facebook virus [РЕШЕН]

30 октомври 201114 г.

Здравейте,моля да ви помогнете. Прихванах вируса от фейсбук който иска да свалиш ъпдейт за Flash player.Антивирусната ми беше свалена в този момент и го свалих(очевидно вируса се е мушнал).След това Нод32 се изключи тотално.Не мога да влеза във фейсбук.Свалих си Касперски и пуснах да го инсталирам после след инсталацията пуснах програмата и компютъра ми се рестартира в сейф мод.След сейф мод няколко секунди се включва в нормален режим.Пуснах скан със Virus Fighter.Операционната ми система е Windows 7 и нямам диск.

30 октомври 201114 г.

Здравейте,

1. Изтеглете ComboFix от BleepingComputer

и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. Ако получите предупреждение от UAC, съгласете се.

5 ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

6 Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

Забележка: Ако се появи следното съобщение при отварянето на различни програми след завършване на сканирането с Combofix - "illegal operation on a registry key that has been marked for deletion." просто рестартирайте компютъра още веднъж и то ще изчезне.

По време на сканирането не използвайте компютъра си !

30 октомври 201114 г.

Автор

ComboFix 11-10-30.03 - el 10.2011 г. 22:02:07.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1251.359.1033.18.4023.2173 [GMT 1:00]

Running from: c:\users\el\Desktop\ComboFix.exe

AV: VIRUSfighter *Disabled/Updated* {97C35F3D-E5DB-6C47-057E-0E55B391ED74}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\el\AppData\Roaming\.#

