msker.exe has stopped working уйндоус 7

28 декември 201213 г.

Продължение от тази тема

http://www.kaldata.com/forums/topic/204555-ÐºÑÐ°Ð¹Ð½Ð¾-Ð´Ð¾ÑÐ°Ð´Ð½Ð¾-ÑÑÐ¾Ð±ÑÐµÐ½Ð¸Ðµ-Ð·Ð°-mskerexe-not-working/

Съобщението излиза на приблизителен интервал 10-15 мин. Никаква идея от какво се получава. Нямам такъв файл на харда, нод32 не открива нищо лошо.

DDS.txt:

DDS (Ver_2011-09-30.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 10.9.2Run by kelesh at 12:23:05 on 2012-12-28Microsoft Windows 7 Professional   6.1.7601.1.1251.359.1033.18.4091.2514 [GMT 2:00].AV: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}SP: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.============== Running Processes ===============.C:Windowssystem32wininit.exeC:Windowssystem32lsm.exeC:Windowssystem32svchost.exe -k DcomLaunchC:Windowssystem32svchost.exe -k RPCSSC:Windowssystem32atiesrxx.exeC:WindowsSystem32svchost.exe -k LocalServiceNetworkRestrictedC:WindowsSystem32svchost.exe -k LocalSystemNetworkRestrictedC:Windowssystem32svchost.exe -k netsvcsC:Windowssystem32svchost.exe -k GPSvcGroupC:WindowsservicingTrustedInstaller.exeC:Windowssystem32svchost.exe -k LocalServiceC:Windowssystem32svchost.exe -k NetworkServiceC:Windowssystem32svchost.exe -k LocalServiceNoNetworkC:Program FilesESETESET NOD32 Antivirusx86ekrn.exeC:Program FilesCommon FilesProtexisLicense ServicePsiService_2.exeC:Program Files (x86)TuneUp Utilities 2013TuneUpUtilitiesService64.exeC:Windowssystem32atieclxx.exeC:Windowssystem32taskhost.exeC:Program Files (x86)TuneUp Utilities 2013TuneUpUtilitiesApp64.exeC:Windowssystem32Dwm.exeC:WindowsExplorer.EXEC:Program FilesESETESET NOD32 Antivirusegui.exeC:WindowsPLFSetI.exeC:Program Files (x86)uTorrentuTorrent.exeC:UserskeleshAppDataRoamingMozillamscon.exeC:Program Files (x86)ATI TechnologiesATI.ACECore-StaticMOM.exeC:Program Files (x86)ATI TechnologiesATI.ACECore-StaticCCC.exeC:Windowssystem32svchost.exe -k LocalServiceAndNoImpersonationC:Program Files (x86)Mozilla Firefoxfirefox.exeC:WindowsMicrosoft.NetFramework64v3.0WPFPresentationFontCache.exeC:Windowssystem32sppsvc.exeC:WindowsSystem32svchost.exe -k secsvcsC:Windowssystem32wbemwmiprvse.exeC:Windowssystem32taskhost.exeC:Windowssystem32wbemwmiprvse.exeC:Windowssystem32conhost.exeC:WindowsSystem32cscript.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3220468uURLSearchHooks: {7473b6bd-4691-4744-a82b-7854eb3d70b6} - <orphaned>mWinlogon: Userinit = userinit.exeBHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:Program Files (x86)Common FilesAdobeAcrobatActiveXAcroIEHelperShim.dllBHO: FGCatchUrl: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:Program Files (x86)FlashGetjccatch.dllBHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:Program Files (x86)Microsoft OfficeOffice14GROOVEEX.DLLBHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program Files (x86)Javajre7binssv.dllBHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:Program Files (x86)Common FilesAdobeAcrobatActiveXAcroIEFavClient.dllBHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:Program Files (x86)Microsoft OfficeOffice14URLREDIR.DLLBHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program Files (x86)Javajre7binjp2ssv.dllBHO: FlashGet GetFlash Class: {F156768E-81EF-470C-9057-481BA8380DBA} - C:Program Files (x86)FlashGetgetflash.dllBHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:Program Files (x86)Common FilesAdobeAcrobatActiveXAcroIEFavClient.dllTB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:Program Files (x86)Common FilesAdobeAcrobatActiveXAcroIEFavClient.dlluRun: [uTorrent] "C:Program Files (x86)uTorrentuTorrent.exe"  /MINIMIZEDuRun: [DAEMON Tools Lite] "C:Program Files (x86)DAEMON Tools LiteDTLite.exe" -autorun                                                                                                                                                                                                           uRun: [PlayNC Launcher] <no file>mRun: [StartCCC] "C:Program Files (x86)ATI TechnologiesATI.ACECore-StaticCLIStart.exe" MSRunmRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:Program Files (x86)AMD AVTbinkdbsync.exe" amlmPolicies-Explorer: NoActiveDesktop = dword:1mPolicies-Explorer: NoActiveDesktopChanges = dword:1mPolicies-System: ConsentPromptBehaviorAdmin = dword:0mPolicies-System: ConsentPromptBehaviorUser = dword:3mPolicies-System: EnableLUA = dword:0mPolicies-System: EnableUIADesktopToggle = dword:0mPolicies-System: PromptOnSecureDesktop = dword:0IE: &Download All with FlashGet - C:PROGRA~2FlashGetjc_all.htmIE: &Download with FlashGet - C:PROGRA~2FlashGetjc_link.htmIE: E&xport to Microsoft Excel - C:PROGRA~1MICROS~1Office14EXCEL.EXE/3000IE: Se&nd to OneNote - C:PROGRA~1MICROS~1Office14ONBttnIE.dll/105IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:Program Files (x86)Microsoft OfficeOffice14ONBttnIE.dllIE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:Program Files (x86)Microsoft OfficeOffice14ONBttnIELinkedNotes.dllIE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:Program Files (x86)FlashGetFlashGet.exeTCP: NameServer = 192.168.0.1 192.168.0.1TCP: Interfaces{91D6D9DC-CA13-4B38-AC06-5D39C345A8CD} : DHCPNameServer = 192.168.0.1TCP: Interfaces{BA1881DC-1331-40BD-9B92-F48D09E72A77} : DHCPNameServer = 192.168.0.1 192.168.0.1Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:Program Files (x86)Common FilesMicrosoft SharedOFFICE14MSOXMLMF.DLLHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:Program Files (x86)Common FilesSkypeSkype4COM.dllSSODL: WebCheck - <orphaned>SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:Program Files (x86)Microsoft OfficeOffice14GROOVEEX.DLLIFEO: dtlite.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: excel.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: groove.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: infopath.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: misc.