----w- c:\users\Michał\AppData\Local\{C79E1252-FB9F-4C0C-B0C8-05132AADAB5C} 2012-10-22 07:50 . 2012-10-22 07:50 -------- d-----w- c:\users\Michał\AppData\Local\{814F69D5-14A2-40AB-9952-D964C4ADA08F} 2012-10-21 19:50 . 2012-10-21 19:50 -------- d-----w- c:\users\Michał\AppData\Local\{096702F2-F73E-4AE4-AB5A-25E29AF3BCDC} 2012-10-19 07:01 . 2012-10-19 07:01 -------- d-----w- c:\users\Michał\AppData\Local\{E22C4C59-D26B-4A32-B5D3-A0451835E5F7} 2012-10-18 06:54 . 2012-10-18 06:55 -------- d-----w- c:\users\Michał\AppData\Local\{AEDF6864-ABB8-43AE-AA07-28C31BE46ED6} 2012-10-17 06:53 . 2012-10-17 06:53 -------- d-----w- c:\users\Michał\AppData\Local\{9D8481D6-EBE7-404B-9FE1-8AA4B0A1871F} 2012-10-15 10:08 . 2012-10-15 10:08 -------- d-----w- c:\users\Michał\AppData\Local\{2987EE57-14F5-4588-A86C-D68A53F2069A} 2012-10-15 06:38 . 2012-10-15 06:38 -------- d-----w- c:\users\Michał\AppData\Local\{3829DA3D-96FF-4FEC-AB04-C6D2E9F1877D} 2012-10-13 11:09 . 2012-10-13 11:09 -------- d-----w- c:\users\Michał\AppData\Local\{E801FCC0-A6C9-4144-A963-6F18F44BC287} 2012-10-12 07:25 . 2012-10-12 07:25 -------- d-----w- c:\users\Michał\AppData\Local\{3BB36C71-934B-4E0D-9A08-B2D8EA5B1585} 2012-10-11 20:35 . 2012-10-26 23:24 -------- d-----w- c:\programdata\ipla 2012-10-11 20:34 . 2012-10-11 20:35 -------- d-----w- c:\program files (x86)\ipla 2012-10-11 07:02 . 2012-08-24 18:05 220160 ----a-w- c:\windows\system32\wintrust.dll 2012-10-11 07:02 . 2012-08-24 16:57 172544 ----a-w- c:\windows\SysWow64\wintrust.dll 2012-10-11 07:02 . 2012-09-14 19:19 2048 ----a-w- c:\windows\system32\tzres.dll 2012-10-11 07:02 . 2012-09-14 18:28 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2012-10-11 07:02 . 2012-08-11 00:56 715776 ----a-w- c:\windows\system32\kerberos.dll 2012-10-11 07:02 . 2012-08-10 23:56 542208 ----a-w- c:\windows\SysWow64\kerberos.dll 2012-10-11 07:02 . 2012-06-02 05:41 184320 ----a-w- c:\windows\system32\cryptsvc.dll 2012-10-11 07:02 . 2012-06-02 05:41 140288 ----a-w- c:\windows\system32\cryptnet.dll 2012-10-11 07:02 . 2012-06-02 05:41 1464320 ----a-w- c:\windows\system32\crypt32.dll 2012-10-11 07:02 . 2012-06-02 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll 2012-10-11 07:02 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\SysWow64\crypt32.dll 2012-10-11 07:02 . 2012-06-02 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll 2012-10-11 06:44 . 2012-10-11 06:44 -------- d-----w- c:\users\Michał\AppData\Local\{71431E49-3500-4317-B049-D55941EBFB71} 2012-10-10 06:49 . 2012-10-10 06:50 -------- d-----w- c:\users\Michał\AppData\Local\{A7A972FF-1444-4C72-9D85-AA3ABF0AB809} 2012-10-09 11:55 . 2012-10-09 11:58 -------- d-----w- c:\users\Michał\AppData\Local\{8D70324D-8C10-4922-8B5B-F6DA781F023D} . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-11 20:10 . 2012-03-07 07:59 65309168 ----a-w- c:\windows\system32\MRT.exe 2012-10-08 22:07 . 2012-06-30 11:50 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-10-08 22:07 . 2012-02-28 16:44 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-10-07 20:26 . 2012-10-07 20:26 1700352 ----a-w- c:\windows\SysWow64\gdiplus.dll 2012-10-07 20:26 . 2012-10-07 20:26 1060864 ----a-w- c:\windows\SysWow64\mfc71.dll 2012-09-09 05:52 . 2012-09-09 05:52 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-09-09 05:52 . 2012-09-09 05:52 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll 2012-09-09 05:52 . 2012-03-22 08:01 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-08-24 11:15 . 2012-09-23 11:03 17810944 ----a-w- c:\windows\system32\mshtml.dll 2012-08-24 10:39 . 2012-09-23 11:03 10925568 ----a-w- c:\windows\system32\ieframe.dll 2012-08-24 10:31 . 2012-09-23 11:03 2312704 ----a-w- c:\windows\system32\jscript9.dll 2012-08-24 10:22 . 2012-09-23 11:03 1346048 ----a-w- c:\windows\system32\urlmon.dll 2012-08-24 10:21 . 2012-09-23 11:03 1392128 ----a-w- c:\windows\system32\wininet.dll 2012-08-24 10:20 . 2012-09-23 11:03 1494528 ----a-w- c:\windows\system32\inetcpl.cpl 2012-08-24 10:18 . 2012-09-23 11:03 237056 ----a-w- c:\windows\system32\url.dll 2012-08-24 10:17 . 2012-09-23 11:03 85504 ----a-w- c:\windows\system32\jsproxy.dll 2012-08-24 10:14 . 2012-09-23 11:03 173056 ----a-w- c:\windows\system32\ieUnatt.exe 2012-08-24 10:14 . 2012-09-23 11:03 816640 ----a-w- c:\windows\system32\jscript.dll 2012-08-24 10:13 . 2012-09-23 11:03 599040 ----a-w- c:\windows\system32\vbscript.dll 2012-08-24 10:12 . 2012-09-23 11:03 2144768 ----a-w- c:\windows\system32\iertutil.dll 2012-08-24 10:11 . 2012-09-23 11:03 729088 ----a-w- c:\windows\system32\msfeeds.dll 2012-08-24 10:10 . 2012-09-23 11:03 96768 ----a-w- c:\windows\system32\mshtmled.dll 2012-08-24 10:09 . 2012-09-23 11:03 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2012-08-24 10:04 . 2012-09-23 11:03 248320 ----a-w- c:\windows\system32\ieui.dll 2012-08-24 06:59 . 2012-09-23 11:03 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll 2012-08-24 06:51 . 2012-09-23 11:03 1129472 ----a-w- c:\windows\SysWow64\wininet.dll 2012-08-24 06:51 . 2012-09-23 11:03 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2012-08-24 06:47 . 2012-09-23 11:03 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe 2012-08-24 06:47 . 2012-09-23 11:03 420864 ----a-w- c:\windows\SysWow64\vbscript.dll 2012-08-24 06:43 . 2012-09-23 11:03 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb 2012-08-22 18:12 . 