API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Dec 3rd, 2017
439
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 20.66 KB | None | 0 0
raw download clone embed print report
  1. ComboFix 17-11-14.01 - jarek 2017-12-03 9:47.1.2 - x64 NETWORK
  2. Microsoft Windows 7 Home Premium 6.1.7601.1.1250.48.1045.18.2937.1906 [GMT 1:00]
  3. Uruchomiony z: c:\users\jarek\Downloads\ComboFix.exe
  4. AV: Avast Antivirus *Enabled/Updated* {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
  5. SP: Avast Antivirus *Enabled/Updated* {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
  6. SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  7. * Utworzono nowy punkt przywracania
  8. .
  9. .
  10. ((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
  11. .
  12. .
  13. c:\windows\IsUn0415.exe
  14. c:\windows\msdownld.tmp
  15. .
  16. .
  17. ((((((((((((((((((((((((( Pliki utworzone od 2017-11-03 do 2017-12-03 )))))))))))))))))))))))))))))))
  18. .
  19. .
  20. 2017-12-03 08:58 . 2017-12-03 08:58 -------- d-----w- c:\users\Default\AppData\Local\temp
  21. 2017-12-03 08:37 . 2017-12-03 08:40 -------- d-----w- C:\AdwCleaner
  22. 2017-12-03 08:36 . 2017-12-03 08:36 55232 ----a-w- c:\windows\system32\drivers\hitmanpro37.sys
  23. 2017-12-03 08:36 . 2017-12-03 08:36 -------- d-----w- c:\programdata\Sophos
  24. 2017-12-03 08:30 . 2017-12-03 08:30 -------- d-----w- c:\programdata\SWCUTemp
  25. 2017-11-16 17:44 . 2017-11-16 17:44 45704 ----a-w- c:\windows\system32\drivers\staport.sys
  26. 2017-11-16 17:44 . 2017-11-16 17:43 183584 ----a-w- c:\windows\system32\drivers\aswArPot.sys
  27. 2017-11-16 17:43 . 2017-11-16 17:43 365168 ----a-w- c:\windows\system32\aswBoot.exe
  28. .
  29. .
  30. .
  31. (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
  32. .
  33. 2017-11-16 17:44 . 2016-11-15 14:20 455376 ----a-w- c:\windows\system32\drivers\aswSP.sys
  34. 2017-11-16 17:43 . 2016-11-15 14:20 364464 ----a-w- c:\windows\system32\drivers\aswVmm.sys
  35. 2017-11-16 17:43 . 2016-11-15 14:20 203976 ----a-w- c:\windows\system32\drivers\aswStm.sys
  36. 2017-11-16 17:43 . 2016-11-15 14:20 84416 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
  37. 2017-11-16 17:43 . 2016-11-15 14:20 47008 ----a-w- c:\windows\system32\drivers\aswHwid.sys
  38. 2017-11-16 17:43 . 2016-11-15 14:20 148288 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
  39. 2017-11-16 17:43 . 2016-11-15 14:20 110376 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
  40. 2017-11-16 17:42 . 2016-11-15 14:20 1026232 ----a-w- c:\windows\system32\drivers\aswSnx.sys
  41. 2017-11-16 17:42 . 2017-03-02 16:27 57728 ----a-w- c:\windows\system32\drivers\aswbuniva.sys
  42. 2017-11-16 17:42 . 2017-03-02 16:27 343288 ----a-w- c:\windows\system32\drivers\aswbloga.sys
  43. 2017-11-16 17:42 . 2017-03-02 16:27 321032 ----a-w- c:\windows\system32\drivers\aswbidsdrivera.sys
  44. 2017-11-16 17:42 . 2017-03-02 16:27 198968 ----a-w- c:\windows\system32\drivers\aswbidsha.sys
  45. 2017-11-14 16:14 . 2015-08-25 18:28 803328 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
  46. 2017-11-14 16:14 . 2015-08-25 18:28 144896 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
  47. 2017-09-06 19:03 . 2016-11-15 14:24 41832 ----a-w- c:\windows\system32\drivers\aswKbd.sys
  48. .
  49. .
  50. ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
  51. .
  52. .
  53. *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
  54. REGEDIT4
  55. .
  56. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
  57. "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
  58. "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
  59. "NBAgent"="c:\program files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe" [2010-03-09 1086760]
  60. "Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-11 288088]
  61. "HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2010-03-03 423936]
  62. "SVPWUTIL"="c:\program files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe" [2010-02-22 352256]
  63. "KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2010-08-15 34160]
  64. "TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2010-05-01 2454840]
  65. "ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136]
  66. "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
  67. "IseUI"="c:\program files (x86)\COMODO\Internet Security Essentials\vkise.exe" [2016-12-06 3386568]
  68. "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2016-12-12 587288]
  69. .
  70. [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  71. "TOSHIBA Online Product Information"="c:\program files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe" [2010-03-03 4581280]
  72. .
  73. c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
  74. TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]
  75. .
