Win32/AutoRun.Agent.UD - Моля за помощ - Премахване на зловреден софтуер - Kaldata.com

17 август 201115 г.

Nod32 откри на компютъра ми този вирус (червей). Самия червей си прави някакви архиви с един и същ размер 590 кб като им присвоява имената на папките в които се създава - примерно Documents.rar, SharedDocs.rar, Videos.rar и т.н (Както и същите файлове с разширение exe) има ги доста, като основно се разполагат впапките : Documents, Pictures, Music, Videos. Явно се размножава гадината. NOD-a изписва че ги изтрива след прехващането но после се появяват отново. Забраних System Restore и сканирах както в нормален режим така и под Safe Mode, но резултата е същия - появява се гадината пак. Сканирах компютъра с Malwarebytes' Anti-Malware но програмата не открива нищо. До сега съм успявал да се справя сам с подобни гадинки (с помоща на чичко Гугъл), но това се оказва доста упорито. С Windows7 съм и имам направен бекъп на системата, но бекъпфайла ми е на втория дял на харда. Разполагам с инсталационен диск на Windows7. Изтеглих и стартирах DDS и поствам логовете тук. Ще бъда благодарен ако окажете помощ да изчистя компютъра с минимални поражения.

.

DDS (Ver_2011-06-23.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Ina at 15:33:13 on 2011-08-17

Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.4003.1891 [GMT 3:00]

.

AV: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}

SP: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe

C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe

C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe

C:\Program Files (x86)\Dell Wireless\Ath_CoexAgent.exe

C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe

C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\DellTPad\Apoint.exe

C:\Windows\System32\hale.exe

C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\Program Files (x86)\Java\jre6\bin\jusched.exe

C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe

C:\Program Files (x86)\CyberLink\Shared Files\brs.exe

C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe

C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Program Files\DellTPad\HidFind.exe

C:\Program Files\DellTPad\Apntex.exe

C:\Windows\system32\conhost.exe

C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Nero\Update\NASvc.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\vssvc.exe

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\System32\mobsync.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

uURLSearchHooks: H - No File

mWinlogon: Userinit=userinit.exe

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: CIESpeechBHO Class: {8d10f6c4-0e01-4bd4-8601-11ac1fdf8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

BHO: : {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: N/A: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

uRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent

mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

mRun: [TaskTray]

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"

mRun: [RemoteControl8] "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe"

mRun: [PDVD8LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe"

mRun: [bDRegion] C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe

mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

mRun: [<NO NAME>]

mRun: [bonus.SSR.FR10] "C:\Program Files (x86)\ABBYY FineReader 10\Bonus.ScreenshotReader.exe" /autorun

mRun: [sAOB Monitor] C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe

mRun: [TrueImageMonitor.exe] "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ADOBEA~1.LNK - C:\Windows\Installer\{AC76BA86-1026-0000-7760-000000000003}\_SC_Acrobat.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ADOBEA~2.LNK - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: EnableLinkedConnections = 1 (0x1)

IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200

IE: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {7815BE26-237D-41A8-A98F-F7BD75F71086} - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab

TCP: DhcpNameServer = 87.121.168.4

TCP: Interfaces\{B84087B3-5B6F-4551-BCC3-19E4D97BEA7C} : DhcpNameServer = 208.67.222.222 80.72.72.9

TCP: Interfaces\{B84087B3-5B6F-4551-BCC3-19E4D97BEA7C}\4646D2772747 : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{B84087B3-5B6F-4551-BCC3-19E4D97BEA7C}\6556E656369616 : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{B84087B3-5B6F-4551-BCC3-19E4D97BEA7C}\6756E656369616 : DhcpNameServer = 192.168.2.1

TCP: Interfaces\{B84087B3-5B6F-4551-BCC3-19E4D97BEA7C}\7596D264969696 : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{F5AACAC3-C683-42D8-80CA-F91142A5D5AE} : DhcpNameServer = 87.121.168.4

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL

BHO-X64: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL

BHO-X64: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO-X64: CIESpeechBHO Class: {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll

BHO-X64: IESpeakDoc - No File

BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO-X64: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

BHO-X64: URLRedirectionBHO - No File

BHO-X64: : {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

BHO-X64: Ask Toolbar BHO - No File

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB-X64: : {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

TB-X64: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

EB-X64: {182EC0BE-5110-49C8-A062-BEB1D02A220B} - No File

mRun-x64: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

mRun-x64: [TaskTray]

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"

mRun-x64: [RemoteControl8] "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe"

mRun-x64: [PDVD8LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe"

mRun-x64: [bDRegion] C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe

mRun-x64: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

mRun-x64: [(Default)]

mRun-x64: [bonus.SSR.FR10] "C:\Program Files (x86)\ABBYY FineReader 10\Bonus.ScreenshotReader.exe" /autorun

mRun-x64: [sAOB Monitor] C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe

mRun-x64: [TrueImageMonitor.exe] "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL

.

============= SERVICES / DRIVERS ===============

.