2012-09-12 07:11 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys 2012-08-22 18:12 . 2012-09-12 07:11 950128 ----a-w- c:\windows\system32\drivers\ndis.sys 2012-08-22 18:12 . 2012-09-12 07:11 376688 ----a-w- c:\windows\system32\drivers\netio.sys 2012-08-22 18:12 . 2012-09-12 07:11 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2012-08-21 21:01 . 2012-09-26 07:00 245760 ----a-w- c:\windows\system32\OxpsConverter.exe 2012-08-20 17:38 . 2012-10-11 07:05 44032 ----a-w- c:\windows\apppatch\acwow64.dll . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "RemoteControl10"="c:\program files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe" [2010-09-20 87336] "CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "iPlusManager"="c:\program files (x86)\iPlus\iPlusChecker.exe" [2010-10-27 464192] "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) "AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944] R3 AMPPALP;Protokół Intel(R) Centrino(R) Bluetooth 3.0 + High Speed;c:\windows\system32\DRIVERS\amppal.sys [2011-04-21 294912] R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560] R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2010-10-27 117248] R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [2010-10-27 13952] R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2010-10-27 256000] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232] R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-05 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2011-06-04 25960] S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2011-07-29 13824] S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-04-21 1136640] S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-03-30 923984] S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [2011-03-30 1001808] S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-04-21 134928] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-29 399432] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-29 676936] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776] S2 SGDrv;SGDrv;c:\windows\system32\DRIVERS\SGdrv64.sys [2011-04-11 7680] S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-05-05 2656536] S3 AMPPAL;Karta wirtualna Intel(R) Centrino(R) Bluetooth 3.0 + High Speed;c:\windows\system32\DRIVERS\AMPPAL.sys [2011-04-21 294912] S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [2011-03-30 1321296] S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys [2011-03-08 51712] S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [2011-03-08 274944] S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2011-08-17 31216] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2011-06-17 186152] S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2010-10-27 86016] S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [2011-03-22 59904] S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-29 25928] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-04-22 471144] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496] . . Zawartość folderu 'Zaplanowane zadania' . 2012-11-07 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-30 22:07] . 2012-05-27 c:\windows\Tasks\AutoKMS.job - c:\windows\AutoKMS\AutoKMS.exe [2012-03-14 22:13] . 2012-11-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-15 19:39] . 2012-11-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-15 19:39] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-12 12558440] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-07-18 168216] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-07-18 391960] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-07-18 418584] "BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-03-30 10372368] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=c:\windows\System32\nvinitx.dll . ------- Skan uzupełniający ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://samsung.msn.com mStart Page = hxxp://samsung.msn.com mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&ksportuj do programu Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Wyślij &do programu OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 194.204.152.34 194.204.159.1 192.168.1.1 TCP: Interfaces\{1A8D92F5-B4AD-4896-BA1B-975E15D66459}: NameServer = 212.2.96.53 212.2.96.51 TCP: Interfaces\{F787EB18-0137-44B9-8873-B97C695BB1A6}: NameServer = 212.2.96.53 212.2.96.54 FF - ProfilePath - c:\users\Michał\AppData\Roaming\Mozilla\Firefox\Profiles\dskukk70.default\ . - - - - USUNIĘTO PUSTE WPISY - - - - . Toolbar-Locked - (no file) Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe Toolbar-Locked - (no file) HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe AddRemove-BankBrowser - c:\users\Michał\Desktop\bankbrowser_3_6.exe . . . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_USERS\S-1-5-21-1771593470-3012635902-189330645-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:a7,9e,51,4e,a3,d0,97,1a,3f,59,80,54,84,1a,ee,5f,55,ce,e2,78,10,00,2c, 45,4c,38,f1,33,ee,e2,84,c5,80,73,21,07,f2,4a,b1,73,da,0a,c8,ac,8f,fc,f7,73,\ "??"=hex:fb,06,5b,ed,b7,44,8a,e5,81,12,df,ea,a1,66,06,4e . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Czas ukończenia: 2012-11-07 22:21:37 ComboFix-quarantined-files.txt 2012-11-07 21:21 . Przed: 111 682 433 024 bajtów wolnych Po: 111 055 740 928 bajtów wolnych . - - End Of File - - 730E21F23BF938AC7304B9CB5B21D8FD