Помощ при откриване и премахване на вируси, троянски коне и др., част 2

3 май 200917 г.

Здравейте!

От известно време ползвам Мулето,за да тегля файлове,които трудно намирам.Днес изтеглих поредните файлове,но се оказаха,че имат вирус.Антивирусната,не ги хвана за мое учудване.Ползвам Bitdefender Internet Security.Дали е добра или не мисля,че сега не е тема за разговор.

Изключих System Restore,влязох под сейф мод и пуснах да сканирам-първо със SpyBot,след това с антивирусната.Намери някакви гадини спауеъра и ми показа,че ги е махнало.Антивирусната,засече само един троянец,който беше keygen за една програма.Както и да е.Пуснах компа,върнах си всичко нормално и пак същото-тая гадина ми изключва антивирусната и SpyBot-а!Ще постна снимки по-надолу.На Виста съм(операционната с-ма) между другото.Рових се в нета и се оказа,че бубата е winupgor.exe.Следвах съвета от един западен сайт,свалих си програмата Malwerbytes` Anti-Spyware и пуснах да се сканира и с нея.Ето какво откри:

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa (Rootkit.Bagle) -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s (Rootkit.Bagle) -> No action taken.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\drvsyskit (Trojan.Agent) -> No action taken.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Users\ivaylopopov\AppData\Roaming\drivers\winupgro.exe (Trojan.Agent) -> No action taken.

Снимка от таск мениджъра тук

Снимка какво се появява на декстопа тук

Някой имал ли е подобна гадина и как да процедирам нататък?

3 май 200917 г.

Здравей!

Добре си се подредил с този Bagle. Тук много ще помогне ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

http://translate.google.com/translate?js=n...te0=&swap=1

3 май 200917 г.

Сега ще го изтегля и ще пробвам,какво ще стане!Дано се получи!

Мисля,че това Combo помогна,сега остана само да си оправя защитната стена,че нещо гадината я е скапало,ама ще търся във форума на производителя!

Благодаря много за бързата помощ,Fixer!

п.п.Ако не ти представлява трудност кажи или дай линк за някаква програма,която да е съвместима с Bitdefender?Вече няма да разчитам само на нея и сериозно ще се замисля дали да си купя нейно ново копие,след като ми изтече лицинза след 2 месеца!

Редактирано 3 май 200917 г. от ivo1017 (преглед на промените)

3 май 200917 г.

Идеята ми беше да извършиш сканиране с ComboFix и накрая да публикуваш тук лога, за да видим дали реално си чист или не. Логът се намира в C:\combofix.txt , копирай съдържанието му и го публикувай тук.

3 май 200917 г.

Ето го и него,явно не съм те разбрал.Има ли нещо подозритерно вътре?

(((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\uTorrent\uTorrent.exe

c:\users\ivaylopopov\AppData\Roaming\drivers\downld

c:\users\ivaylopopov\AppData\Roaming\drivers\winupgro.exe

c:\windows\a3kebook.ini

c:\windows\akebook.ini

c:\windows\ANS2000.INI

c:\windows\system32\x64

F:\Autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_sK9Ou0s

-------\Service_srosa

((((((((((((((((((((((((( Files Created from 2009-04-03 to 2009-05-03 )))))))))))))))))))))))))))))))

.

2009-05-03 16:24 . 2009-05-03 16:24 -------- d-----w c:\users\ivaylopopov\AppData\Roaming\Malwarebytes

2009-05-03 16:24 . 2009-04-06 12:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-05-03 16:24 . 2009-04-06 12:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-03 16:24 . 2009-05-03 16:24 -------- d-----w c:\programdata\Malwarebytes

2009-05-03 16:24 . 2009-05-03 16:24 -------- d-----w c:\users\All Users\Malwarebytes

2009-05-03 16:24 . 2009-05-03 16:24 -------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-05-03 15:38 . 2009-05-03 15:42 -------- d-----w c:\windows\BDOSCAN8

2009-05-03 12:08 . 2009-05-03 12:09 -------- d-----w c:\users\ivaylopopov\AppData\Roaming\GetRightToGo

2009-05-03 10:32 . 2009-05-03 16:28 -------- d-----w c:\programdata\Spybot - Search & Destroy

2009-05-03 10:32 . 2009-05-03 16:28 -------- d-----w c:\users\All Users\Spybot - Search & Destroy

2009-05-03 10:32 . 2009-05-03 10:35 -------- d-----w c:\program files\Spybot - Search & Destroy

2009-05-03 10:04 . 2009-05-03 10:05 -------- d-----r c:\users\ivaylopopov\Videos

2009-05-03 09:56 . 2009-05-03 09:56 -------- d-----r c:\users\Public\Music

2009-05-03 09:56 . 2009-05-03 09:56 -------- d-----r c:\users\Public\Documents

2009-05-03 08:44 . 2009-05-03 20:43 -------- d--h--w c:\users\ivaylopopov\AppData\Roaming\drivers