R0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);C:\Windows\system32\DRIVERS\tdrpm273.sys --> C:\Windows\system32\DRIVERS\tdrpm273.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl [2008-2-1 32240]

R2 afcdpsrv;Acronis Nonstop Backup Service;C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2011-7-28 3246040]

R2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;C:\Program Files (x86)\Dell Wireless\Ath_CoexAgent.exe [2011-7-21 151552]

R2 AtherosSvc;AtherosSvc;C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe [2010-12-17 53920]

R2 DellDigitalDelivery;Dell Digital Delivery Service;C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe [2011-5-4 150920]

R2 ekrn;ESET Service;C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2009-5-12 731840]

R2 epfwwfpr;epfwwfpr;C:\Windows\system32\DRIVERS\epfwwfpr.sys --> C:\Windows\system32\DRIVERS\epfwwfpr.sys [?]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-8-14 366640]

R2 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-5-4 503080]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-7-20 2655768]

R3 afcdp;afcdp;C:\Windows\system32\DRIVERS\afcdp.sys --> C:\Windows\system32\DRIVERS\afcdp.sys [?]

R3 AthBTPort;Atheros Virtual Bluetooth Class;C:\Windows\system32\DRIVERS\btath_flt.sys --> C:\Windows\system32\DRIVERS\btath_flt.sys [?]

R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;C:\Windows\system32\drivers\btath_a2dp.sys --> C:\Windows\system32\drivers\btath_a2dp.sys [?]

R3 BTATH_BUS;Atheros Bluetooth Bus;C:\Windows\system32\DRIVERS\btath_bus.sys --> C:\Windows\system32\DRIVERS\btath_bus.sys [?]

R3 BTATH_HCRP;Bluetooth HCRP Server driver;C:\Windows\system32\DRIVERS\btath_hcrp.sys --> C:\Windows\system32\DRIVERS\btath_hcrp.sys [?]

R3 BTATH_LWFLT;Bluetooth LWFLT Device;C:\Windows\system32\DRIVERS\btath_lwflt.sys --> C:\Windows\system32\DRIVERS\btath_lwflt.sys [?]

R3 BTATH_RCP;Bluetooth AVRCP Device;C:\Windows\system32\DRIVERS\btath_rcp.sys --> C:\Windows\system32\DRIVERS\btath_rcp.sys [?]

R3 BtFilter;BtFilter;C:\Windows\system32\DRIVERS\btfilter.sys --> C:\Windows\system32\DRIVERS\btfilter.sys [?]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys --> C:\Windows\system32\DRIVERS\nusb3hub.sys [?]

R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys --> C:\Windows\system32\DRIVERS\nusb3xhc.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Услуга Google Update (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-7-20 136176]

S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?]

S3 gupdatem;Услуга на Google Актуализация (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-7-20 136176]

S3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2010-12-28 51727736]

S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]

S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]

S3 Synth3dVsc;Synth3dVsc;C:\Windows\system32\drivers\synth3dvsc.sys --> C:\Windows\system32\drivers\synth3dvsc.sys [?]

S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\system32\drivers\terminpt.sys --> C:\Windows\system32\drivers\terminpt.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]

S3 tsusbhub;tsusbhub;C:\Windows\system32\drivers\tsusbhub.sys --> C:\Windows\system32\drivers\tsusbhub.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

.

=============== Created Last 30 ================

.

2011-08-16 13:43:53 -------- d-----w- C:\Users\Ina\AppData\Local\My Games

2011-08-16 13:33:35 -------- d-----w- C:\Program Files (x86)\Sid Meier's Civilization V

2011-08-16 13:29:59 24920 ----a-w- C:\Windows\System32\X3DAudio1_6.dll

2011-08-16 13:28:55 83736 ----a-w- C:\Windows\System32\xinput1_2.dll

2011-08-16 12:25:29 -------- d-----w- C:\ProgramData\Kaspersky Lab

2011-08-16 12:00:15 -------- d-----w- C:\Program Files\CCleaner

2011-08-16 11:46:40 8578896 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{476A604C-7060-4598-A46C-989EF3436B46}\mpengine.dll

2011-08-16 09:35:24 -------- d-----w- C:\Users\Ina\AppData\Local\GHISLER

2011-08-16 09:22:52 545 ----a-w- C:\Windows\UC.PIF

2011-08-16 09:22:52 545 ----a-w- C:\Windows\RAR.PIF

2011-08-16 09:22:52 545 ----a-w- C:\Windows\PKZIP.PIF

2011-08-16 09:22:52 545 ----a-w- C:\Windows\PKUNZIP.PIF

2011-08-16 09:22:52 545 ----a-w- C:\Windows\NOCLOSE.PIF

2011-08-16 09:22:52 545 ----a-w- C:\Windows\LHA.PIF

2011-08-16 09:22:52 545 ----a-w- C:\Windows\ARJ.PIF

2011-08-16 09:22:51 -------- d-----w- C:\Users\Ina\AppData\Roaming\GHISLER

2011-08-16 09:22:51 -------- d-----w- C:\totalcmd

2011-08-16 06:29:19 -------- d-----w- C:\ProgramData\Panda Security

2011-08-16 06:29:16 -------- d-----w- C:\Program Files (x86)\Panda USB Vaccine

2011-08-14 17:29:26 -------- d-----w- C:\Users\Ina\AppData\Roaming\Malwarebytes

2011-08-14 17:29:19 41272 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

2011-08-14 17:29:19 -------- d-----w- C:\ProgramData\Malwarebytes

2011-08-14 17:29:16 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys

2011-08-14 17:29:15 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2011-08-14 15:52:49 -------- d-----w- C:\Program Files (x86)\ESET

