ComboFix 11-01-13.01 - teo 01.2011 г. 18:42:43.1.2 - x64 Microsoft Windows 7 Ultimate 6.1.7600.0.1251.359.1033.18.2046.1157 [GMT 2:00] Running from: c:\users\teo\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\users\Default\AppData\Local\Application Data.exe c:\users\Default\AppData\Local\Local.exe c:\users\Default\AppData\Local\Settings.exe c:\users\Default\AppData\Roaming\Application Data.exe c:\users\Default\AppData\Roaming\Microsoft\Microsoft.exe c:\users\Default\AppData\Roaming\Roaming.exe c:\users\Default\Default User.exe c:\users\Default\Default.exe c:\users\Public\Public.exe c:\users\teo\AppData\Local\Application Data.exe c:\users\teo\AppData\Local\Local.exe c:\users\teo\AppData\Roaming\Microsoft\Windows\Recent\Recent.pif c:\users\teo\AppData\Roaming\Roaming.exe c:\users\teo\teo.exe c:\windows\SysWow64\klipxm32.dll c:\windows\XSxS . ((((((((((((((((((((((((( Files Created from 2010-12-14 to 2011-01-14 ))))))))))))))))))))))))))))))) . 2011-01-14 16:49 . 2011-01-14 16:49 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-01-14 13:38 . 2011-01-14 13:38 -------- d-----w- C:\antivir 2011-01-14 13:34 . 2011-01-14 13:34 -------- d-----w- c:\program files\trend micro 2011-01-13 22:46 . 2011-01-13 22:46 -------- d-----w- c:\users\teo\AppData\Roaming\Malwarebytes 2011-01-13 22:46 . 2011-01-13 22:46 -------- d-----w- c:\programdata\Malwarebytes 2011-01-13 22:46 . 2010-12-20 16:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2011-01-13 22:46 . 2011-01-13 22:46 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2011-01-13 22:46 . 2010-12-20 16:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-01-13 09:18 . 2011-01-13 10:08 -------- d-----w- c:\program files (x86)\Games 2011-01-06 08:56 . 2011-01-09 11:04 -------- d-----w- c:\users\teo\AppData\Roaming\Hardcore 2011-01-05 16:13 . 2011-01-05 16:13 -------- d-----w- c:\program files (x86)\ASIO4ALL v2 2011-01-05 16:13 . 2006-06-20 08:56 225280 ----a-w- c:\windows\SysWow64\rewire.dll 2011-01-05 16:12 . 2009-09-15 09:14 1554944 ----a-w- c:\windows\SysWow64\vorbis.acm 2011-01-05 16:12 . 2011-01-05 16:13 -------- d-----w- c:\program files (x86)\VstPlugins 2011-01-05 16:12 . 2011-01-05 16:12 -------- d-----w- c:\program files (x86)\Outsim 2011-01-05 16:10 . 2011-01-05 16:12 -------- d-----w- c:\program files (x86)\Image-Line 2011-01-04 13:24 . 2011-01-05 19:23 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\PrintHood.exe 2011-01-04 13:24 . 2011-01-05 19:22 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\NetHood.exe 2011-01-04 13:21 . 2011-01-05 19:26 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Templates\Templates.bat 2011-01-04 13:21 . 2011-01-05 19:12 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Maintenance.exe 2011-01-04 13:21 . 2011-01-05 19:11 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Tools.exe 2011-01-04 13:20 . 2011-01-05 19:10 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Accessibility.exe 2011-01-04 13:20 . 2011-01-05 19:10 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessories.pif 2011-01-04 13:20 . 2011-01-05 19:09 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programs.pif 2011-01-04 13:20 . 2011-01-05 19:26 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Start Menu.exe 2011-01-04 13:20 . 2011-01-05 19:25 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\SendTo\SendTo.scr 2011-01-04 13:19 . 2011-01-05 19:24 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Recent\Recent.pif 2011-01-04 13:19 . 2011-01-05 19:07 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Shortcuts.exe 2011-01-04 13:19 . 2011-01-05 19:07 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\Shortcuts.exe 2011-01-04 13:19 . 2011-01-05 19:14 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Cookies\Cookies.pif 2011-01-04 13:19 . 2011-01-05 19:05 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Windows.pif 2011-01-04 13:18 . 2011-01-05 19:05 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch.scr 2011-01-04 13:18 . 2011-01-05 19:04 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Internet Explorer\Explorer.exe 2011-01-03 15:43 . 2011-01-03 15:43 561152 ----a-w- c:\users\teo\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CustomDestinations.exe 2011-01-03 15:43 . 2011-01-03 15:43 561152 ----a-w- c:\users\teo\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\AutomaticDestinations.exe 2010-12-29 17:03 . 2010-12-29 17:03 -------- d-----w- c:\programdata\Electronic Arts 2010-12-29 16:27 . 2010-12-29 16:27 -------- d-----w- c:\program files (x86)\Electronic Arts 2010-12-27 13:59 . 