  76. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  77. "ConsentPromptBehaviorAdmin"= 5 (0x5)
  78. "ConsentPromptBehaviorUser"= 3 (0x3)
  79. "EnableUIADesktopToggle"= 0 (0x0)
  80. "EnableLinkedConnections"= 1 (0x1)
  81. "SoftwareSASGeneration"= 1 (0x1)
  82. .
  83. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
  84. "LoadAppInit_DLLs"=1 (0x1)
  85. .
  86. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
  87. @=""
  88. .
  89. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
  90. @=""
  91. .
  92. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
  93. @=""
  94. .
  95. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
  96. @=""
  97. .
  98. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
  99. @=""
  100. .
  101. R0 aswbidsh;aswbidsh;c:\windows\system32\drivers\aswbidsha.sys;c:\windows\SYSNATIVE\drivers\aswbidsha.sys [x]
  102. R0 aswblog;aswblog;c:\windows\system32\drivers\aswbloga.sys;c:\windows\SYSNATIVE\drivers\aswbloga.sys [x]
  103. R0 aswbuniv;aswbuniv;c:\windows\system32\drivers\aswbuniva.sys;c:\windows\SYSNATIVE\drivers\aswbuniva.sys [x]
  104. R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys;c:\windows\SYSNATIVE\drivers\aswRvrt.sys [x]
  105. R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys;c:\windows\SYSNATIVE\drivers\aswVmm.sys [x]
  106. R1 aswArPot;aswArPot;c:\windows\system32\drivers\aswArPot.sys;c:\windows\SYSNATIVE\drivers\aswArPot.sys [x]
  107. R1 aswbidsdriver;aswbidsdriver;c:\windows\system32\drivers\aswbidsdrivera.sys;c:\windows\SYSNATIVE\drivers\aswbidsdrivera.sys [x]
  108. R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
  109. R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
  110. R1 isedrv;Internet Security Essentials;c:\windows\system32\drivers\isedrv.sys;c:\windows\SYSNATIVE\drivers\isedrv.sys [x]
  111. R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
  112. R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
  113. R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe [x]
  114. R2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [x]
  115. R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
  116. R2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [x]
  117. R2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
  118. R2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
  119. R2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [x]
  120. R2 isesrv;isesrv;c:\program files (x86)\COMODO\Internet Security Essentials\isesrv.exe;c:\program files (x86)\COMODO\Internet Security Essentials\isesrv.exe [x]
  121. R2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
  122. R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
  123. R3 aswbIDSAgent;aswbIDSAgent;c:\program files\AVAST Software\Avast\x64\aswidsagenta.exe;c:\program files\AVAST Software\Avast\x64\aswidsagenta.exe [x]
  124. R3 aswHwid;aswHwid;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
  125. R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe [x]
  126. R3 hitmanpro37;HitmanPro 3.7 Support Driver;c:\windows\system32\drivers\hitmanpro37.sys;c:\windows\SYSNATIVE\drivers\hitmanpro37.sys [x]
  127. R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
  128. R3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]
  129. R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
  130. R3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
  131. R3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
  132. R3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
  133. R3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
  134. R3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
  135. R3 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe;c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [x]
  136. R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]
  137. R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]
  138. R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
  139. R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
  140. S1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys;c:\windows\SYSNATIVE\drivers\aswKbd.sys [x]
  141. S3 CeKbFilter;CeKbFilter;c:\windows\system32\DRIVERS\CeKbFilter.sys;c:\windows\SYSNATIVE\DRIVERS\CeKbFilter.sys [x]
  142. S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
  143. S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys;c:\windows\SYSNATIVE\DRIVERS\rtl8192Ce.sys [x]
  144. .
  145. .
  146. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
  147. LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr QWAVE wcncsvc
  148. .
  149. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
  150. 2017-11-15 18:07 1509208 ----a-w- c:\program files (x86)\Google\Chrome\Application\62.0.3202.94\Installer\chrmstp.exe
  151. .
  152. .
  153. --------- X64 Entries -----------
  154. .
  155. .
  156. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00asw]
  157. @="{472083B0-C522-11CF-8763-00608CC02F24}"
  158. .
  159. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
  160. @="{472083B0-C522-11CF-8763-00608CC02F24}"
  161. [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
  162. 2017-11-16 17:43 1793296 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
  163. .
  164. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00asw]
  165. @="{472083B0-C522-11CF-8763-00608CC02F24}"
  166. .
  167. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
  168. @="{472083B0-C522-11CF-8763-00608CC02F24}"
  169. [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
  170. 2017-11-16 17:43 1793296 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
  171. .
  172. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  173. "Toshiba TEMPRO"="c:\program files (x86)\Toshiba TEMPRO\TemproTray.exe" [2010-05-11 1050072]
  174. "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-07 166424]
  175. "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-07 391192]
  176. "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-07 410648]
  177. "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-28 11101800]
  178. "RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-07-28 2120808]
  179. "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-02-05 709976]
  180. "TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
  181. "Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaReminder.exe" [2010-04-19 136136]
  182. "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvLaunch.exe" [2017-11-16 253344]
  183. .