2011-08-08 14:08:07 -------- d-----w- C:\Program Files (x86)\Common Files\COWON

2011-08-08 14:08:05 -------- d-----w- C:\Program Files (x86)\JetAudio

2011-08-07 12:24:58 -------- d-----w- C:\Program Files (x86)\ICE Book Reader Professional

2011-08-07 12:19:08 -------- d-----w- C:\Users\Ina\cr3

2011-07-28 18:13:11 48648 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll

2011-07-28 07:46:34 -------- d-----w- C:\Program Files\Easy CD-DA Extractor 10

2011-07-28 07:46:09 -------- d-----w- C:\Windows\Easy CD-DA Extractor

2011-07-28 07:46:09 -------- d-----w- C:\Program Files (x86)\Easy CD-DA Extractor 10

2011-07-28 05:26:34 285280 ----a-w- C:\Windows\System32\drivers\afcdp.sys

2011-07-28 05:26:33 1263200 ----a-w- C:\Windows\System32\drivers\tdrpm273.sys

2011-07-28 05:26:32 970336 ----a-w- C:\Windows\System32\drivers\timntr.sys

2011-07-28 05:26:28 277088 ----a-w- C:\Windows\System32\drivers\snapman.sys

2011-07-22 14:52:28 -------- d-----w- C:\Users\Ina\AppData\Roaming\ABBYY

2011-07-22 14:48:48 -------- d-----w- C:\Program Files (x86)\Common Files\ABBYY

2011-07-22 14:48:34 -------- d-----w- C:\Users\Ina\AppData\Local\ABBYY

2011-07-22 14:48:34 -------- d-----w- C:\ProgramData\ABBYY

2011-07-22 14:48:34 -------- d-----w- C:\Program Files (x86)\ABBYY FineReader 10

2011-07-22 11:25:14 -------- d-----w- C:\Program Files (x86)\Common Files\Macrovision Shared

2011-07-22 11:25:11 -------- d-----w- C:\Users\Ina\AppData\Local\Adobe

2011-07-22 11:13:57 -------- d-----w- C:\Windows\SysWow64\spool

2011-07-22 07:58:24 -------- d-----w- C:\Program Files (x86)\Common Files\CyberLink

2011-07-22 07:56:59 505128 ----a-w- C:\Windows\SysWow64\msvcp71.dll

2011-07-22 07:56:59 353576 ----a-w- C:\Windows\SysWow64\msvcr71.dll

2011-07-22 07:56:59 29480 ----a-w- C:\Windows\SysWow64\msxml3a.dll

2011-07-22 07:54:59 -------- d-----w- C:\Users\Ina\AppData\Local\ESET

2011-07-22 05:35:57 2169856 --sha-w- C:\Windows\System32\hale.exe

2011-07-22 04:11:21 -------- d-----w- C:\Program Files (x86)\Nero

2011-07-22 04:11:13 -------- d-----w- C:\ProgramData\Nero

2011-07-22 04:08:18 4379984 ----a-w- C:\Windows\SysWow64\D3DX9_40.dll

2011-07-22 04:08:01 3497832 ----a-w- C:\Windows\SysWow64\d3dx9_34.dll

2011-07-22 03:50:08 -------- d-----w- C:\Program Files\DellTPad

2011-07-22 03:49:58 363856 ----a-w- C:\Windows\System32\drivers\Apfiltr.sys

2011-07-22 03:49:58 1721576 ----a-w- C:\Windows\System32\WdfCoInstaller01009.dll

2011-07-22 03:49:58 113224 ----a-w- C:\Windows\System32\Vxdif.dll

2011-07-21 21:42:09 -------- d-----w- C:\Users\Ina\AppData\Local\HMSMPEG

2011-07-21 21:29:41 48648 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll

2011-07-21 21:08:47 -------- d-----w- C:\Users\Ina\AppData\Local\Home Media Server

2011-07-21 21:08:43 -------- d-----w- C:\ProgramData\Home Media Server

2011-07-21 21:08:38 -------- d-----r- C:\Program Files (x86)\Home Media Server

2011-07-21 20:31:38 -------- d-----w- C:\Users\Ina\AppData\Local\ElevatedDiagnostics

2011-07-21 19:50:48 -------- d-----w- C:\Program Files\Microsoft Synchronization Services

2011-07-21 19:50:28 -------- d-----w- C:\Windows\PCHEALTH

2011-07-21 19:50:28 -------- d-----w- C:\Program Files\Microsoft SQL Server Compact Edition

2011-07-21 19:49:27 -------- d-----w- C:\Program Files (x86)\Microsoft Visual Studio 8

2011-07-21 19:48:38 -------- d-----w- C:\Program Files\Microsoft Analysis Services

2011-07-21 19:48:38 -------- d-----w- C:\Program Files (x86)\Microsoft Analysis Services