2010-12-27 14:05 88 --sh--r- c:\programdata\840BB621E5.sys 2010-12-27 13:59 . 2010-12-30 10:53 2828 --sha-w- c:\programdata\KGyGaAvL.sys 2010-12-27 13:58 . 2010-12-27 13:58 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll 2010-12-27 13:58 . 2010-12-27 13:58 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll 2010-12-27 13:58 . 2010-12-27 13:58 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll 2010-12-27 13:58 . 2010-12-27 13:58 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll 2010-12-27 13:58 . 2010-12-27 13:58 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll 2010-12-27 13:58 . 2010-12-27 13:58 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll 2010-12-27 13:58 . 2010-12-27 13:58 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll 2010-12-27 13:58 . 2010-12-27 13:58 -------- d-----w- c:\program files (x86)\Common Files\Apple 2010-12-27 13:58 . 2010-12-27 13:58 -------- d-----w- c:\program files (x86)\QuickTime 2010-12-27 13:58 . 2010-12-27 13:58 -------- d-----w- c:\programdata\Apple Computer 2010-12-27 13:57 . 2010-12-27 13:57 -------- d-----w- c:\program files (x86)\Common Files\Protexis 2010-12-27 13:57 . 2010-12-27 13:57 -------- d-----w- c:\programdata\Corel 2010-12-27 13:54 . 2011-01-07 15:25 -------- d-----w- c:\users\teo\AppData\Local\Corel 2010-12-27 13:54 . 2011-01-07 15:25 -------- d-----w- c:\users\teo\AppData\Roaming\Corel 2010-12-27 13:51 . 2010-12-29 15:42 -------- d-----w- c:\programdata\Ulead Systems 2010-12-27 13:51 . 2010-12-27 13:53 -------- d-----w- c:\program files (x86)\Common Files\Corel 2010-12-27 13:51 . 2010-12-27 13:51 -------- d-----w- c:\program files (x86)\Corel 2010-12-26 09:24 . 2007-05-16 14:45 4496232 ----a-w- c:\windows\system32\d3dx9_34.dll 2010-12-22 19:02 . 2010-12-22 19:02 -------- d-----r- c:\program files (x86)\Skype 2010-12-22 16:37 . 2009-11-25 10:47 99176 ----a-w- c:\windows\SysWow64\PresentationHostProxy.dll 2010-12-22 16:37 . 2009-11-25 10:47 49472 ----a-w- c:\windows\SysWow64\netfxperf.dll 2010-12-22 16:37 . 2009-11-25 10:47 48960 ----a-w- c:\windows\system32\netfxperf.dll 2010-12-22 16:37 . 2009-11-25 10:47 297808 ----a-w- c:\windows\SysWow64\mscoree.dll 2010-12-22 16:37 . 2009-11-25 10:47 295264 ----a-w- c:\windows\SysWow64\PresentationHost.exe 2010-12-22 16:37 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll 2010-12-22 16:37 . 2009-11-25 10:47 109912 ----a-w- c:\windows\system32\PresentationHostProxy.dll 2010-12-22 16:37 . 2009-11-25 10:47 444752 ----a-w- c:\windows\system32\mscoree.dll 2010-12-22 16:37 . 2009-11-25 10:47 320352 ----a-w- c:\windows\system32\PresentationHost.exe 2010-12-22 16:37 . 2009-11-25 10:47 1942856 ----a-w- c:\windows\system32\dfshim.dll 2010-12-22 16:30 . 2010-11-16 10:01 8199504 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DFF6C16D-3128-4DCE-A8E8-92D449D6DCFA}\mpengine.dll 2010-12-22 16:24 . 2010-03-24 07:34 1737120 ----a-w- c:\windows\system32\ntdll.dll 2010-12-22 16:23 . 2010-10-16 05:23 112000 ----a-w- c:\windows\system32\consent.exe 2010-12-22 16:20 . 2010-08-21 06:38 1024512 ----a-w- c:\windows\system32\wmpmde.dll 2010-12-22 16:20 . 2010-08-21 05:36 738816 ----a-w- c:\windows\SysWow64\wmpmde.dll 2010-12-22 16:19 . 2010-05-05 07:37 483840 ----a-w- c:\windows\system32\StructuredQuery.dll 2010-12-22 16:19 . 2010-05-05 06:46 363520 ----a-w- c:\windows\SysWow64\StructuredQuery.dll 2010-12-22 16:18 . 2010-08-20 05:38 559104 ----a-w- c:\windows\system32\spoolsv.exe 2010-12-22 16:18 . 2010-08-31 04:32 954752 ----a-w- c:\windows\SysWow64\mfc40.dll 2010-12-22 16:18 . 2010-08-31 04:32 954288 ----a-w- c:\windows\SysWow64\mfc40u.dll 2010-12-22 16:18 . 2010-08-27 06:14 236032 ----a-w- c:\windows\system32\srvsvc.dll 2010-12-22 16:18 . 2010-08-27 05:46 9728 ----a-w- c:\windows\SysWow64\sscore.dll 2010-12-22 16:18 . 2010-08-27 03:38 463360 ----a-w- c:\windows\system32\drivers\srv.sys 2010-12-22 16:18 . 2010-08-27 03:37 402944 ----a-w- c:\windows\system32\drivers\srv2.sys 2010-12-22 16:18 . 2010-08-27 03:37 161792 ----a-w- c:\windows\system32\drivers\srvnet.sys 2010-12-22 16:05 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe 2010-12-22 16:05 . 2010-03-04 04:40 184832 ----a-w- c:\windows\system32\drivers\usbvideo.sys 2010-12-22 16:05 . 2010-03-04 04:32 243712 ----a-w- c:\windows\system32\drivers\ks.sys 2010-12-22 15:27 . 2010-01-09 07:19 139264 ----a-w- c:\windows\system32\cabview.dll 2010-12-22 15:27 . 2010-01-09 06:52 132608 ----a-w- c:\windows\SysWow64\cabview.dll 2010-12-22 15:27 . 2009-12-29 08:03 220672 ----a-w- c:\windows\system32\wintrust.dll 2010-12-22 15:27 . 2009-12-29 06:55 172032 ----a-w- c:\windows\SysWow64\wintrust.dll 2010-12-21 08:27 . 