c:\users\el\AppData\Roaming\.#\MBX@12B0@342968.###

c:\users\el\AppData\Roaming\.#\MBX@12B0@342998.###

c:\users\el\AppData\Roaming\.#\MBX@12B0@3429C8.###

c:\users\el\AppData\Roaming\.#\MBX@15C@1DC2968.###

c:\users\el\AppData\Roaming\.#\MBX@15C@1DC2998.###

c:\users\el\AppData\Roaming\.#\MBX@15C@1DC29C8.###

c:\users\el\AppData\Roaming\.#\MBX@418@6F2968.###

c:\users\el\AppData\Roaming\.#\MBX@418@6F2998.###

c:\users\el\AppData\Roaming\.#\MBX@418@6F29C8.###

c:\users\el\AppData\Roaming\.#\MBX@7FC@6E2968.###

c:\users\el\AppData\Roaming\.#\MBX@7FC@6E2998.###

c:\users\el\AppData\Roaming\.#\MBX@7FC@6E29C8.###

c:\users\el\AppData\Roaming\.#\MBX@9A0@682968.###

c:\users\el\AppData\Roaming\.#\MBX@9A0@682998.###

c:\users\el\AppData\Roaming\.#\MBX@9A0@6829C8.###

c:\users\el\AppData\Roaming\.#\MBX@BE0@1DD2968.###

c:\users\el\AppData\Roaming\.#\MBX@BE0@1DD2998.###

c:\users\el\AppData\Roaming\.#\MBX@BE0@1DD29C8.###

c:\users\el\AppData\Roaming\.#\MBX@E30@1FF2968.###

c:\users\el\AppData\Roaming\.#\MBX@E30@1FF2998.###

c:\users\el\AppData\Roaming\.#\MBX@E30@1FF29C8.###

c:\users\Public\videos\HP MediaSmart Demo.exe

c:\windows\assembly\tmp\U

c:\windows\assembly\tmp\U\000000c0.@

c:\windows\assembly\tmp\U\000000cb.@

c:\windows\assembly\tmp\U\000000cf.@

c:\windows\assembly\tmp\U\80000000.@

c:\windows\assembly\tmp\U\800000c0.@

c:\windows\assembly\tmp\U\800000cb.@

c:\windows\assembly\tmp\U\800000cf.@

c:\windows\front_ip_list.txt

c:\windows\geoiplist

c:\windows\geoiplist.rar

c:\windows\iecheck_iplist.txt

c:\windows\info1

c:\windows\iplist.txt

c:\windows\loader2.exe_ok

c:\windows\logboot_30.10.2011.tureg.log

c:\windows\proc_list1.log

c:\windows\system32\config\systemprofile\AppData\Local\aa4a3ccd\X

c:\windows\system32\consrv.dll

c:\windows\system32\drivers\etc\HSTS~1

c:\windows\system32\drivers\etc\hоsts

c:\windows\TEMP\www1e0eo.vbt

c:\windows\update.1

c:\windows\update.2

c:\windows\update.2\svchost.exe

c:\windows\update.5.0

c:\windows\update.5.0\svchost.exe

c:\windows\winlog-dirs.txt

c:\windows\winlog-ids.txt

c:\windows\winsetupapi.log

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_srvbtcclient

-------\Service_srviecheck

-------\Service_srvsysdriver32

-------\Service_wxpdrivers

.

((((((((((((((((((((((((( Files Created from 2011-09-28 to 2011-10-30 )))))))))))))))))))))))))))))))

.

2011-10-30 21:12 . 2011-10-30 21:12 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-10-30 19:46 . 2011-10-30 19:46 -------- d-----w- c:\program files (x86)\Kaspersky Lab

2011-10-30 13:45 . 2011-10-30 14:15 -------- d-----w- c:\programdata\Systweak

2011-10-30 13:02 . 2011-10-14 15:37 25920 ----a-w- c:\windows\system32\authuitu.dll

2011-10-30 13:02 . 2011-10-14 15:37 21312 ----a-w- c:\windows\SysWow64\authuitu.dll

2011-10-30 13:01 . 2011-10-30 13:02 -------- d-----w- c:\program files (x86)\TuneUp Utilities 2012

2011-10-30 13:00 . 2011-10-30 13:00 -------- d-sh--w- c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}

2011-10-30 07:00 . 2010-09-16 10:26 40408 ----a-w- c:\windows\system32\CleanMFT64.exe

2011-10-30 07:00 . 2008-04-02 14:54 1101824 ----a-w- c:\windows\SysWow64\UniBox210.ocx

2011-10-30 07:00 . 2008-04-02 14:53 212992 ----a-w- c:\windows\SysWow64\UniBoxVB12.ocx

2011-10-30 07:00 . 2008-04-02 14:53 880640 ----a-w- c:\windows\SysWow64\UniBox10.ocx

2011-10-30 07:00 . 2004-08-04 06:00 506368 ----a-w- c:\windows\SysWow64\msxml.dll

2011-10-30 07:00 . 2011-10-30 07:00 -------- d-----w- c:\program files (x86)\Common Files\PC Tools

2011-10-30 04:03 . 2011-10-30 14:15 -------- d-----w- c:\users\el\AppData\Roaming\Systweak

2011-10-30 04:02 . 2011-10-30 04:02 -------- d-----w- c:\users\el\AppData\Roaming\DivX

2011-10-30 04:02 . 2011-10-30 04:02 -------- d-----w- c:\program files (x86)\Common Files\PX Storage Engine

2011-10-30 04:01 . 2011-10-30 04:01 -------- d-----w- c:\program files\DivX

2011-10-30 04:00 . 2011-10-30 04:01 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared

2011-10-29 17:03 . 2011-10-29 17:03 -------- d-----w- c:\windows\Sun

2011-10-28 17:47 . 2011-10-28 23:20 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-10-28 17:28 . 2011-10-28 17:35 -------- d-----w- c:\users\el\AppData\Roaming\albumart

2011-10-28 17:28 . 2011-10-30 13:58 -------- d-----w- c:\program files (x86)\Album Cover Art Downloader

2011-10-28 15:54 . 2011-10-30 13:44 -------- d-----w- c:\programdata\clp

2011-10-28 15:53 . 2011-10-29 13:30 -------- d-----w- c:\users\el\AppData\Roaming\Fighters