  184. ------- Skan uzupełniający -------
  185. .
  186. uLocal Page = c:\windows\system32\blank.htm
  187. uStart Page = https://www.google.pl/
  188. mLocal Page = c:\windows\SysWOW64\blank.htm
  189. IE: E&ksportuj do programu Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
  190. TCP: DhcpNameServer = 192.168.0.1
  191. .
  192. - - - - USUNIĘTO PUSTE WPISY - - - -
  193. .
  194. Toolbar-Locked - (no file)
  195. Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
  196. Toolbar-Locked - (no file)
  197. HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe
  198. HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
  199. HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
  200. HKLM-Run-SmoothView - c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe
  201. HKLM-Run-00TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
  202. HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
  203. HKLM-Run-SmartFaceVWatcher - c:\program files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
  204. AddRemove-SimCity 3000 - c:\windows\IsUn0415.exe
  205. AddRemove-{958A475F-037D-401A-AC05-209725973E11}_is1 - c:\program files (x86)\Booking.com\unins000.exe
  206. .
  207. .
  208. .
  209. --------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
  210. .
  211. [HKEY_USERS\S-1-5-21-2750261995-724818214-202736448-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*$%_*]
  212. @Class="Shell"
  213. .
  214. [HKEY_USERS\S-1-5-21-2750261995-724818214-202736448-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*$%_*\OpenWithList]
  215. @Class="Shell"
  216. .
  217. [HKEY_USERS\S-1-5-21-2750261995-724818214-202736448-1000\com.avast.ipm.ClientParameters.FirefoxExtensionSpStatus*]
  218. @Allowed: (Read) (RestrictedCode)
  219. "cl"=dword:00000003
  220. .
  221. [HKEY_USERS\S-1-5-21-2750261995-724818214-202736448-1000\°ťÚr*]
  222. @Allowed: (Read) (RestrictedCode)
  223. "cl"=dword:00000003
  224. .
  225. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
  226. @Denied: (A 2) (Everyone)
  227. @="FlashBroker"
  228. "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_27_0_0_187_ActiveX.exe,-101"
  229. .
  230. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
  231. "Enabled"=dword:00000001
  232. .
  233. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
  234. @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_27_0_0_187_ActiveX.exe"
  235. .
  236. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
  237. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  238. .
  239. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
  240. @Denied: (A 2) (Everyone)
  241. @="IFlashBroker6"
  242. .
  243. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
  244. @="{00020424-0000-0000-C000-000000000046}"
  245. .
  246. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
  247. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  248. "Version"="1.0"
  249. .
  250. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
  251. @Denied: (A 2) (Everyone)
  252. @="FlashBroker"
  253. "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_27_0_0_187_ActiveX.exe,-101"
  254. .
  255. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
  256. "Enabled"=dword:00000001
  257. .
  258. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
  259. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_27_0_0_187_ActiveX.exe"
  260. .
  261. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
  262. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  263. .
  264. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  265. @Denied: (A 2) (Everyone)
  266. @="Shockwave Flash Object"
  267. .
  268. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
  269. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_27_0_0_187.ocx"
  270. "ThreadingModel"="Apartment"
  271. .
  272. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
  273. @="0"
  274. .
  275. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
  276. @="ShockwaveFlash.ShockwaveFlash.27"
  277. .
  278. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  279. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_27_0_0_187.ocx, 1"
  280. .
  281. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
  282. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  283. .
  284. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
  285. @="1.0"
  286. .
  287. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  288. @="ShockwaveFlash.ShockwaveFlash"
  289. .
  290. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  291. @Denied: (A 2) (Everyone)
  292. @="Macromedia Flash Factory Object"
  293. .
  294. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
  295. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_27_0_0_187.ocx"
  296. "ThreadingModel"="Apartment"
  297. .
  298. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
  299. @="FlashFactory.FlashFactory.1"
  300. .
  301. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  302. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_27_0_0_187.ocx, 1"
  303. .
  304. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
  305. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  306. .
  307. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
  308. @="1.0"
  309. .
  310. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  311. @="FlashFactory.FlashFactory"
  312. .
  313. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
  314. @Denied: (A 2) (Everyone)
  315. @="IFlashBroker6"
  316. .
  317. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
  318. @="{00020424-0000-0000-C000-000000000046}"
  319. .
  320. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
  321. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  322. "Version"="1.0"
  323. .
  324. [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
  325. "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  326. 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
  327. .
  328. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  329. @Denied: (Full) (Everyone)
  330. .
  331. Czas ukończenia: 2017-12-03 10:02:11
  332. ComboFix-quarantined-files.txt 2017-12-03 09:02
  333. .
  334. Przed: 60 405 354 496 bajtów wolnych
  335. Po: 61 391 302 656 bajtów wolnych
  336. .
  337. - - End Of File - - 83F8BB0558EABD986E54B8568D43002A
  338. A36C5E4F47E84449FF07ED3517B43A31
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!