2009-05-02 15:02 . 2009-05-02 16:21 -------- d-----w c:\users\ivaylopopov\PPT

2009-04-29 18:25 . 2000-01-24 02:01 453632 ----a-w c:\windows\system32\stdvcl40.dll

2009-04-29 18:25 . 2009-04-29 18:25 -------- d-----w c:\users\ivaylopopov\AppData\Local\Web CEO

2009-04-22 06:21 . 2003-07-18 07:40 204800 ----a-w c:\windows\system32\FPHttp.dll

2009-04-22 06:21 . 2004-08-01 21:03 110592 ----a-w c:\windows\system32\DNSClientLib.exe

2009-04-22 06:21 . 2004-08-01 21:05 77824 ----a-w c:\windows\system32\FPUninstall.dll

2009-04-20 15:31 . 2009-04-20 15:31 -------- d-----w c:\program files\DiskInternals

2009-04-17 16:02 . 2009-04-17 16:02 -------- d-----w c:\users\ivaylopopov\AppData\Roaming\Uniblue

2009-04-15 20:41 . 2009-04-15 20:41 -------- d-----w c:\users\ivaylopopov\AppData\Roaming\RM Royal Media Ltd

2009-04-15 14:53 . 2009-04-15 15:14 -------- d-----w c:\program files\Emule Mod

2009-04-12 18:12 . 2009-04-12 18:13 -------- d-----w C:\themes

2009-04-12 18:10 . 2009-04-12 18:10 77221 ----a-w C:\page-style.1.5.zip

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-03 20:46 . 2008-12-28 20:00 1152 ----a-w c:\windows\Tasks\GoogleUpdateTaskMachine.job

2009-05-03 20:46 . 2006-11-02 12:58 6 ---ha-w c:\windows\Tasks\SA.DAT

2009-05-03 20:45 . 2006-11-09 21:16 12 ----a-w c:\windows\bthservsdp.dat

2009-05-03 20:45 . 2008-10-19 10:16 81984 ----a-w c:\windows\system32\bdod.bin

2009-05-03 20:44 . 2008-10-17 18:46 -------- d-----w c:\program files\uTorrent

2009-05-03 08:39 . 2008-10-13 17:38 430 ---ha-w c:\windows\Tasks\User_Feed_Synchronization-{57A00BEE-7D16-48D9-AF83-B6C77CBBDCC5}.job

2009-04-27 17:05 . 2008-10-16 17:39 -------- d-----w c:\program files\Foxit Software

2009-04-20 14:31 . 2007-11-12 09:13 -------- d-----w c:\program files\Hewlett-Packard

2009-04-18 20:40 . 2007-11-12 09:31 -------- d--h--w c:\program files\InstallShield Installation Information

2009-04-12 08:37 . 2008-10-18 22:15 -------- d-----w c:\program files\Common Files\eMail ID

2009-03-25 19:34 . 2009-01-11 17:41 130886 ----a-w c:\windows\hpoins18.dat

2009-03-25 19:27 . 2006-11-02 10:25 86016 ----a-w c:\windows\inf\infstor.dat

2009-03-25 19:27 . 2006-11-02 10:25 51200 ----a-w c:\windows\inf\infpub.dat

2009-03-25 19:27 . 2006-11-02 10:25 143360 ----a-w c:\windows\inf\infstrng.dat

2009-03-24 07:10 . 2009-03-24 07:10 105048 ----a-w c:\users\Guest\AppData\Local\GDIPFONTCACHEV1.DAT

2009-03-20 21:39 . 2009-03-20 21:38 -------- d-----w c:\program files\FileZilla FTP Client

2009-03-17 10:39 . 2008-10-13 16:55 105048 ---ha-w c:\users\ivaylopopov\AppData\Local\GDIPFONTCACHEV1.DAT

2009-03-16 17:22 . 2009-03-16 17:18 -------- d-----w c:\program files\Common Files\Macromedia

2009-03-16 17:19 . 2009-03-16 17:18 -------- d-----w c:\program files\Macromedia

2009-03-10 00:39 . 2009-03-10 00:39 99 ---ha-w c:\users\ivaylopopov\AppData\Local\fusioncache.dat

2009-03-07 20:03 . 2009-03-07 20:03 -------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2

2009-03-07 19:56 . 2007-11-12 09:42 -------- d-----w c:\program files\Microsoft SQL Server