2011-10-28 15:53 . 2011-10-28 15:53 -------- d-----w- c:\program files (x86)\Common Files\Common Toolkit Suite

2011-10-28 15:53 . 2011-10-30 19:36 -------- d-----w- c:\program files (x86)\Fighters

2011-10-28 15:53 . 2011-10-28 15:53 -------- d-----w- c:\programdata\Common Toolkit Suite

2011-10-28 15:53 . 2011-10-30 19:37 -------- d-----w- c:\programdata\Fighters

2011-10-28 15:52 . 2011-10-28 15:52 0 ----a-w- c:\windows\SysWow64\ConduitEngine.tmp

2011-10-28 15:52 . 2011-10-28 15:52 -------- d-----w- c:\program files (x86)\ConduitEngine

2011-10-28 15:47 . 2011-10-30 15:43 -------- d--h--w- c:\windows\update.tray-12-0-lnk

2011-10-28 15:47 . 2011-10-29 21:13 -------- d--h--w- c:\windows\update.tray-12-0

2011-10-28 15:41 . 2011-10-28 15:41 -------- d-----w- C:\found.000

2011-10-28 15:18 . 2011-10-28 23:20 -------- d-----w- c:\users\el\AppData\Local\Solid State Networks

2011-10-28 12:00 . 2011-10-28 12:00 246272 ----a-w- c:\windows\unrar.exe

2011-10-28 11:48 . 2011-10-29 01:28 -------- d-----w- c:\windows\av_ico

2011-10-28 11:44 . 2011-10-29 21:14 -------- d--h--w- c:\windows\update.tray-2-0-lnk

2011-10-28 11:44 . 2011-10-29 21:13 -------- d--h--w- c:\windows\update.tray-2-0

2011-10-27 23:53 . 2011-10-27 23:53 -------- d-----w- c:\users\el\AppData\Local\Apple Computer

2011-10-27 23:51 . 2011-10-28 17:29 -------- d-----w- c:\programdata\Apple Computer

2011-10-27 23:51 . 2011-10-27 23:52 -------- d-----w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001}

2011-10-27 23:50 . 2011-10-27 23:50 -------- d-----w- c:\users\el\AppData\Local\Apple

2011-10-27 23:50 . 2011-10-27 23:50 -------- d-----w- c:\program files\Common Files\Apple

2011-10-27 23:50 . 2011-10-30 13:58 -------- d-----w- c:\program files (x86)\Common Files\Apple

2011-10-27 23:50 . 2011-10-27 23:50 -------- d-----w- c:\programdata\Apple

2011-10-26 01:02 . 2011-08-13 05:27 6144 ----a-w- c:\program files\Internet Explorer\iecompat.dll

2011-10-26 01:02 . 2011-08-13 04:18 6144 ----a-w- c:\program files (x86)\Internet Explorer\iecompat.dll

2011-10-24 14:48 . 2011-10-24 14:49 -------- d-----w- c:\users\el\AppData\Local\Facebook

2011-10-22 18:19 . 2011-10-22 18:19 -------- d-----w- c:\users\el\AppData\Local\Mozilla

2011-10-22 01:00 . 2011-10-22 01:00 -------- d-----w- C:\a34cb2e6bc9630b39b0f3c54

2011-10-21 12:39 . 2011-10-21 12:39 -------- d-----w- c:\program files (x86)\Microsoft Synchronization Services

2011-10-21 12:39 . 2011-10-21 12:39 -------- d-----w- c:\windows\PCHEALTH

2011-10-21 12:39 . 2011-10-21 12:39 -------- d-----w- c:\program files (x86)\Microsoft Sync Framework

2011-10-21 12:37 . 2011-10-21 12:37 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8

2011-10-21 12:37 . 2011-10-21 12:37 -------- d-----w- c:\program files (x86)\Microsoft Analysis Services