2011-07-21 19:46:34 -------- d-----w- C:\Users\Ina\AppData\Local\Microsoft Help

2011-07-21 15:23:49 410976 ----a-w- C:\Windows\SysWow64\deploytk.dll

2011-07-21 15:22:30 -------- d-----w- C:\Program Files (x86)\PS3 Media Server

2011-07-21 15:13:44 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2011-07-21 15:10:08 -------- d-----w- C:\Program Files (x86)\Ask.com

2011-07-21 15:09:07 -------- d-----w- C:\Program Files (x86)\GRETECH

2011-07-21 14:40:00 -------- d-----w- C:\Program Files\ESET

2011-07-21 14:26:58 513080 ----a-w- C:\Windows\System32\drivers\sptd.sys

2011-07-21 14:26:45 -------- d-----w- C:\Program Files (x86)\DAEMON Tools Lite

2011-07-21 14:25:53 -------- d-----w- C:\Users\Ina\AppData\Roaming\DAEMON Tools Lite

2011-07-21 14:25:53 -------- d-----w- C:\ProgramData\DAEMON Tools Lite

2011-07-21 14:17:20 -------- d-----w- C:\extensions

2011-07-21 14:17:19 0 ----a-w- C:\Windows\SysWow64\ConduitEngine.tmp

2011-07-21 14:17:18 -------- d-----w- C:\Users\Ina\AppData\Local\Conduit

2011-07-21 14:16:29 -------- d-----w- C:\Program Files (x86)\uTorrent

2011-07-21 14:15:40 -------- d-----w- C:\Users\Ina\AppData\Roaming\uTorrent

2011-07-21 14:15:40 -------- d-----w- C:\Users\Ina\AppData\Local\uTorrent

2011-07-21 14:05:44 -------- d-----w- C:\Program Files (x86)\Dell Digital Delivery

2011-07-21 14:03:56 -------- d-----w- C:\Program Files\Dell

2011-07-21 13:58:14 -------- d-----w- C:\Program Files (x86)\Dell

2011-07-21 13:37:13 -------- d-----w- C:\Users\Ina\AppData\Local\BMExplorer

2011-07-21 13:34:25 -------- d-----w- C:\Program Files (x86)\Common Files\Atheros

2011-07-21 13:34:23 -------- d-----w- C:\Program Files (x86)\Dell Wireless

2011-07-21 13:34:01 2673664 ----a-w- C:\Windows\System32\drivers\athrx.sys

2011-07-21 13:34:01 2673664 ----a-w- C:\Windows\System32\athrx.sys

2011-07-21 13:34:01 -------- d-----w- C:\Windows\Options

2011-07-20 17:44:08 -------- d-----w- C:\Users\Ina\AppData\Local\Google

2011-07-20 17:26:10 476928 ----a-w- C:\Windows\System32\drivers\btmusb.sys

2011-07-20 17:22:15 -------- d-----w- C:\Program Files (x86)\Driver-Soft

2011-07-20 16:42:19 -------- d-----r- C:\Program Files (x86)\Skype

2011-07-20 16:42:07 -------- d-----w- C:\Program Files (x86)\Foxit Software

2011-07-20 16:41:44 165376 ----a-w- C:\Windows\SysWow64\unrar.dll

2011-07-20 16:41:43 839680 ----a-w- C:\Windows\SysWow64\lameACM.acm

2011-07-20 16:41:43 810496 ----a-w- C:\Windows\SysWow64\xvidcore.dll

2011-07-20 16:41:43 80896 ----a-w- C:\Windows\SysWow64\ff_vfw.dll

2011-07-20 16:41:43 237568 ----a-w- C:\Windows\SysWow64\yv12vfw.dll

2011-07-20 16:41:43 183808 ----a-w- C:\Windows\SysWow64\xvidvfw.dll

2011-07-20 16:41:43 151552 ----a-w- C:\Windows\SysWow64\ac3acm.acm

2011-07-20 16:41:40 -------- d-----w- C:\Program Files (x86)\K-Lite Codec Pack

2011-07-20 16:27:03 82432 ----a-w- C:\Windows\System32\drivers\nusb3hub.sys

2011-07-20 16:27:03 181760 ----a-w- C:\Windows\System32\drivers\nusb3xhc.sys

2011-07-20 16:26:58 -------- d-----w- C:\Program Files\Synaptics

2011-07-20 16:26:52 396584 ----a-w- C:\Windows\System32\SynCOM.dll

2011-07-20 16:26:52 316464 ----a-w- C:\Windows\System32\drivers\SynTP.sys

2011-07-20 16:26:52 264488 ----a-w- C:\Windows\System32\SynCtrl.dll

2011-07-20 16:26:52 210216 ----a-w- C:\Windows\SysWow64\SynCtrl.dll

2011-07-20 16:26:52 207144 ----a-w- C:\Windows\System32\SynTPAPI.dll

2011-07-20 16:26:52 173352 ----a-w- C:\Windows\SysWow64\SynCOM.dll

2011-07-20 16:26:52 147752 ----a-w- C:\Windows\System32\SynTPCo4.dll

2011-07-20 16:26:52 107816 ----a-w- C:\Windows\SysWow64\SynTPCOM.dll

2011-07-20 16:26:48 438808 ----a-w- C:\Windows\System32\drivers\iaStor.sys

2011-07-20 16:26:28 74272 ----a-w- C:\Windows\System32\RtNicProp64.dll

2011-07-20 16:26:28 412264 ----a-w- C:\Windows\System32\drivers\Rt64win7.sys

2011-07-20 16:23:28 -------- d-----w- C:\Users\Ina\AppData\Roaming\Torrent2Exe

2011-07-20 16:23:28 -------- d-----w- C:\Program Files\Torrent2Exe

2011-07-20 04:33:00 -------- d-----w- C:\Windows\SysWow64\Wat

2011-07-20 04:33:00 -------- d-----w- C:\Windows\System32\Wat

2011-07-20 04:07:41 8192 ----a-w- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll

2011-07-20 04:07:41 8192 ----a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll

2011-07-20 04:07:35 -------- d-----w- C:\Program Files (x86)\Common Files\postureAgent

2011-07-20 04:07:27 56344 ----a-w- C:\Windows\System32\drivers\HECIx64.sys

2011-07-20 04:03:43 -------- d-----w- C:\Windows\SysWow64\sda

2011-07-20 04:03:24 9888360 ----a-w- C:\Windows\SysWow64\RtsUStoricon.dll

2011-07-20 04:03:24 422504 ----a-w- C:\Windows\System32\RtsUStor.dll

2011-07-20 04:03:24 250984 ----a-w- C:\Windows\System32\drivers\RtsUStor.sys

2011-07-20 04:02:26 -------- d-----w- C:\Program Files (x86)\Renesas Electronics

2011-07-20 04:01:53 -------- d-sh--w- C:\Windows\Installer

2011-07-20 02:20:46 -------- d-----w- C:\Windows\Panther

2011-07-19 19:49:53 902656 ----a-w- C:\Windows\System32\d2d1.dll

2011-07-19 19:49:53 739840 ----a-w- C:\Windows\SysWow64\d2d1.dll

2011-07-19 19:49:53 1544192 ----a-w- C:\Windows\System32\DWrite.dll

2011-07-19 19:49:53 1139200 ----a-w- C:\Windows\System32\FntCache.dll

2011-07-19 19:49:53 1076736 ----a-w- C:\Windows\SysWow64\DWrite.dll

2011-07-19 19:49:52 31232 ----a-w- C:\Windows\SysWow64\prevhost.exe

2011-07-19 19:49:52 31232 ----a-w- C:\Windows\System32\prevhost.exe

2011-07-19 19:39:18 8578896 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2011-07-19 19:37:57 499200 ----a-w- C:\Windows\System32\drivers\afd.sys

2011-07-19 19:35:06 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys

2011-07-19 19:18:48 -------- d-----w- C:\Users\Ina\AppData\Local\Diagnostics

2011-07-19 19:09:23 107552 ----a-w- C:\Windows\System32\RTNUninst64.dll

2011-07-19 19:09:20 -------- d-----w- C:\Program Files (x86)\Realtek

2011-07-19 15:34:45 53248 ----a-w- C:\Windows\SysWow64\CSVer.dll

2011-07-19 15:34:37 -------- d-----w- C:\Intel

2011-07-19 15:32:55 -------- d-----w- C:\dell

.

==================== Find3M ====================

.

2011-07-22 05:42:23 2303488 ----a-w- C:\Windows\System32\jscript9.dll

2011-07-22 05:36:54 65536 ----a-w- C:\Windows\System32\sppuinotify.dll

2011-07-22 05:36:54 381952 ----a-w- C:\Windows\System32\sppcommdlg.dll

2011-07-22 05:36:53 419840 ----a-w- C:\Windows\System32\systemcpl.dll

2011-07-22 05:36:53 1008128 ----a-w- C:\Windows\System32\user32.dll

2011-07-22 05:36:52 15360 ----a-w- C:\Windows\System32\slwga.dll

2011-07-22 05:36:52 142336 ----a-w- C:\Windows\System32\sppwmi.dll

2011-07-22 05:36:16 1389056 ----a-w- C:\Windows\System32\wininet.dll

2011-07-22 05:36:08 389632 ----a-w- C:\Windows\System32\winlogon.exe

2011-07-22 05:36:08 349696 ----a-w- C:\Windows\System32\slui.exe

2011-07-22 05:36:08 2048 ----a-w- C:\Windows\System32\winver.exe

2011-07-22 05:36:08 107946 ----a-w- C:\Windows\System32\slmgr.vbs

2011-07-22 05:32:40 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2011-07-22 02:54:43 1797632 ----a-w- C:\Windows\SysWow64\jscript9.dll

2011-07-22 02:48:26 1126912 ----a-w- C:\Windows\SysWow64\wininet.dll

2011-07-22 02:44:36 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2011-07-16 05:41:50 362496 ----a-w- C:\Windows\System32\wow64win.dll

