ComboFix 14-09-16.01 - Zwierz 2014-09-17 20:17:17.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.48.1045.18.2046.1097 [GMT 2:00] Uruchomiony z: c:\users\Zwierz\Desktop\WoT roboczy\NVIDIA\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B} SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Zwierz\Desktop\WOTROB~1\9.2\1629_W~1\WOTTwe~1.exe c:\windows\system32\KBL.LOG . . ((((((((((((((((((((((((( Pliki utworzone od 2014-08-17 do 2014-09-17 ))))))))))))))))))))))))))))))) . . 2014-09-17 18:29 . 2014-09-17 18:29 -------- d-----w- c:\users\Zwierz\AppData\Local\temp 2014-09-17 18:29 . 2014-09-17 18:29 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-09-17 18:03 . 2010-08-30 06:34 536576 ----a-w- c:\windows\system32\sqlite3.dll 2014-09-17 17:59 . 2014-09-17 18:04 -------- d-----w- C:\AdwCleaner 2014-09-16 23:39 . 2014-09-09 01:24 8806800 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B0D6BA0D-37C0-4B5B-9B29-EF16BE6532F1}\mpengine.dll 2014-09-13 18:06 . 2014-09-13 18:08 -------- d-----w- c:\users\Zwierz\AppData\Local\NVIDIA . . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-08-25 04:53 . 2009-10-04 21:29 231584 ------w- c:\windows\system32\MpSigStub.exe 2014-08-18 05:16 . 2012-04-03 18:13 699568 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2014-08-18 05:16 . 2011-06-08 20:21 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2014-07-13 16:50 . 2013-07-21 19:16 414520 ----a-w- c:\windows\system32\drivers\aswsp.sys 2014-07-13 16:49 . 2014-05-25 19:07 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys 2014-07-13 16:49 . 2013-07-21 19:23 192352 ----a-w- c:\windows\system32\drivers\aswVmm.sys 2014-07-13 16:49 . 2013-07-21 19:23 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys 2014-07-13 16:49 . 2013-07-21 19:16 55112 ----a-w- c:\windows\system32\drivers\aswrdr.sys 2014-07-13 16:49 . 2013-07-21 19:16 57800 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2014-07-13 16:49 . 2013-07-21 19:16 779536 ----a-w- c:\windows\system32\drivers\aswsnx.sys 2014-07-13 16:49 . 2013-07-21 19:16 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2014-07-13 16:49 . 2014-07-13 16:49 43152 ----a-w- c:\windows\avastSS.scr 2014-07-13 16:49 . 2013-02-17 00:32 276432 ----a-w- c:\windows\system32\aswBoot.exe 2014-02-16 11:03 . 2014-02-16 11:03 50063360 ----a-w- c:\program files\GUT9195.tmp . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2014-07-13 16:49 578240 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320] "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-07-29 4085896] "NvBackend"="c:\program files\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-08-09 2404296] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli DPPWDFLT . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^Users^Zwierz^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk] path=c:\users\Zwierz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup backupExtension=.Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2011-06-06 10:55 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALLUpdate] 2009-06-04 20:56 869888 ----a-w- c:\program files\ALLPlayer\ALLUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] 2005-09-03 13:18 94208 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] 2007-04-03 22:29 165784 ----a-w- c:\program files\DAEMON Tools\daemon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DpAgent] 2007-09-20 09:12 671744 ----a-w- c:\program files\DigitalPersona\Bin\DpAgent.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2008-12-08 14:50 54576 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant] 2007-09-13 07:47 480560 ----a-w- c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 09:50 155648 ----a-w- c:\windows\System32\NeroCheck.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2012-01-17 10:07 252296 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu] 2007-08-16 21:13 218408 ------w- c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] 2014-07-03 04:27 1322832 ----a-w- c:\users\Zwierz\AppData\Roaming\uTorrent\uTorrent.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WAWifiMessage] 2007-01-08 14:53 311296 ----a-w- c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] 2010-01-13 22:44 37888 ----a-w- c:\program files\Winamp\winampa.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] 2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 HPService REG_MULTI_SZ HPSLPSVC . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2007-08-23 15:34 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-09-13 01:00 1096520 ----a-w- c:\program files\Google\Chrome\Application\37.0.2062.120\Installer\chrmstp.exe . Zawartość folderu 'Zaplanowane zadania' . 2014-09-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2014-08-18 05:17] . 2014-09-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2014-08-18 05:17] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.com mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=pl_pl&c=81&bd=Pavilion&pf=laptop TCP: DhcpNameServer = 62.21.99.94 62.21.99.95 . - - - - USUNIĘTO PUSTE WPISY - - - - . Toolbar-10 - (no file) ShellIconOverlayIdentifiers-{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} - (no file) SafeBoot-WudfPf SafeBoot-WudfRd MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe AddRemove-ilividtoolbargaw - c:\progra~1\SEARCH~1\Datamngr\SRTOOL~1\uninstall.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2014-09-17 20:29 Windows 6.0.6002 Service Pack 2 NTFS . skanowanie ukrytych procesów ... . skanowanie ukrytych wpisów autostartu ... . skanowanie ukrytych plików ... . skanowanie pomyślnie ukończone ukryte pliki: 0 . ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- . - - - - - - - > 'lsass.exe'(772) c:\windows\system32\DPPWDFLT.dll . Czas ukończenia: 2014-09-17 20:32:27 ComboFix-quarantined-files.txt 2014-09-17 18:32 . Przed: 27 464 126 464 bajtów wolnych Po: 27 191 259 136 bajtów wolnych . - - End Of File - - 1CEB8B5C3C21324E05628883CB5A239A 1A1A06F62E891045814007163C1C76C3