2011-10-21 12:37 . 2011-10-21 12:40 -------- d-----w- c:\windows\SHELLNEW

2011-10-21 12:36 . 2011-10-21 12:36 -------- d-----r- C:\MSOCache

2011-10-19 09:06 . 2011-10-19 09:06 13720 ----a-w- c:\windows\system32\drivers\avfsfilter.sys

2011-10-17 01:23 . 2011-10-18 00:41 -------- d-----w- c:\users\el\AppData\Local\Graboid

2011-10-17 01:23 . 2011-10-17 01:23 -------- d-----w- c:\users\el\AppData\Local\Geckofx

2011-10-17 01:22 . 2011-10-25 06:35 -------- d-----w- c:\program files (x86)\Graboid

2011-10-16 09:42 . 2011-10-16 09:42 -------- d-----w- C:\PFiles

2011-10-12 07:39 . 2011-10-12 07:39 -------- d-----w- C:\2dce9bf6ba70895a26ef460c84d5

2011-10-12 06:49 . 2011-08-17 04:24 465408 ----a-w- c:\windows\SysWow64\psisdecd.dll

2011-10-12 06:49 . 2011-08-17 04:19 75776 ----a-w- c:\windows\SysWow64\psisrndr.ax

2011-10-05 11:46 . 2011-10-05 11:46 -------- d-----w- c:\users\el\AppData\Roaming\Registry Mechanic

2011-10-05 11:44 . 2008-09-17 19:17 658432 ----a-w- c:\windows\SysWow64\MSCOMCT2.OCX

2011-10-02 02:00 . 2011-10-30 04:03 -------- d-----w- c:\program files (x86)\DivX

2011-10-02 02:00 . 2011-10-30 04:03 -------- d-----w- c:\programdata\DivX

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-10-14 15:37 . 2011-10-30 13:02 34624 ----a-w- c:\windows\system32\TURegOpt.exe

2011-10-07 04:16 . 2011-10-28 09:41 8570192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D52D8DD1-D46D-484D-B0A2-67A6DD03CADF}\mpengine.dll

2011-10-01 03:25 . 2011-10-12 06:48 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2011-09-13 04:30 . 2011-09-13 04:30 37456 ----a-w- c:\windows\system32\drivers\avgrkx64.sys

2011-09-09 21:56 . 2011-09-09 21:39 270912 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys

2011-09-06 03:03 . 2011-10-12 06:48 3138048 ----a-w- c:\windows\system32\win32k.sys

2011-08-30 21:05 . 2011-08-30 21:05 83816 ----a-w- c:\windows\SysWow64\dns-sd.exe

2011-08-30 21:05 . 2011-08-30 21:05 73064 ----a-w- c:\windows\SysWow64\dnssd.dll

2011-08-28 01:18 . 2011-08-28 01:18 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-08-27 05:37 . 2011-10-12 06:48 861696 ----a-w- c:\windows\system32\oleaut32.dll

2011-08-27 05:37 . 2011-10-12 06:48 331776 ----a-w- c:\windows\system32\oleacc.dll

2011-08-20 19:46 . 2011-08-20 19:45 848 --sha-w- c:\programdata\KGyGaAvL.sys

2011-08-20 05:37 . 2011-10-12 06:48 1188864 ----a-w- c:\windows\system32\wininet.dll

2011-08-17 05:26 . 2011-10-12 06:49 613888 ----a-w- c:\windows\system32\psisdecd.dll

2011-08-17 05:25 . 2011-10-12 06:49 108032 ----a-w- c:\windows\system32\psisrndr.ax

2011-08-08 04:08 . 2011-08-08 04:08 46672 ----a-w- c:\windows\system32\drivers\avgmfx64.sys

2011-08-07 18:08 . 2011-08-07 18:08 424624 ----a-w- c:\windows\system32\wrap_oal.dll

2011-08-07 18:08 . 2011-08-07 18:08 418480 ----a-w- c:\windows\SysWow64\wrap_oal.dll

2011-08-07 18:08 . 2011-08-07 18:08 138472 ----a-w- c:\windows\system32\OpenAL32.dll