2009-03-07 19:40 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail

2009-03-07 19:10 . 2009-03-07 19:10 87430 ----a-w c:\windows\ds2engm.dat

2009-03-07 19:10 . 2009-03-07 19:10 78533 ----a-w c:\windows\dwreng4.dat

2009-03-07 19:10 . 2009-03-07 19:10 215392 ----a-w c:\windows\catdws.dat

2009-03-07 19:10 . 2009-03-07 19:10 864300 ----a-w c:\windows\ds2eng5.dat

2009-03-06 14:12 . 2007-03-12 18:01 21256 ----a-w c:\windows\Help\OEM\scripts\HPScript.exe

2009-03-05 09:29 . 2009-03-16 15:08 16648 ----a-w c:\windows\Help\OEM\scripts\HC_ProtectSmartPatch.exe

2009-02-21 17:51 . 2009-02-21 17:51 0 ----a-w c:\windows\nsreg.dat

2008-10-19 14:53 . 2006-11-02 12:48 174 --sha-w c:\program files\desktop.ini

2007-11-12 08:03 . 2007-11-12 07:55 8192 --sha-w c:\windows\Users\Default\NTUSER.DAT

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-12 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-12 154136]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-12 129560]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1045800]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]

"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-11 317128]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-06-05 71176]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-01 136600]

"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-11-06 177456]

"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 61440]

"BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2008-10-19 368640]

"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2008-06-29 52168]

"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2007-05-23 192512]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]

"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2008-10-13 192512]

HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UACDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-600977008-258949345-919141859-1006]

"EnableNotificationsRef"=dword:00000009

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{A07C1FC6-8A57-404E-AD19-AAC65826A257}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)

"{0DAA7DCA-2DB6-4948-9AAD-BB57E6D691E3}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)

"TCP Query User{D19BD695-AE33-4BB8-BF54-926DA0A3C537}c:\\users\\ivaylopopov\\appdata\\local\\temp\\7zoaa3e.tmp\\strongdc.exe"= UDP:c:\users\ivaylopopov\appdata\local\temp\7zoaa3e.tmp\strongdc.exe:strongdc.exe

"UDP Query User{07867D5B-4234-41A2-AB8A-8C4DB404EE42}c:\\users\\ivaylopopov\\appdata\\local\\temp\\7zoaa3e.tmp\\strongdc.exe"= TCP:c:\users\ivaylopopov\appdata\local\temp\7zoaa3e.tmp\strongdc.exe:strongdc.exe

"TCP Query User{1A16F4AE-FB8D-4068-BDDF-6BC8F2CEFEA7}c:\\users\\ivaylopopov\\appdata\\local\\temp\\7zo993d.tmp\\strongdc.exe"= UDP:c:\users\ivaylopopov\appdata\local\temp\7zo993d.tmp\strongdc.exe:strongdc.exe

"UDP Query User{57656187-52E1-42EA-90C9-CC21F34524CC}c:\\users\\ivaylopopov\\appdata\\local\\temp\\7zo993d.tmp\\strongdc.exe"= TCP:c:\users\ivaylopopov\appdata\local\temp\7zo993d.tmp\strongdc.exe:strongdc.exe

"TCP Query User{178FDAD4-504C-49EE-A601-01BEB008304C}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent

"UDP Query User{1193F519-009B-4083-8263-88F8E67E2DD4}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent

"{F7560C29-3215-4A2B-8C97-29F03409C38F}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{9ED6184C-63C6-4294-AF86-484752AD4469}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook

"{6192BAD0-33E8-4367-AF7D-9D6378A143F6}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{CFBC28C1-AC15-4129-B5BB-DBCB699C1AEE}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{0627319E-0AF1-4F40-B31E-2D2FFB7B9159}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{849EF009-5DAE-4629-8939-1262D68E25F2}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"= 0 (0x0)

R2 Apache2.2;Apache2.2; [x]

R2 gupdate1c96926f8f640f5;Google Update Service (gupdate1c96926f8f640f5);c:\program files\Google\Update\GoogleUpdate.exe [2008-12-28 133104]

R2 XAMPP;XAMPP Service; [x]

R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 167936]

R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\bdfndisf.sys [2008-06-02 86792]

R3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]

S2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-11 30312]

S2 IconixService;Iconix Update Service;c:\program files\Common Files\eMail ID\IconixService.exe [2009-03-10 279824]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

--- Other Services/Drivers In Memory ---

*Deregistered* - sptd

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

bthsvcs REG_MULTI_SZ BthServ

bdx REG_MULTI_SZ scan

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

2009-05-03 c:\windows\Tasks\GoogleUpdateTaskMachine.job

- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-28 20:00]

2009-05-03 c:\windows\Tasks\User_Feed_Synchronization-{57A00BEE-7D16-48D9-AF83-B6C77CBBDCC5}.job

- c:\windows\system32\msfeedssync.exe [2008-10-19 07:33]

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-IBP - (no file)

.