2011-07-16 05:41:49 243200 ----a-w- C:\Windows\System32\wow64.dll

2011-07-16 05:41:49 13312 ----a-w- C:\Windows\System32\wow64cpu.dll

2011-07-16 05:39:10 16384 ----a-w- C:\Windows\System32\ntvdm64.dll

2011-07-16 05:37:12 421888 ----a-w- C:\Windows\System32\KernelBase.dll

2011-07-16 04:29:19 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

2011-07-16 04:26:00 44032 ----a-w- C:\Windows\apppatch\acwow64.dll

2011-07-16 04:25:37 25600 ----a-w- C:\Windows\SysWow64\setup16.exe

2011-07-16 04:24:23 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

2011-07-16 04:24:22 272384 ----a-w- C:\Windows\SysWow64\KernelBase.dll

2011-07-16 02:21:44 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

2011-07-16 02:21:41 2048 ----a-w- C:\Windows\SysWow64\user.exe

2011-07-16 02:17:19 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

2011-07-16 02:17:19 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

2011-07-16 02:17:19 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

2011-07-16 02:17:19 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

2011-07-09 02:46:28 288768 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys

2011-06-24 05:34:53 214528 ----a-w- C:\Windows\System32\winsrv.dll

2011-06-24 05:25:49 338432 ----a-w- C:\Windows\System32\conhost.exe

2011-06-23 05:43:12 5561216 ----a-w- C:\Windows\System32\ntoskrnl.exe

2011-06-23 04:33:57 3967872 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2011-06-23 04:33:57 3912576 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2011-06-21 06:34:00 1923968 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2011-06-15 10:02:23 212992 ----a-w- C:\Windows\System32\odbctrac.dll

2011-06-15 10:02:23 163840 ----a-w- C:\Windows\System32\odbccp32.dll

2011-06-15 10:02:23 106496 ----a-w- C:\Windows\System32\odbccu32.dll

2011-06-15 10:02:23 106496 ----a-w- C:\Windows\System32\odbccr32.dll

2011-06-15 08:55:19 86016 ----a-w- C:\Windows\SysWow64\odbccu32.dll

2011-06-15 08:55:19 81920 ----a-w- C:\Windows\SysWow64\odbccr32.dll

2011-06-15 08:55:19 319488 ----a-w- C:\Windows\SysWow64\odbcjt32.dll

2011-06-15 08:55:19 163840 ----a-w- C:\Windows\SysWow64\odbctrac.dll

2011-06-15 08:55:19 122880 ----a-w- C:\Windows\SysWow64\odbccp32.dll

2011-06-11 03:07:25 3137536 ----a-w- C:\Windows\System32\win32k.sys

2011-05-24 16:14:10 270720 ------w- C:\Windows\System32\MpSigStub.exe

2011-05-24 11:42:55 404480 ----a-w- C:\Windows\System32\umpnpmgr.dll

2011-05-24 10:40:05 64512 ----a-w- C:\Windows\SysWow64\devobj.dll

2011-05-24 10:40:05 44544 ----a-w- C:\Windows\SysWow64\devrtl.dll

2011-05-24 10:39:38 145920 ----a-w- C:\Windows\SysWow64\cfgmgr32.dll

2011-05-24 10:37:54 252928 ----a-w- C:\Windows\SysWow64\drvinst.exe

.

============= FINISH: 15:33:46,64 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-06-23.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume2

Install Date: 19.7.2011 г. 18:28:31

System Uptime: 17.8.2011 г. 08:11:00 (7 hours ago)

.

Motherboard: Dell Inc. | | 034W60

Processor: Intel® Pentium® CPU B940 @ 2.00GHz | CPU 1 | 2000/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 98 GiB total, 65,111 GiB free.

D: is FIXED (NTFS) - 497 GiB total, 425,594 GiB free.

E: is CDROM (CDFS)

F: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

Домашний медиа-сервер (UPnP)

µTorrent

ABBYY FineReader 10 Corporate Edition

Acronis True Image Home 2011

Adobe Acrobat 8 Professional - Bulgarian, Romanian, Slovenian

Adobe Flash Player 10 ActiveX

Ask Toolbar

COWON Media Center - jetAudio Plus VX

CyberLink PowerDVD 8

DAEMON Tools Lite

Dell Digital Delivery

Dell WLAN and Bluetooth Client Installation

Driver Genius Professional Edition

Easy CD-DA Extractor 10

ESET Online Scanner v3

Foxit Reader

GOM Player

Google Chrome

Google Toolbar for Internet Explorer

Google Update Helper

ICE Book Reader Professional v8.9.1

Intel® Control Center

Intel® Management Engine Components

Java 6 Update 10

K-Lite Codec Pack 6.7.0 (Full)

Malwarebytes' Anti-Malware version 1.51.1.1800

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Nero Burning ROM 10

Nero BurningROM 10 Help (CHM)

Nero BurnRights 10

Nero BurnRights 10 Help (CHM)

Nero Control Center 10

Nero ControlCenter 10 Help (CHM)

Nero Core Components 10

Nero Update

Panda USB Vaccine 1.0.1.4

Picasa 3

Realtek Ethernet Controller Driver

Realtek USB 2.0 Card Reader

Renesas Electronics USB 3.0 Host Controller Driver

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Skype™ 5.1

Steam

Torrent2Exe

Total Commander (Remove or Repair)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

.

==== Event Viewer Messages From Past Week ========

.

16.8.2011 г. 16:31:34, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.

16.8.2011 г. 16:31:34, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

16.8.2011 г. 12:40:31, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Dell Digital Delivery Service service to connect.

16.8.2011 г. 12:40:31, Error: Service Control Manager [7000] - The Dell Digital Delivery Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

14.8.2011 г. 21:21:41, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.