2011-08-07 18:08 . 2011-08-07 18:08 115432 ----a-w- c:\windows\SysWow64\OpenAL32.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files (x86)\BS_Player\prxtbBS_0.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2011-01-17 14:54 175912 ----a-w- c:\program files (x86)\ConduitEngine\prxConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

2011-01-17 14:54 175912 ----a-w- c:\program files (x86)\BS_Player\prxtbBS_0.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files (x86)\BS_Player\prxtbBS_0.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\users\el\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\users\el\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\users\el\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-08-20 2363392]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-09-26 17353352]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-24 323640]

"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2009-09-02 60464]

"WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]

"DpAgent"="c:\program files (x86)\DigitalPersona\Bin\dpagent.exe" [2009-12-01 842816]

"ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2010-03-10 300400]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"VFPROguard"="c:\program files (x86)\Fighters\VIRUSfighter\vfprotray.exe" [2011-10-19 1300616]

"SSDMonitor"="c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2010-11-15 112600]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]

"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallation-feedback-lsf?lic=TlVIRDQtWUg5UEUtTzNQNEUtUVJERUstR0RKWjctVk9YVUw&inst=NzctNzIyMzAzOTM5LVNUMTJGT0krMS1ERFQrMC1TVDEyQVBQKzEtRVVMQSsx&prod=55&ver=2012.0.1809&mid=4cd741f9cc5a47d1ad161943ef6512fd-0cedc4f5a80b84a2fb832b7803eeed5bf8f31a12" [?]

.

c:\users\el\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\el\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-9-2 24183152]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableSecureUIAPaths"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)

.

[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer9"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0sdnclean64.exe\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"HPCam_Menu"="c:\program files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "c:\program files (x86)\Hewlett-Packard\Media\Webcam" UpdateWithCreateOnce "Software\Hewlett-Packard\Media\Webcam"

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"HP Software Update"=c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"

"NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"2353092.exe"="c:\windows\TEMP\2353092.exe"

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"CommonToolkitTray"=c:\program files (x86)\Fighters\Tray\FightersTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"FirewallOverride"=dword:00000001

"DisableThumbnailCache"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

.

R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [x]

R2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [x]

R2 gupdate;Услуга на Google Актуализация (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-13 136176]

R2 vToolbarUpdater;vToolbarUpdater;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [x]

R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [x]

R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys [x]

R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys [x]

R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys [x]

R3 AVFSFilter;AVFSFilter;c:\windows\system32\DRIVERS\avfsfilter.sys [x]

R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]

R3 gupdatem;Услуга на Google Актуализация (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-13 136176]

R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]

R4 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-06-21 85560]

R4 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-28 94264]

R4 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x]

S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [x]

S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]

S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [x]

S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [x]

S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [x]

S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [x]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]

S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]

S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [x]

S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2010/02/06 02:29];c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl [2009-10-17 04:47 146928]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\AESTSr64.exe [2010-11-10 89600]

S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]

S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 27136]

S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]

S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2011-01-28 632792]

S2 Suite Service;Suite Service;c:\program files (x86)\Fighters\FighterSuiteService.exe [2011-10-10 1318536]

S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2011-10-14 2072896]

S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2009-07-13 1924400]

S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x]

S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x]

S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]

S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [x]

S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]

S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [x]

S3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtpt64.sys [x]

S3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbs64.sys [x]

S3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmdm64.sys [x]

S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-10-13 11856]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

ezSharedSvc

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2009-08-20 21:24 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

.

2011-10-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4151207390-2366049724-2330981530-1001Core.job

- c:\users\el\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-24 14:48]

.

2011-10-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4151207390-2366049724-2330981530-1001UA.job

- c:\users\el\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-24 14:48]

.

2011-10-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-13 01:51]

.

2011-10-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-13 01:51]

.

2011-10-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4151207390-2366049724-2330981530-1001Core.job

- c:\users\el\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-26 19:50]

.

