ComboFix 12-11-14.01 - Administrator 2012-11-15 13:17:13.2.2 - x86 MINIMAL Microsoft Windows XP Home Edition 5.1.2600.3.1250.48.1045.18.2038.1807 [GMT 1:00] Uruchomiony z: c:\documents and settings\Administrator\Pulpit\ComboFix.exe . . ((((((((((((((((((((((((( Pliki utworzone od 2012-10-15 do 2012-11-15 ))))))))))))))))))))))))))))))) . . 2012-11-15 11:30 . 2012-11-15 11:46 -------- d-----w- c:\documents and settings\Administrator 2012-11-15 10:59 . 2012-11-15 10:59 -------- d-----w- c:\windows\Sun 2012-11-13 13:06 . 2012-11-13 13:06 -------- d-----w- c:\program files\Winamp 2012-11-04 19:39 . 2008-04-14 21:50 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll 2012-11-04 19:39 . 2008-04-14 21:50 21504 ----a-w- c:\windows\system32\hidserv.dll 2012-11-04 19:39 . 2008-04-14 20:50 14720 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys 2012-11-04 19:39 . 2008-04-14 20:50 14720 ----a-w- c:\windows\system32\drivers\kbdhid.sys . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-22 19:57 . 2008-09-06 12:00 1866624 ----a-w- c:\windows\system32\win32k.sys 2012-10-10 09:55 . 2012-10-10 09:55 73728 ----a-w- c:\windows\system32\javacpl.cpl 2012-10-10 09:55 . 2012-10-10 09:55 472808 ----a-w- c:\windows\system32\deployJava1.dll 2012-10-09 20:19 . 2012-08-31 08:32 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-10-09 20:19 . 2012-08-31 08:32 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-10-02 18:04 . 2008-09-06 12:00 58368 ----a-w- c:\windows\system32\synceng.dll 2012-08-28 15:18 . 2008-09-06 12:00 916992 ----a-w- c:\windows\system32\wininet.dll 2012-08-28 15:18 . 2008-09-06 12:00 43520 ------w- c:\windows\system32\licmgr10.dll 2012-08-28 15:18 . 2008-09-06 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl 2012-08-28 12:07 . 2008-09-06 12:00 385024 ------w- c:\windows\system32\html.iec 2012-08-24 13:53 . 2008-09-06 12:00 177664 ----a-w- c:\windows\system32\wintrust.dll 2012-08-23 06:27 . 2008-09-06 12:00 2150400 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-08-23 06:27 . 2008-04-14 21:59 2029056 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-10-28 15:25 . 2012-10-28 15:24 261600 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-07-02 159744] "SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-07-20 1228800] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-06-23 141336] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-06-23 173592] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-06-23 142360] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2010-10-29 2498560] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-09-06 15360] . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= . S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-07-13 160944] S3 cpuz134;cpuz134;\??\c:\docume~1\user\USTAWI~1\Temp\HBCD\PCWizard\pcwiz_x32.sys --> c:\docume~1\user\USTAWI~1\Temp\HBCD\PCWizard\pcwiz_x32.sys [?] . --- Inne Usługi/Sterowniki w Pamięci --- . *NewlyCreated* - MDMXSDK . Zawartość folderu 'Zaplanowane zadania' . 2012-11-15 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-31 20:19] . 2012-11-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-10-10 08:56] . 2012-11-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-10-10 08:56] . 2012-11-15 c:\windows\Tasks\User_Feed_Synchronization-{2AF82AB3-717B-40CE-A827-88EC1F80DD66}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31] . . ------- Skan uzupełniający ------- . TCP: DhcpNameServer = 192.168.0.1 FF - ProfilePath - . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-11-15 13:23 Windows 5.1.2600 Dodatek Service Pack 3 NTFS . skanowanie ukrytych procesów ... . skanowanie ukrytych wpisów autostartu ... . skanowanie ukrytych plików ... . skanowanie pomyślnie ukończone ukryte pliki: 0 . ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_USERS\S-1-5-21-73586283-299502267-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1b,1e,eb,27,65,a3,2b,43,91,f3,d3,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1b,1e,eb,27,65,a3,2b,43,91,f3,d3,\ . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- . - - - - - - - > 'winlogon.exe'(212) c:\windows\System32\BCMLogon.dll . - - - - - - - > 'explorer.exe'(1912) c:\windows\system32\WININET.dll . Czas ukończenia: 2012-11-15 13:24:38 ComboFix-quarantined-files.txt 2012-11-15 12:24 ComboFix2.txt 2012-11-15 11:43 . Przed: 64 310 181 888 bajtów wolnych Po: 64 302 612 480 bajtów wolnych . - - End Of File - - F69F9AEDD68C99749E47C92A0E8C1AF8