14.8.2011 г. 21:21:41, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

14.8.2011 г. 21:21:41, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

14.8.2011 г. 21:21:41, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}

14.8.2011 г. 21:21:41, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}

14.8.2011 г. 21:21:29, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

14.8.2011 г. 21:21:20, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

14.8.2011 г. 21:21:12, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD CSC DfsC discache ehdrv NetBIOS NetBT nsiproxy Psched rdbss spldr sptd tdx vwififlt Wanarpv6 WfpLwf

14.8.2011 г. 21:21:12, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

14.8.2011 г. 21:21:12, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

14.8.2011 г. 21:21:12, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.

14.8.2011 г. 21:21:12, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

14.8.2011 г. 21:21:12, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

14.8.2011 г. 21:21:12, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.

14.8.2011 г. 21:21:12, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

14.8.2011 г. 21:21:12, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

14.8.2011 г. 21:21:12, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.

14.8.2011 г. 21:21:12, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

14.8.2011 г. 21:20:54, Error: sptd [4] - Driver detected an internal error in its data structures for .

14.8.2011 г. 20:50:16, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004

14.8.2011 г. 17:23:47, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.

14.8.2011 г. 16:13:54, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004

.

==== End Of File ===========================

17 август 201115 г.

Привет. В малко случаи, подобен на вашия имаме успех с почистването на тази гадина. Може да пробваме, ако желаете. Като начало изтеглете OTL.exe и го запазете на десктопа.

Стартирайте OTL (ако е необходимо, потвърдете през UAC).
Направете следните настройки:
Сложете отметка пред Scan All Users
Под менюто File Age => изберете 90 days
Под менюто Standard Registry => променете на ALL
Сложете отметки пред LOP и Purity Check

Под

с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
drivers32 /all
%SYSTEMDRIVE%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
/md5start
atapi.sys
iaStor.sys
explorer.exe
svchost.exe
userinit.exe
hlp.dat
winlogon.exe
wininit.exe
volsnap.sys
/md5stop

Натиснете маркираният в синьо бутон: Run Scan.
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

17 август 201115 г.

Автор

Ето ги въпросните файлове.

OTL.Txt

Extras.Txt

Редактирано 17 август 201115 г. от Ozzi (преглед на промените)

17 август 201115 г.

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:otl
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [TaskTray] File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] File not found
O33 - MountPoints2\{a24c4cc0-b3a5-11e0-9ea3-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a24c4cc0-b3a5-11e0-9ea3-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Installer.exe
[2011.08.17 08:12:38 | 000,604,175 | ---- | C] () -- C:\Users\Public\Documents\SharedDocs.rar
[2011.08.16 22:42:43 | 000,609,271 | ---- | C] () -- C:\Users\Public\Documents\Documents.rar
:files
recycler /alldrives
ipconfig /flushdns /c
:reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"53:UDP" =-
:commands
[purity]
[emptytemp]
[emptyflash]
[reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

17 август 201115 г.

Автор

All processes killed

========== OTL ==========

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\TaskTray deleted successfully.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a24c4cc0-b3a5-11e0-9ea3-806e6f6e6963}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a24c4cc0-b3a5-11e0-9ea3-806e6f6e6963}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a24c4cc0-b3a5-11e0-9ea3-806e6f6e6963}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a24c4cc0-b3a5-11e0-9ea3-806e6f6e6963}\ not found.

File F:\Installer.exe not found.

C:\Users\Public\Documents\SharedDocs.rar moved successfully.

C:\Users\Public\Documents\Documents.rar moved successfully.

========== FILES ==========

recycler not found in C:\

recycler not found in D:\

recycler not found in E:\

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\Ina\Desktop\cmd.bat deleted successfully.

C:\Users\Ina\Desktop\cmd.txt deleted successfully.

========== REGISTRY ==========

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List not found.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Ina

->Temp folder emptied: 59413348 bytes

->Temporary Internet Files folder emptied: 6010688 bytes

->Google Chrome cache emptied: 283817755 bytes

->Flash cache emptied: 1724 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 462780 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 334,00 mb

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Ina

->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.26.5 log created on 08172011_190701

Files\Folders moved on Reboot...

C:\Users\Ina\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

17 август 201115 г.

Сега стартирайте OTL още веднъж и натиснете бутона CleanUp.

Публикувано изображение

При дeинсталацията на OTL ще бъдат почистени инструменти и файлове, които използвахме в темата. Ще последва рестарт на Windows. Може да изтриете останалите програми и логове, които използвахме в темата.

Ще помисля малко за това какво да правим по-нататък. След около час ще пиша. Изчакайте...

17 август 201115 г.

Автор

Изпълнено! След горните манипулации се появи следното съобщение на Solve PC issues:

Редактирано 17 август 201115 г. от Ozzi (преглед на промените)

17 август 201115 г.

Сега направете една проверка с Microsoft Malicious Software Removal Tool. След като завърши проверката, намерете файла mrt.log, който се намира в папката %WINDIR%\debug или C:\WINDOWS\Debug, където C е системния дял. Прикачете го към следващия си коментар по темата.

17 август 201115 г.