2011-01-04 08:09 -------- d-----w- c:\users\teo\AppData\Roaming\Zeon 2010-12-18 15:47 . 2010-12-18 15:47 -------- d-----w- c:\program files (x86)\Imikimi . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-12-02 03:35 . 2010-12-02 03:35 4280320 ----a-w- c:\windows\SysWow64\GPhotos.scr 2010-11-04 21:52 . 2010-11-04 21:52 614400 ----a-w- c:\windows\AutoKMS.exe 2010-10-19 08:41 . 2010-09-08 07:41 270720 ------w- c:\windows\system32\MpSigStub.exe 2010-10-18 18:11 . 2010-10-18 18:11 31744 ----a-w- c:\windows\SysWow64\maplec.dll 2010-10-18 18:11 . 2010-10-18 18:11 212992 ----a-w- c:\windows\SysWow64\WMIMPLEX.dll 2010-10-18 18:11 . 2010-10-18 18:11 20480 ----a-w- c:\windows\SysWow64\maplecompat.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files (x86)\uTorrentBar\tbuTo1.dll" [2010-12-26 3911776] [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}] 2010-12-26 15:10 3911776 ----a-w- c:\program files (x86)\ConduitEngine\ConduitEngin0.dll [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] 2010-12-26 15:10 3911776 ----a-w- c:\program files (x86)\uTorrentBar\tbuTo1.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files (x86)\uTorrentBar\tbuTo1.dll" [2010-12-26 3911776] "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files (x86)\ConduitEngine\ConduitEngin0.dll" [2010-12-26 3911776] [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2010-09-02 13351304] "NokiaPCInternetAccess"="c:\program files (x86)\Nokia\PC Internet Access\NPCIA.exe" [2009-05-26 651264] "uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2010-12-11 395640] "PC Suite Tray"="c:\program files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" [2010-05-14 1479680] "Corel Photo Downloader"="c:\program files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2010-07-28 526992] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth Monitor.lnk - c:\program files (x86)\TOSHIBA\Bluetooth Monitor\BtMon2.exe [2010-9-8 92280] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368] R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [2010-02-26 25088] R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [2010-02-26 12288] R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [2010-02-26 173056] R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [2010-02-26 19456] R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-08 834544] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 203264] S2 TeamViewer4;TeamViewer 4;c:\program files (x86)\TeamViewer\Version4\TeamViewer_Service.exe [2009-10-07 185640] S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864] S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312] S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120] . Contents of the 'Scheduled Tasks' folder 2011-01-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3447158227-3012016689-1084579962-1000Core.job - c:\users\teo\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-08 07:39] 2011-01-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3447158227-3012016689-1084579962-1000UA.job - c:\users\teo\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-08 07:39] . --------- x86-64 ----------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1609296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = about:blank mLocal Page = c:\windows\SysWOW64\blank.htm IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Download &Flash Movies - c:\program files (x86)\Flash2X\Flash Hunter\save.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: {6B34DE5E-E3F1-4A75-A206-2E5E3B6E4440} = 10.10.10.3 DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} - hxxp://webcam.varna.bg:8080/VatDec.cab . - - - - ORPHANS REMOVED - - - - WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file) AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-WinSetupFromUSB - c:\winsetupfromusb\Uninstall.exe . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{6EF568F4-D437-4466-AA63-A3645136D93E}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}] @Denied: (A 2) (Everyone) @="IFlashBroker" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib] @="{6EF568F4-D437-4466-AA63-A3645136D93E}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}] @Denied: (A 2) (Everyone) @="IFlashBroker2" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib] @="{6EF568F4-D437-4466-AA63-A3645136D93E}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-01-14 18:53:05 ComboFix-quarantined-files.txt 2011-01-14 16:53 Pre-Run: 13 583 769 600 bytes free Post-Run: 13 165 256 704 bytes free - - End Of File - - E1CE13282C9229FA51844AC83802E282