2011-10-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4151207390-2366049724-2330981530-1001UA.job

- c:\users\el\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-26 19:50]

.

2011-10-30 c:\windows\Tasks\HPCeeScheduleForel.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07 03:22]

.

2011-10-25 c:\windows\Tasks\Norton Security Scan for el.job

- c:\progra~2\NORTON~2\Engine\311~1.6\Nss.exe [2011-05-04 06:22]

.

2011-10-30 c:\windows\Tasks\RMSchedule.job

- c:\program files (x86)\Registry Mechanic\RegMech.exe [2011-10-30 09:02]

.

2011-09-08 c:\windows\Tasks\SidebarExecute.job

- c:\program files\Windows Sidebar\sidebar.exe [2011-06-07 13:25]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 97792 ----a-w- c:\users\el\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 97792 ----a-w- c:\users\el\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 97792 ----a-w- c:\users\el\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 97792 ----a-w- c:\users\el\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-29 16395880]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-11-10 487424]

"combofix"="c:\combofix\CF27236.3XE" [2010-11-20 345088]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x1

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.searchqu.com//406

uLocal Page = c:\windows\system32\blank.htm

uDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://home.sweetim.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

TCP: DhcpNameServer = 212.54.35.25 212.54.40.25

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)

Toolbar-{AF3D7884-B142-414E-943D-75D8D54E1FFF} - (no file)

Toolbar-10 - (no file)

Toolbar-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)

Wow6432Node-HKLM-Run-AVP - c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe

Wow6432Node-HKLM-Run-wxpdrv - c:\windows\services32.exe

Wow6432Node-HKLM-Run-tray_ico - (no file)

Wow6432Node-HKLM-Run-tray_ico0 - (no file)

Wow6432Node-HKLM-Run-tray_ico1 - (no file)

Wow6432Node-HKLM-Run-tray_ico2 - (no file)

Wow6432Node-HKLM-Run-tray_ico3 - (no file)

Wow6432Node-HKLM-Run-tray_ico4 - (no file)

Toolbar-10 - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - (no file)

WebBrowser-{AF3D7884-B142-414E-943D-75D8D54E1FFF} - (no file)

WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)

WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe

AddRemove-{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226} - c:\program files (x86)\InstallShield Installation Information\{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226}\setup.exe

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\AV Engine Scanning Service]

"ImagePath"="C:/Program Files (x86)/Common Files/Common Toolkit Suite/AVEngine/AVScanningService.exe"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\AV Watch Service]

"ImagePath"="C:/Program Files (x86)/Common Files/Common Toolkit Suite/AVEngine/AVWatchService.exe"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\AV Engine Scanning Service]

"ImagePath"="C:/Program Files (x86)/Common Files/Common Toolkit Suite/AVEngine/AVScanningService.exe"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\AV Watch Service]

"ImagePath"="C:/Program Files (x86)/Common Files/Common Toolkit Suite/AVEngine/AVWatchService.exe"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{55662437-DA8C-40c0-AADA-2C816A897A49}]

"ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\DigitalPersona\Bin\DpHostW.exe

c:\program files (x86)\Common Files\Common Toolkit Suite\AVEngine\AVScanningService.exe

c:\program files (x86)\Common Files\Common Toolkit Suite\AVEngine\AVWatchService.exe

c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe

c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files (x86)\CyberLink\Shared files\RichVideo.exe

c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

c:\program files (x86)\Citrix\ICA Client\wfcrun32.exe

c:\program files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

.

**************************************************************************

.

Completion time: 2011-10-30 22:41:50 - machine was rebooted

ComboFix-quarantined-files.txt 2011-10-30 21:41

.

Pre-Run: 359 353 090 048 bytes free

Post-Run: 358 855 520 256 bytes free

.

- - End Of File - - 4568EA8198C8D4D2CBD7596C074DE781

30 октомври 201114 г.