------- Supplementary Scan -------

.

uStart Page = about:blank

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_BG&c=74&bd=smb&pf=laptop

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Закачать ВСЕ при помощи Download Master - c:\program files\Download Master\dmieall.htm

IE: Закачать при помощи Download Master - c:\program files\Download Master\dmie.htm

IE: {{8DAE90AD-4583-4977-9DD4-4360F7A45C74} - c:\program files\Download Master\dmaster.exe

FF - ProfilePath - c:\users\ivaylopopov\AppData\Roaming\Mozilla\Firefox\Profiles\my6o38uu.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - component: c:\program files\Google\Google Gears\Firefox\components\gears.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{318732A4-3815-329C-4AD2-436952EE2641}\components\FFProxy3.dll

FF - plugin: c:\program files\Google\Update\1.2.133.33\npGoogleOneClick7.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdm.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npIconixProxy3.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-03 23:50

Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\SOFTWARE\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10a.exe,-101"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

[HKEY_USERS\SOFTWARE\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10a.exe"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\Flash10a.ocx"

"ThreadingModel"="Apartment"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\system32\\Macromed\\Flash\\Flash10a.ocx, 1"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\Flash10a.ocx"

"ThreadingModel"="Apartment"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\system32\\Macromed\\Flash\\Flash10a.ocx, 1"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

[HKEY_USERS\SOFTWARE\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]

@Denied: (A 2) (Everyone)

@="IFlashBroker2"

[HKEY_USERS\SOFTWARE\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_USERS\SOFTWARE\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

[HKEY_USERS\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]

@Denied: (A 2) (Everyone)

[HKEY_USERS\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]

@="Shockwave Flash"

[HKEY_USERS\SOFTWARE\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]

@Denied: (A 2) (Everyone)

@=""

[HKEY_USERS\SOFTWARE\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]

@="FlashBroker"

[HKEY_USERS\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_USERS\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

------------------------ Other Running Processes ------------------------

.

c:\windows\System32\audiodg.exe

c:\windows\System32\Crypserv.exe

c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe

c:\windows\System32\drivers\XAudio.exe

c:\program files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe

c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

c:\program files\BitDefender\BitDefender 2008\vsserv.exe

c:\windows\System32\conime.exe

c:\windows\System32\igfxsrvc.exe

c:\windows\System32\wbem\unsecapp.exe

c:\program files\Hewlett-Packard\Shared\HpqToaster.exe

c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe

c:\windows\System32\wbem\WMIADAP.exe

.

**************************************************************************

.

Completion time: 2009-05-03 23:54 - machine was rebooted

ComboFix-quarantined-files.txt 2009-05-03 20:53

Pre-Run: 100 051 709 952 bytes free

Post-Run: 99 547 422 720 bytes free

299 --- E O F --- 2009-03-07 20:12

Все пак въпроса ми остава,ако имаш време.

3 май 200917 г.

Нека първо почистим системата ти и накрая ще ти отговарям на въпросите, защото това е по-належащо.

Отворете Notepad и чрез copy/paste поставете следното:

KILLALL::


RegNull::

[HKEY_USERS\SOFTWARE\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

[HKEY_USERS\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

[HKEY_USERS\SOFTWARE\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]

[HKEY_USERS\SOFTWARE\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]

[HKEY_USERS\SOFTWARE\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]

[HKEY_USERS\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]

[HKEY_USERS\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]

[HKEY_USERS\SOFTWARE\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]

[HKEY_USERS\SOFTWARE\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]

[HKEY_USERS\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

[HKEY_USERS\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След, като програмата приключи ще Ви изведе лог файла. Чрез Copy/Paste поставете информацията тук.

3 май 200917 г.

Направих каквото ме посъветва.Само,че след рестарта не направи файл както първият път(лог файл предполагам)Трябва ли пак да пусна ComboFix-а?

3 май 200917 г.

Ако не ти го отворя, то той се записва в C:\combofix.txt , така че отвори го, копирай съдържанието му и го публикувай тук.

3 май 200917 г.

Ето го и него

Running from: C:\Users\ivaylopopov\Desktop\ComboFix.exe

Command switches used :: C:\Users\ivaylopopov\Desktop\CFScript.txt

AV: Bitdefender Antivirus *On-access scanning enabled* (Updated)

FW: Bitdefender Firewall *disabled*

FW: COMODO Firewall Pro *enabled*

* Created a new restore point

* Resident AV is active

3 май 200917 г.

Това не е целият лог файл.

3 май 200917 г.

Е надявам се да е това.Гледам по последна промяна на файловете,т.е. времето

KILLALL::

RegNull::