Копирайте текста в карето на notepad и го запазваш с име CFScript.txt на десктопа си:

KILLALL::

file:
c:\windows\AutoKMS.exe
c:\programdata\840BB621E5.sys



registry::
[-HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
[-HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

След съхранението премести CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт прикачете в следващия си пост..!

ето

log1.txt

Сега какво е положението....Наблюдавате ли проблеми..?

ами нищо ново не се е създало но старите си седят My Documents.exe Pictures.exe Games.exe Music.exe. Мисля да пусна в търсачката *.* и да ги сортирам по размер тъй като всичките са с един размер да им видя датите и да ги изтрия...

В лога има едни такива файлове...създадени в една и съща дата по едно и също време..:

2011-01-04 13:24 . 2011-01-05 19:23 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\PrintHood.exe

2011-01-04 13:24 . 2011-01-05 19:22 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\NetHood.exe

2011-01-04 13:21 . 2011-01-05 19:26 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Templates\Templates.bat

2011-01-04 13:21 . 2011-01-05 19:12 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Maintenance.exe

2011-01-04 13:21 . 2011-01-05 19:11 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Tools.exe

2011-01-04 13:20 . 2011-01-05 19:10 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Accessibility.exe

2011-01-04 13:20 . 2011-01-05 19:10 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessories.pif

2011-01-04 13:20 . 2011-01-05 19:09 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programs.pif

2011-01-04 13:20 . 2011-01-05 19:26 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Start Menu.exe

2011-01-04 13:20 . 2011-01-05 19:25 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\SendTo\SendTo.scr