Така...иамме доста работа още:

*. Изтрийте вашето копие на Combofix и изтеглете ново оттук

*. Отворете notepad.exe и с copy/paste въведете следната информация:

http://www.kaldata.com/forums/index.php?showtopic=185961

Collect::
c:\windows\unrar.exe
c:\windows\TEMP\2353092.exe
Suspect::[4]
c:\windows\system32\authuitu.dll
c:\windows\SysWow64\authuitu.dll
Folder::
c:\windows\update.tray-12-0-lnk
c:\windows\update.tray-12-0
c:\windows\av_ico
c:\windows\update.tray-2-0-lnk
c:\windows\update.tray-2-0
Registry::
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"2353092.exe"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000000
"DisableThumbnailCache"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000000
RegLock::
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).

*. По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

*. По време на тази операция Combofix ще отвори диалогов прозорец. Със скрипта който изпълнихте той ще архивира и ще изпрати няколко файлове за анализ. Необходимо е да се свързан към Интеренет преди да натиснете OK. Ще се появи син прозорец чрез който вие можете да проследите цялата операция. Накарая ще получите съобщението "Upload was Successful".

*. Ако по някаква причина Combofix не успее да изпрати файловете (вижте снимката отдолу):

тогава просто кликнете върху файла C:\CF-Submit.htm и следвайте инструкциите за да го изпратите.

*. Когато Combofix приключи ще създаде лог файла. Моя, публикувайте този файл в следващия си пост.

Отворете virustotal и с бутона Browse намерете файла:

c:\windows\system32\authuitu.dll

Натиснете бутона SEND.

Ако файла вече е анализирам, моля натиснете re-analyse.

Публикувайте резултатите от проверката за този файл в следващия си коментар.

Повторете стъпките за този файл:

c:\windows\SysWow64\authuitu.dll

Имате куп останки от антивирусни програми и ненужни оптимизиращи програми.

Ще е добре след като приключим с почистването на гадинките, да ги премахнем и тях...

30 октомври 201114 г.

Автор

ComboFix 11-10-30.03 - el 10.2011 г. 23:16:47.2.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1251.359.1033.18.4023.2445 [GMT 1:00]

Running from: c:\users\el\Desktop\ComboFix.exe

Command switches used :: c:\users\el\Desktop\CFScript.txt

AV: VIRUSfighter *Disabled/Updated* {97C35F3D-E5DB-6C47-057E-0E55B391ED74}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\av_ico

c:\windows\av_ico\ico_NOD_AV_START.ico

c:\windows\av_ico\ico_NOD_SYSINSP.ico

c:\windows\av_ico\ico_NOD_SYSRESC.ico

c:\windows\av_ico\ico_NOD_TXT.ico

c:\windows\av_ico\ico_NOD_UNINSTALL.ico

c:\windows\system32\config\systemprofile\AppData\Local\aa4a3ccd\X

c:\windows\TEMP\zrnstn57.vbt

c:\windows\unrar.exe

c:\windows\update.tray-12-0-lnk

c:\windows\update.tray-12-0

c:\windows\update.tray-2-0-lnk

c:\windows\update.tray-2-0

.

((((((((((((((((((((((((( Files Created from 2011-09-28 to 2011-10-30 )))))))))))))))))))))))))))))))

.

2011-10-30 22:24 . 2011-10-30 22:24 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp

2011-10-30 22:24 . 2011-10-30 22:24 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-10-30 19:46 . 2011-10-30 19:46 -------- d-----w- c:\program files (x86)\Kaspersky Lab

2011-10-30 13:45 . 2011-10-30 14:15 -------- d-----w- c:\programdata\Systweak

2011-10-30 13:02 . 2011-10-14 15:37 34624 ----a-w- c:\windows\system32\TURegOpt.exe

2011-10-30 13:02 . 2011-10-14 15:37 25920 ----a-w- c:\windows\system32\authuitu.dll

2011-10-30 13:02 . 2011-10-14 15:37 21312 ------w- c:\windows\SysWow64\authuitu.dll