ComboFix 13-01-08.01 - Ola 2013-01-10 10:08:14.1.4 - x86 MINIMAL Uruchomiony z: E:\ComboFix.exe . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\dsgsdgdsgdsgw.pad c:\programdata\FullRemove.exe c:\users\Ola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk c:\users\Ola\vifpwpdi.exe c:\users\Ola\wgsdgsdgdsgsd.exe . . ((((((((((((((((((((((((( Pliki utworzone od 2012-12-10 do 2013-01-10 ))))))))))))))))))))))))))))))) . . 2013-01-10 09:23 . 2013-01-10 09:23 -------- d-----w- c:\users\Ola\AppData\Local\temp 2013-01-10 09:23 . 2013-01-10 09:23 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-01-09 22:44 . 2013-01-10 09:12 60872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2EAA5A26-15A8-4684-807E-D426B58B00C5}\offreg.dll 2013-01-09 22:43 . 2013-01-09 22:43 2839 ----a-w- c:\programdata\dsgsdgdsgdsgw.js 2013-01-09 16:16 . 2012-12-07 12:26 308736 ----a-w- c:\windows\system32\Wpc.dll 2013-01-08 08:46 . 2012-11-08 18:00 6812136 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2EAA5A26-15A8-4684-807E-D426B58B00C5}\mpengine.dll 2013-01-02 05:18 . 2013-01-02 05:18 0 ----a-w- c:\windows\system32\sho167.tmp 2012-12-29 11:32 . 2012-12-29 17:02 -------- d-----w- c:\users\Ola\AppData\Roaming\.minecraft 2012-12-27 08:03 . 2012-12-27 08:04 -------- d-----w- c:\users\Ola\AppData\Roaming\SprillRichiPoland 2012-12-27 08:01 . 2012-12-27 08:03 -------- d-----w- c:\program files\Zeberka.pl 2012-12-26 22:11 . 2012-12-27 08:01 -------- d-----w- c:\program files\Alawar.pl 2012-12-26 10:03 . 2012-12-26 10:03 -------- d-----w- c:\users\Ola\AppData\Local\2DBoy 2012-12-26 10:03 . 2012-12-26 10:03 -------- d-----w- c:\programdata\2DBoy 2012-12-26 09:10 . 2012-12-26 09:10 -------- d-----w- c:\programdata\InterAction studios 2012-12-24 10:49 . 2012-12-16 14:13 295424 ----a-w- c:\windows\system32\atmfd.dll 2012-12-24 10:49 . 2012-12-16 14:13 34304 ----a-w- c:\windows\system32\atmlib.dll 2012-12-15 13:59 . 2012-12-15 13:59 -------- d-----w- c:\program files\Snikers 2012-12-12 14:40 . 2012-11-02 05:11 376832 ----a-w- c:\windows\system32\dpnet.dll 2012-12-12 14:40 . 2012-11-09 04:42 2048 ----a-w- c:\windows\system32\tzres.dll . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-12-10 15:37 . 2012-12-10 15:37 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2012-12-10 15:37 . 2012-09-06 13:14 821736 ----a-w- c:\windows\system32\npdeployJava1.dll 2012-12-10 15:37 . 2011-12-24 21:10 746984 ----a-w- c:\windows\system32\deployJava1.dll 2012-10-16 07:39 . 2012-11-28 14:49 561664 ----a-w- c:\windows\apppatch\AcLayers.dll 2012-12-06 19:22 . 2011-12-25 18:51 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-05-04 1519272] . [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu 10"="c:\program files\Gadu-Gadu 10\gg.exe" [2011-07-04 13374048] "Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2012-10-30 3093624] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-02-11 10025576] "SuiteTray"="c:\program files\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-09-28 340336] "EgisTecPMMUpdate"="c:\program files\EgisTec IPS\PmmUpdate.exe" [2010-09-17 407920] "EgisUpdate"="c:\program files\EgisTec IPS\EgisUpdate.exe" [2010-09-17 201584] "Norton Online Backup"="c:\program files\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 966488] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-01-11 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-01-11 173592] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-01-11 150552] "LManager"="c:\program files\Launch Manager\LManager.exe" [2011-03-14 1081424] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-10-08 1934632] "Power Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2011-02-23 715368] "iSyncData"="c:\program files\Acer\Android Manager\iSync.exe" [2011-05-10 408128] "AndroidManager"="c:\program files\Acer\Android Manager\AML.exe" [2011-05-10 508992] "iPatchData"="c:\program files\Acer\Updater\iUpdate.exe" [2011-05-10 492096] "ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-05-04 1561768] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "IsMyWinLockerReboot"="msiexec.exe" [2010-11-20 73216] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2011-5-10 704104] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~2\BROWSE~1\23762~1.17\{16CDF~1\browsemngr.dll . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x] R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x] R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x] R2 Browser Manager;Browser Manager;c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe [x] R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x] R2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [x] R2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x] R2 GREGService;GREGService;c:\program files\Acer\Registration\GREGsvc.exe [x] R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x] R2 IconMan_R;IconMan_R;c:\program files\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x] R2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [x] R2 NOBU;Norton Online Backup;c:\program files\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x] R2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [x] R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x] R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [x] R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files\Common Files\EgisTec\Services\EgisTicketService.exe [x] R3 NETwNs32;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETwNs32.sys [x] R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [x] R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x] R3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x] R3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x] R3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x] R3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x] R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 zte_cdc_acm;ZTE All CDC-ACM driver;c:\windows\system32\DRIVERS\zte_cdc_acm.sys [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc . Zawartość folderu 'Zaplanowane zadania' . 2013-01-10 c:\windows\Tasks\Acer Registration - Data Sending task.job - c:\program files\Acer\Registration\GREG.exe [2011-01-25 02:59] . 2013-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-06-06 14:31] . 2013-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-06-06 14:31] . 2013-01-03 c:\windows\Tasks\Norton Security Scan for Ola.job - c:\progra~1\NORTON~2\Engine\361~1.11\Nss.exe [2011-12-25 02:30] . . ------- Skan uzupełniający ------- . uStart Page = mStart Page = IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\Ola\AppData\Roaming\Mozilla\Firefox\Profiles\0dsqrlqh.default\ FF - prefs.js: browser.startup.homepage - FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_uid=04042E36-9760-4E39-800F-E3AD427CD1C5&apn_ptnrs=9M&apn_sauid=180DF1B6-3909-4131-8E9D-EA9D266506EE&apn_dtid=OSJ000&&q= FF - user.js: extensions.BabylonToolbar_i.id - 7c16511d00000000000078929c2807ce FF - user.js: extensions.BabylonToolbar_i.hardId - 7c16511d00000000000078929c2807ce FF - user.js: extensions.BabylonToolbar_i.instlDay - 15373 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babclient FF - user.js: extensions.BabylonToolbar_i.tlbrId - base FF - user.js: extensions.BabylonToolbar_i.newTab - false FF - user.js: extensions.BabylonToolbar_i.babTrack - FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - FF - user.js: extensions.BabylonToolbar_i.instlRef - std FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=7c16511d00000000000078929c2807ce&q= FF - user.js: extensions.BabylonToolbar.id - 7c16511d00000000000078929c2807ce FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB} FF - user.js: extensions.BabylonToolbar.instlDay - 15619 FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.0.7 FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.0.7 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.0.720:34 FF - user.js: extensions.BabylonToolbar.prtnrId - babylon FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar.instlRef - sst FF - user.js: extensions.BabylonToolbar.dfltLng - en FF - user.js: extensions.BabylonToolbar.excTlbr - false FF - user.js: extensions.BabylonToolbar.admin - false . - - - - USUNIĘTO PUSTE WPISY - - - - . Toolbar-Locked - (no file) HKLM-Run-ROC_ROC_NT - c:\program files\AVG Secure Search\ROC_ROC_NT.exe . . . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Czas ukończenia: 2013-01-10 10:27:34 ComboFix-quarantined-files.txt 2013-01-10 09:27 . Przed: 183 391 850 496 bajtów wolnych Po: 184 348 549 120 bajtów wolnych . - - End Of File - - 4D68248E026D39E61CCD28DF6C1C8EEC