API tools faq
paste
Guest User

Untitled

a guest
Sep 20th, 2014
378
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 12.48 KB | None | 0 0
raw download clone embed print report
  1. ComboFix 14-09-18.01 - hp 2014-09-20 12:35:20.4.1 - x86
  2. Microsoft Windows XP Home Edition 5.1.2600.2.1250.48.1045.18.1015.513 [GMT 2:00]
  3. Uruchomiony z: c:\documents and settings\hp\Pulpit\com\ComboFix.exe
  4. AV: avast! Antivirus *Disabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
  5. .
  6. .
  7. ((((((((((((((((((((((((( Pliki utworzone od 2014-08-20 do 2014-09-20 )))))))))))))))))))))))))))))))
  8. .
  9. .
  10. 2014-09-20 10:02 . 2014-09-20 10:02 -------- d-----w- c:\documents and settings\hp\Dane aplikacji\Media Player Classic
  11. 2014-09-20 10:01 . 2013-03-17 16:21 3649536 ----a-w- c:\windows\system32\x264vfw.dll
  12. 2014-09-20 10:01 . 2011-12-07 17:32 216064 ----a-w- c:\windows\system32\lagarith.dll
  13. 2014-09-20 10:01 . 2011-06-24 14:44 243200 ----a-w- c:\windows\system32\xvidvfw.dll
  14. 2014-09-20 10:01 . 2011-06-24 14:28 650752 ----a-w- c:\windows\system32\xvidcore.dll
  15. 2014-09-20 10:01 . 2008-09-24 18:41 839680 ----a-w- c:\windows\system32\lameACM.acm
  16. 2014-09-20 10:01 . 2012-07-21 10:54 122880 ----a-w- c:\windows\system32\ac3acm.acm
  17. 2014-09-20 10:01 . 2013-08-22 17:09 217176 ----a-w- c:\windows\system32\unrar.dll
  18. 2014-09-20 10:01 . 2013-09-12 18:00 112640 ----a-w- c:\windows\system32\ff_vfw.dll
  19. 2014-09-20 10:01 . 2014-09-20 10:01 -------- d-----w- c:\program files\K-Lite Codec Pack
  20. .
  21. .
  22. .
  23. (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
  24. .
  25. 2014-09-20 10:07 . 2013-10-25 08:47 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
  26. 2014-09-20 10:07 . 2013-10-25 08:47 701104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
  27. .
  28. .
  29. ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
  30. .
  31. .
  32. *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
  33. REGEDIT4
  34. .
  35. [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{77e8143b-6759-416e-b521-82cfed75150b}]
  36. 2014-04-10 08:59 423744 ----a-w- c:\documents and settings\hp\Ustawienia lokalne\Dane aplikacji\DivX_Browser_Bar\prxtbDiv0.dll
  37. .
  38. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  39. "{77e8143b-6759-416e-b521-82cfed75150b}"= "c:\documents and settings\hp\Ustawienia lokalne\Dane aplikacji\DivX_Browser_Bar\prxtbDiv0.dll" [2014-04-10 423744]
  40. .
  41. [HKEY_CLASSES_ROOT\clsid\{77e8143b-6759-416e-b521-82cfed75150b}]
  42. .
  43. [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
  44. "{77E8143B-6759-416E-B521-82CFED75150B}"= "c:\documents and settings\hp\Ustawienia lokalne\Dane aplikacji\DivX_Browser_Bar\prxtbDiv0.dll" [2014-04-10 423744]
  45. .
  46. [HKEY_CLASSES_ROOT\clsid\{77e8143b-6759-416e-b521-82cfed75150b}]
  47. .
  48. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  49. "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2013-08-01 3673696]
  50. "uTorrent"="c:\documents and settings\hp\Dane aplikacji\uTorrent\uTorrent.exe" [2014-09-20 1416016]
  51. .
  52. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  53. "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]
  54. "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-06-03 177456]
  55. "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1028096]
  56. "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-24 141848]
  57. "Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-24 137752]
  58. "DataCardMonitor"="c:\program files\blueconnect\DataCardMonitor.exe" [2013-10-30 253952]
  59. "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-24 166424]
  60. "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
  61. "upfst_pl_14.exe"="c:\documents and settings\hp\Ustawienia lokalne\Dane aplikacji\fst_pl_14\upfst_pl_14.exe" [2013-11-27 3154416]
  62. "avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-03-09 2769336]
  63. "CCS Poland Imola ModemListener"="c:\program files\HSPA USB MODEM\BackgroundService\ModemListener.exe" [2013-10-14 158032]
  64. .