2011-01-04 13:19 . 2011-01-05 19:24 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Recent\Recent.pif

2011-01-04 13:19 . 2011-01-05 19:07 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Shortcuts.exe

2011-01-04 13:19 . 2011-01-05 19:07 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\Shortcuts.exe

2011-01-04 13:19 . 2011-01-05 19:14 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Cookies\Cookies.pif

2011-01-04 13:19 . 2011-01-05 19:05 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Windows.pif

2011-01-04 13:18 . 2011-01-05 19:05 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch.scr

2011-01-04 13:18 . 2011-01-05 19:04 561152 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Internet Explorer\Explorer.exe

\AutomaticDestinations\AutomaticDestinations.exe

...не смея да ги изтрия...!

ами нищо ново не се е създало но старите си седят My Documents.exe Pictures.exe Games.exe Music.exe. Мисля да пусна в търсачката *.* и да ги сортирам по размер тъй като всичките са с един размер да им видя датите и да ги изтрия...

Не цъкай върху тях ,че отново зпочва всичко

ПС.Ицо извинявай че ти пиша в темата...

Можеш ли да ги архивираш тези файлове и да качиш архива например на : http://www.zippyshare.com/ .

Можеш ли да ги архивираш тези файлове и да качиш архива например на : http://www.zippyshare.com/ .

трябва ли ти ?

само един архивирах, че нямат събиранка всички (махам линка да не се набута някой)

Не цъкай върху тях ,че отново зпочва всичко

ПС.Ицо извинявай че ти пиша в темата...

предположих

изтрих 653 файла да видим сега ще се появят ли пак ...

Оххххххх сега пък ми казват, че сам разпращал такива глупости в чата на Фейсбук .... @[smiley: Oh%20No%20She%20Didn%27t: [F/1/446]] *:-]* Your friend just sent you a Smiley. Go to http://digtrivia.com?partner=ZNzfb001_ZNzfb015&5M1L3

Оххххххх сега пък ми казват, че сам разпращал такива глупости в чата на Фейсбук .... @[smiley: Oh%20No%20She%20Didn%27t: [F/1/446]]

*:-]* Your friend just sent you a Smiley. Go to http://digtrivia.com..._ZNzfb015

Не си само ти(:

Здравейте, не искам да се бъркам в работата на icotonev, но заразата поразително прилича на това което ми се случи и на мен, и което премахнах с помощта на специалистите от този форум. Моля разгледайте тази тема, мисля че може да е от полза и на автора, и на тези които се опитват да помагат: ihttp://www.kaldata.com/forums/index.php?showtopic=150955&st=0&p=1650242&hl=adasha&fromsearch=1&#entry1650242 Поздрави и успех!

Здравейте,

не искам да се бъркам в работата на icotonev, но заразата поразително прилича на това което ми се случи и на мен, и което премахнах с помощта на специалистите от този форум. Моля разгледайте тази тема, мисля че може да е от полза и на автора, и на тези които се опитват да помагат: ihttp://www.kaldata.com/forums/index.php?showtopic=150955&st=0&p=1650242&hl=adasha&fromsearch=1&#entry1650242

Поздрави и успех!

Не виждам да сме направили нещо по различно от посочената от вас тема ....!Моля спазвайте правилата на подраздела..!

Към автора на темата :

1. Изтеглете Hitman Pro

• За 32-битова система -
• За 64-битова система -

2. Стартирайте програмата.

3. Натиснете бутона „Next".

4. Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

5. След завършване на сканирането натиснете "Eport scan results to XML file"

6. След това на работния ви плот ще се появи файл.

7. Прикачете файла в следващия си коментар.

http-~~-//www.youtube.com/watch?v=rMS-kxbo5fc&feature=player_embedded

Сега направете проверка със Sophos Anti-Rootkit. Eто как: изтеглете Sophos Anti-Rootkit от тук (иска се регистрация), стартирайте sarsfx.exe и го пуснете да сканира (Start scan). Когато сканирането завърши, пуснете Windows Explorer и отидете в папка %temp%. Там трябва да има файл с име sarscan.log. Публикувайте или го прикачете към следващия си коментар.