Автор

Приключих със сканирането. но при опита да прекача файла mrt.log ми се изписва следното съобщение: "Грешка Не можете да качвате такъв тип файл"

Преименувах файла от mrt.log на mrt.txt и сега с прикачането няма проблеми:

P.S Ако може съвет относно моят пост номер 7 - как да постъпя с тези съобщения?

mrt.txt

Редактирано 17 август 201115 г. от Ozzi (преглед на промените)

17 август 201115 г.

Проблемът със съобщенията е незначителен и винаги може да го оправим. Обаче проблемът с този червей е много сериозен, като гледам лога на Microsoft Malicious Software Removal Tool.

За последно може да пробвате klwk, ето инструкция за използвано му: klwk.com utility for virus fighting.

Пишете дали има някакви проблеми, защото все пак име някакъв минимален шанс за успех.

17 август 201115 г.

Автор

Ок ще опитам, но това ще го сторя утре, защото вече стана късно. Благодаря за усилията!

17 август 201115 г.

Нещо не мога да си обясня:

1. От лога на DDS си личи, че имате 64 битова операционна система Microsoft Windows 7 Ultimate:

Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.4003.1891 [GMT 3:00]

2. От лога Extras на OTL илиза, че имате Windows XP Professional Edition Service Pack 3

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)

Както и да е, приятна вечер...

18 август 201115 г.

Автор

Нещо не мога да си обясня:
1. От лога на DDS си личи, че имате 64 битова операционна система Microsoft Windows 7 Ultimate:

2. От лога Extras на OTL илиза, че имате Windows XP Professional Edition Service Pack 3

Както и да е, приятна вечер...

Добро утро!

Да от лога Extras така излиза и то е нормално тъй като лога не е от моя компютър. Сега го видях това за което се извинявам. Да опитам ли да пусна KWLK или да генерирам нови логове с OTL?

18 август 201115 г.

Оставете OTL, вече не ни трябва. Опитайте klwk.

18 август 201115 г.

Автор

В момента е в процес на сканиране. Независимо от резултата - каква е все пак причината за попадането на този червей на компютъра ми? Лаптопа е нов (на месец и половина). След като го инсталирах веднага му сложих Nod32 и ъпдейтнах Windows7. Може ли да е сложен умишлено от някой който е имал достъп до този компютър с цел да се откраднат пароли и т.н?

18 август 201115 г.

Автор

При сканиране с klwk не бяха открити заразени файлове, но аз виждам същите архивни файлове по папките ми. Т.е червея (или каквото е там) си стои. Вероятно ще опитам първо с възстановяване на системата от бакъпа който бях направил след инсталацията. Само не ми е ясно има ли вероятност гадинката да се е настанила и на втората част на диска, защото бакъп файла се намира там.

18 август 201115 г.

За съжаление този бекъп остава като последен вариант. Пробвайте възстановяване оттам. Не използвайте флашки и връзка с други компютри, защото този червей е много коварен.

18 август 201115 г.

Автор

Ще прибегна към този варинат но след 21.08, а до тогава вероятно ще опитам с някоя друга антивирусна програма и друг ad-aware програма.

18 август 201115 г.

Няма смисъл да се бавите, защото операционната система е сериозно компрометирана. Няма да можете да се справите с този червей. Според мен във вашия случай ще е най-добре да направите чиста инсталация на Windows 7, като по време на инсталацията изтриете всички дялове (partitions) и ги създадете наново. После следва формат на дяловете и инсталация. В момента използвате някакъв моднат вариант на Windows 7 64bit- Ultimate Edition, както и активатор, който вероятно създава проблеми. Препоръчвам да използвате MSDN версия за Windows 7 (заради правилата на форума няма да ви кажа как да се снабдите с нея) или по възможност легален Windows.

P.S. След като имате инсталиран Acronis, винаги може да си правите резервни копия за бекъп, както и да използвате възможностите на Windows. Пишете какво ще решите да правите по-нататък.

18 август 201115 г.

Автор

Налага се да се забавя, защото до неделя не съм си в къщи реално, където ще имам повече ресурси да си инсталирам наново системата. Това с изтриването на дяловете и преформатирането ще е доста неприятно, защото имам качена доста информация вече (филми, снимки и т.н), но щом се налага ще го сторя. Активатора за версията го издирих като самия активатор е направен специално за лаптопи dell (за сега не съм забелязал проблеми относно активацията). Относно версията на Windows 7 ще попрочета. Мисля, че бекъпа който бях направил с Acronis-а мисля че трябва да не е компрометиран, но е ясно че има много голяма вероятнос гадината да се е скрила някъде по втория дял. Задължително ще опиша развитието на ситуацията.

31 януари 201214 г.

За съжаление и аз имам същият червей, но темата е прекъснала на 18 август. Ако Ozzi си е решил проблема или

Überfighter е намерил решение, да кажат как. В нета информацията за премахването на този червей е оскъдна.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

31 януари 201214 г.

Здравейте..!Моля не пишете в чужда тема - нарушавате правилата на подраздела..!Ако искате да ви помогним създайте си нова ваша тема ,прочетете и изпълнете сканирането от тази тема: Системата ми е инфектирана - Какво да правя сега?

Добре дошли!

Win32/AutoRun.Agent.UD - Моля за помощ

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)