  65. [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  66. "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]
  67. .
  68. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
  69. @="Driver"
  70. .
  71. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
  72. 2010-11-15 20:02 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
  73. .
  74. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fst_pl_14]
  75. 2013-11-27 12:19 3993584 ----a-w- c:\program files\fst_pl_14\fst_pl_14.exe
  76. .
  77. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fst_pl_19]
  78. 2013-12-17 18:10 11671024 ----a-w- c:\program files\fst_pl_19\fst_pl_19.exe
  79. .
  80. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HW_OPENEYE_OUC_blueconnect]
  81. 2009-12-31 13:13 110592 ----a-w- c:\program files\blueconnect\UpdateDog\ouc.exe
  82. .
  83. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetPanel]
  84. 2014-07-10 14:09 218112 ----a-w- c:\program files\NetPanel\Starter.exe
  85. .
  86. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
  87. 2012-07-03 08:04 252848 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
  88. .
  89. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UIExec]
  90. 2011-05-31 11:47 138584 ----a-w- c:\program files\PLAY ONLINE\UIExec.exe
  91. .
  92. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\upfst_pl_14.exe]
  93. 2013-11-27 12:19 3154416 ----a-w- c:\documents and settings\hp\Ustawienia lokalne\Dane aplikacji\fst_pl_14\upfst_pl_14.exe
  94. .
  95. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
  96. 2014-09-20 09:38 1416016 ----a-w- c:\documents and settings\hp\Dane aplikacji\uTorrent\uTorrent.exe
  97. .
  98. [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  99. "c:\\WINDOWS\\system32\\sessmgr.exe"=
  100. "c:\\Documents and Settings\\hp\\Dane aplikacji\\uTorrent\\uTorrent.exe"=
  101. "c:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"=
  102. .
  103. [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
  104. "7676:TCP"= 7676:TCP:oowydpg
  105. .
  106. R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2014-07-10 162640]
  107. R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2013-10-23 243128]
  108. R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2014-07-10 19024]
  109. R2 UI Assistant Service;UI Assistant Service;c:\program files\PLAY ONLINE\AssistantServices.exe [2014-04-15 260976]
  110. R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2013-10-26 193840]
  111. R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [2013-10-30 73216]
  112. S2 CCS_Poland Imola Modem Device Helper;CCS_Poland Imola Modem Device Helper;c:\program files\HSPA USB MODEM\BackgroundService\ServiceManager.exe -start --> c:\program files\HSPA USB MODEM\BackgroundService\ServiceManager.exe -start [?]
  113. S2 HWDeviceService.exe;HWDeviceService.exe;c:\documents and settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe [2011-03-14 271712]
  114. S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\Drivers\e4ldr.sys --> c:\windows\system32\Drivers\e4ldr.sys [?]
  115. S2 oucpcxo;Monitor Support;c:\windows\system32\svchost.exe -k netsvcs [2006-03-02 14336]
  116. S2 PLAY ONLINE. RunOuc;PLAY ONLINE. OUC;c:\program files\PLAY ONLINE\UpdateDog\ouc.exe [2013-11-10 246112]
  117. S2 Wpm;Wpm Service;c:\documents and settings\All Users\Dane aplikacji\WPM\wprotectmanager.exe -service --> c:\documents and settings\All Users\Dane aplikacji\WPM\wprotectmanager.exe -service [?]
  118. S3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\DRIVERS\e4usbaw.sys --> c:\windows\system32\DRIVERS\e4usbaw.sys [?]
  119. S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [2013-10-30 102784]
  120. S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2013-10-30 235392]
  121. S3 filtertdidriver;filtertdidriver;c:\windows\system32\drivers\ewfiltertdidriver.sys [2013-10-30 7552]
  122. S3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\drivers\ew_jucdcacm.sys [2013-10-30 90368]
  123. S3 jrdusbser;Modem Interface Device for Legacy Serial Communication;c:\windows\system32\drivers\jrdusbser.sys [2014-07-10 106112]
  124. S3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2014-04-15 9216]
  125. .
  126. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
  127. oucpcxo
  128. .
  129. [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
  130. 2014-09-20 09:36 1096520 ----a-w- c:\program files\Google\Chrome\Application\37.0.2062.120\Installer\chrmstp.exe
  131. .
  132. Zawartość folderu 'Zaplanowane zadania'
  133. .
  134. 2014-09-20 c:\windows\Tasks\Adobe Flash Player Updater.job
  135. - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-25 10:07]
  136. .
  137. 2014-09-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  138. - c:\program files\Google\Update\GoogleUpdate.exe [2013-12-15 16:44]
  139. .
  140. 2014-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  141. - c:\program files\Google\Update\GoogleUpdate.exe [2013-12-15 16:44]
  142. .
  143. .
  144. ------- Skan uzupełniający -------
  145. .
  146. uStart Page = hxxp://www.gazeta.pl/0,0.html?p=128
  147. uDefault_Search_URL = hxxp://www.aartemis.com/web/?type=ds&ts=1387204792&from=cor&uid=TOSHIBAXMK8046GSX_382IT0F6TXX382IT0F6T&q={searchTerms}
  148. mStart Page = about:blank
  149. TCP: DhcpNameServer = 192.168.1.1
  150. TCP: Interfaces\{E3FB6732-20CD-420E-A499-C823BAC914F0}: NameServer = 8.8.8.8,8.8.4.4
  151. FF - ProfilePath - c:\documents and settings\hp\Dane aplikacji\Mozilla\Firefox\Profiles\kpj90xff.default-1398817687578\
  152. FF - prefs.js: browser.startup.homepage - hxxp://www.gazeta.pl/0,0.html?p=128
  153. .
  154. .
  155. **************************************************************************
  156. .
  157. catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  158. Rootkit scan 2014-09-20 12:38
  159. Windows 5.1.2600 Dodatek Service Pack 2 NTFS
  160. .
  161. skanowanie ukrytych procesów ...
  162. .
  163. skanowanie ukrytych wpisów autostartu ...
  164. .
  165. HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  166. DataCardMonitor = c:\program files\blueconnect\DataCardMonitor.exe????????????????????????Z? ?????x???x??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
  167. .
  168. skanowanie ukrytych plików ...
  169. .
  170. skanowanie pomyślnie ukończone
  171. ukryte pliki: 0
  172. .
  173. **************************************************************************
  174. .
  175. [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\oucpcxo]
  176. "ServiceDll"="c:\windows\system32\xxrkloy.dll"
  177. .
  178. --------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
  179. .
  180. [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
  181. @Denied: (A 2) (Everyone)
  182. @="FlashBroker"
  183. "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
  184. .
  185. [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
  186. "Enabled"=dword:00000001
  187. .
  188. [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
  189. @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
  190. .
  191. [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
  192. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  193. .
  194. [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
  195. @Denied: (A 2) (Everyone)
  196. @="IFlashBroker5"
  197. .
  198. [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
  199. @="{00020424-0000-0000-C000-000000000046}"
  200. .
  201. [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
  202. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  203. "Version"="1.0"
  204. .
  205. --------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
  206. .
  207. - - - - - - - > 'explorer.exe'(3908)
  208. c:\windows\system32\WPDShServiceObj.dll
  209. c:\windows\system32\PortableDeviceTypes.dll
  210. c:\windows\system32\PortableDeviceApi.dll
  211. c:\windows\system32\browselc.dll
  212. c:\windows\system32\wpdshext.dll
  213. .
  214. Czas ukończenia: 2014-09-20 12:39:47
  215. ComboFix-quarantined-files.txt 2014-09-20 10:39
  216. ComboFix2.txt 2014-09-20 10:33
  217. ComboFix3.txt 2014-09-20 10:26
  218. ComboFix4.txt 2014-07-10 14:02
  219. .
  220. Przed: 3 740 012 544 bajtów wolnych
  221. Po: 3 726 626 816 bajtów wolnych
  222. .
  223. - - End Of File - - 866B8685510A0AC9E87ED65420B7E526
  224. 32052574BF9F325AE309ABC7BFD04460
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!