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:Program FilesMicrosoft OfficeOffice14GROOVEEX.DLLx64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:Program FilesMicrosoft OfficeOffice14URLREDIR.DLLx64-Run: [egui] "C:Program FilesESETESET NOD32 Antivirusegui.exe" /hide /waitservicex64-Run: [BCSSync] "C:Program FilesMicrosoft OfficeOffice14BCSSync.exe" /DelayServices                                                                                                                                                                                                  x64-Run: [PLFSetI] C:WindowsPLFSetI.exex64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:Program FilesMicrosoft OfficeOffice14ONBttnIE.dllx64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:Program FilesMicrosoft OfficeOffice14ONBttnIELinkedNotes.dllx64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:Program FilesCommon FilesMicrosoft SharedOFFICE14MSOXMLMF.DLLx64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>x64-SSODL: WebCheck - <orphaned>x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:Program FilesMicrosoft OfficeOffice14GROOVEEX.DLLx64-IFEO: dtlite.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: excel.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: groove.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: infopath.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: misc.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe".Note: multiple IFEO entries found. Please refer to Attach.txt.================= FIREFOX ===================.FF - ProfilePath - C:UserskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultFF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ncrFF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3220468&SearchSource=2&q=FF - plugin: C:PROGRA~2MICROS~1Office14NPAUTHZ.DLLFF - plugin: C:PROGRA~2MICROS~1Office14NPSPWRAP.DLLFF - plugin: C:Program Files (x86)AdobeAcrobat 10.0AcrobatAirnppdf32.dllFF - plugin: C:Program Files (x86)Foxit SoftwareFoxit ReaderpluginsnpFoxitReaderPlugin.dllFF - plugin: C:Program Files (x86)Javajre7binplugin2npjp2.dllFF - plugin: C:WindowsSysWOW64MacromedFlashNPSWF32_11_5_502_135.dllFF - plugin: C:WindowsSysWOW64npDeployJava1.dllFF - plugin: C:WindowsSysWOW64npmproxy.dll.---- FIREFOX POLICIES ----FF - user.js: network.http.max-persistent-connections-per-server - 4FF - user.js: nglayout.initialpaint.delay - 600FF - user.js: content.notify.interval - 600000FF - user.js: content.max.tokenizing.time - 1800000FF - user.js: content.switch.threshold - 600000.============= SERVICES / DRIVERS ===============.R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:WindowsSystem32driversdtsoftbus01.sys [2012-11-3 283200]R1 vwififlt;Virtual WiFi Filter Driver;C:WindowsSystem32driversvwififlt.sys [2009-7-14 59904]R2 AMD External Events Utility;AMD External Events Utility;C:WindowsSystem32atiesrxx.exe [2012-7-4 238080]R2 eamonm;eamonm;C:WindowsSystem32driverseamonm.sys [2011-8-9 202576]R2 ekrn;ESET Service;C:Program FilesESETESET NOD32 Antivirusx86ekrn.exe [2011-8-9 974944]R2 epfwwfpr;epfwwfpr;C:WindowsSystem32driversepfwwfpr.sys [2011-8-4 137144]R2 PSI_SVC_2_x64;Protexis Licensing V2 x64;C:Program FilesCommon FilesProtexisLicense ServicePsiService_2.exe [2010-11-30 336824]R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:Program Files (x86)TuneUp Utilities 2013TuneUpUtilitiesService64.exe [2012-9-17 2365792]R3 amdkmdag;amdkmdag;C:WindowsSystem32driversatikmdag.sys [2012-7-4 11922944]R3 amdkmdap;amdkmdap;C:WindowsSystem32driversatikmpag.sys [2012-7-4 359936]R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:WindowsSystem32driversAtihdW76.sys [2012-2-23 95760]R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;C:WindowsSystem32driversk57nd60a.sys [2009-6-10 270848]R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:Program Files (x86)TuneUp Utilities 2013TuneUpUtilitiesDriver64.sys [2012-8-29 11880]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [2012-7-9 104912]S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:WindowsMicrosoft.NETFramework64v4.0.30319mscorsvw.exe [2012-7-8 123856]S2 SkypeUpdate;Skype Updater;C:Program Files (x86)SkypeUpdaterUpdater.exe [2012-10-19 160944]S3 btusbflt;Bluetooth USB Filter;C:WindowsSystem32driversbtusbflt.sys [2012-11-4 52264]S3 dmvsc;dmvsc;C:WindowsSystem32driversdmvsc.sys [2011-4-12 71168]S3 ose64;Office 64 Source Engine;C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2010-1-9 174440]S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:WindowsSystem32driversrdpvideominiport.sys [2012-11-25 19456]S3 StorSvc;Storage Service;C:WindowsSystem32svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 27136]S3 SwitchBoard;SwitchBoard;C:Program Files (x86)Common FilesAdobeSwitchBoardSwitchBoard.exe [2010-2-19 517096]S3 TsUsbFlt;TsUsbFlt;C:WindowsSystem32driversTsUsbFlt.sys [2012-11-25 57856]S3 TsUsbGD;Remote Desktop Generic USB Device;C:WindowsSystem32driversTsUsbGD.sys [2012-11-25 30208]S3 WatAdminSvc;Windows Activation Technologies Service;C:WindowsSystem32WatWatAdminSvc.exe [2012-11-4 1255736]S4 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:Program FilesMicrosoft OfficeOffice14GROOVE.EXE [2010-3-25 51456888]S4 osppsvc;Office Software Protection Platform;C:Program FilesCommon FilesMicrosoft SharedOfficeSoftwareProtectionPlatformOSPPSVC.EXE [2010-1-9 4925184].=============== Created Last 30 ================.2012-12-28 08:46:49	9125352	----a-w-	C:ProgramDataMicrosoftWindows DefenderDefinition Updates{2C90EDD7-836D-4E14-91ED-6BDCFE2062A3}mpengine.dll2012-12-28 08:46:41	46080	----a-w-	C:WindowsSystem32atmlib.dll2012-12-28 08:46:41	367616	----a-w-	C:WindowsSystem32atmfd.dll2012-12-28 08:46:41	34304	----a-w-	C:WindowsSysWow64atmlib.dll2012-12-28 08:46:40	295424	----a-w-	C:WindowsSysWow64atmfd.dll2012-12-28 08:10:28	--------	d-----w-	C:UserskeleshAppDataLocalMacromedia2012-12-27 11:37:21	--------	d-----w-	C:WindowsSysWow64directx2012-12-25 15:34:36	--------	d-----w-	C:UserskeleshAppDataRoamingMight & Magic Heroes VI2012-12-24 17:27:38	--------	d-----w-	C:Program Files (x86)Password Unlocker2012-12-24 17:14:11	--------	d-----w-	C:Program Files (x86)RAR Password Unlocker2012-12-23 20:06:24	--------	d-----w-	C:UserskeleshAppDataRoamingLittle Inferno2012-12-20 18:58:55	--------	d-----w-	C:Program Files (x86)Retro City Rampage™2012-12-17 05:53:10	--------	d-----w-	C:ProgramDataLightmare Studio2012-12-14 18:00:38	--------	d-----w-	C:WindowsMigration2012-12-14 17:32:09	58368	----a-w-	C:WindowsSystem32ncobjapi.dll2012-12-14 17:32:09	46080	----a-w-	C:WindowsSysWow64ncobjapi.dll2012-12-14 17:32:08	74240	----a-w-	C:WindowsSystem32wbemNCProv.dll2012-12-14 17:29:10	2382848	----a-w-	C:WindowsSysWow64mshtml.tlb2012-12-14 17:28:59	887296	----a-w-	C:Program FilesInternet Exploreriedvtool.dll2012-12-14 17:28:59	678912	----a-w-	C:Program Files (x86)Internet Exploreriedvtool.dll2012-12-14 17:28:59	499200	----a-w-	C:Program FilesInternet Explorerjsdbgui.dll2012-12-14 17:28:59	387584	----a-w-	C:Program Files (x86)Internet Explorerjsdbgui.dll2012-12-14 17:28:32	2048	----a-w-	C:WindowsSysWow64tzres.dll2012-12-14 17:28:32	2048	----a-w-	C:WindowsSystem32tzres.dll2012-12-14 17:26:25	478208	----a-w-	C:WindowsSystem32dpnet.dll2012-12-14 17:26:25	376832	----a-w-	C:WindowsSysWow64dpnet.dll2012-12-09 09:16:37	--------	d-----w-	C:ProgramDataAlawar2012-12-09 09:09:07	--------	d-----w-	C:UserskeleshAppDataRoaming.mono2012-12-06 05:49:27	--------	d-----w-	C:Program Files (x86)LittleFighter22012-12-01 23:04:14	--------	d-----w-	C:UserskeleshAppDataLocalassembly2012-12-01 20:40:11	--------	d-----w-	C:ProgramDataSTORAGE.==================== Find3M  ====================.2012-12-23 18:57:53	73656	----a-w-	C:WindowsSysWow64FlashPlayerCPLApp.cpl2012-12-23 18:57:53	697272	----a-w-	C:WindowsSysWow64FlashPlayerApp.exe2012-11-25 09:45:37	319488	----a-w-	C:WindowsHideWin.exe2012-11-22 03:26:40	3149824	----a-w-	C:WindowsSystem32win32k.sys2012-11-14 06:11:44	2312704	----a-w-	C:WindowsSystem32jscript9.dll2012-11-14 06:04:11	1392128	----a-w-	C:WindowsSystem32wininet.dll2012-11-14 06:02:49	1494528	----a-w-	C:WindowsSystem32inetcpl.cpl2012-11-14 05:57:46	599040	----a-w-	C:WindowsSystem32vbscript.dll2012-11-14 05:57:35	173056	----a-w-	C:WindowsSystem32ieUnatt.exe2012-11-14 05:52:40	2382848	----a-w-	C:WindowsSystem32mshtml.tlb2012-11-14 02:09:22	1800704	----a-w-	C:WindowsSysWow64jscript9.dll2012-11-14 01:58:15	1427968	----a-w-	C:WindowsSysWow64inetcpl.cpl2012-11-14 01:57:37	1129472	----a-w-	C:WindowsSysWow64wininet.dll2012-11-14 01:49:25	142848	----a-w-	C:WindowsSysWow64ieUnatt.exe2012-11-14 01:48:27	420864	----a-w-	C:WindowsSysWow64vbscript.dll2012-11-04 11:36:28	95208	----a-w-	C:WindowsSysWow64WindowsAccessBridge-32.dll2012-11-04 11:36:16	821736	----a-w-	C:WindowsSysWow64npDeployJava1.dll2012-11-04 11:36:16	746984	----a-w-	C:WindowsSysWow64deployJava1.dll2012-11-03 19:42:43	283200	----a-w-	C:WindowsSystem32driversdtsoftbus01.sys2012-11-03 17:25:41	524288	----a-w-	C:WindowsRtlExUpd.dll2012-11-03 14:55:16	0	----a-w-	C:Windowsativpsrm.bin2012-10-16 08:38:37	135168	----a-w-	C:WindowsapppatchAppPatch64AcXtrnal.dll2012-10-16 08:38:34	350208	----a-w-	C:WindowsapppatchAppPatch64AcLayers.dll2012-10-16 07:39:52	561664	----a-w-	C:WindowsapppatchAcLayers.dll2012-10-09 18:17:13	55296	----a-w-	C:WindowsSystem32dhcpcsvc6.dll2012-10-09 18:17:13	226816	----a-w-	C:WindowsSystem32dhcpcore6.dll2012-10-09 17:40:31	44032	----a-w-	C:WindowsSysWow64dhcpcsvc6.dll2012-10-09 17:40:31	193536	----a-w-	C:WindowsSysWow64dhcpcore6.dll2012-10-04 17:46:16	362496	----a-w-	C:WindowsSystem32wow64win.dll2012-10-04 17:46:15	243200	----a-w-	C:WindowsSystem32wow64.dll2012-10-04 17:46:15	13312	----a-w-	C:WindowsSystem32wow64cpu.dll2012-10-04 17:45:55	215040	----a-w-	C:WindowsSystem32winsrv.dll2012-10-04 17:43:28	16384	----a-w-	C:WindowsSystem32ntvdm64.dll2012-10-04 17:41:16	424960	----a-w-	C:WindowsSystem32KernelBase.dll2012-10-04 16:47:41	5120	----a-w-	C:WindowsSysWow64wow32.dll2012-10-04 16:47:41	274944	----a-w-	C:WindowsSysWow64KernelBase.dll2012-10-04 15:21:55	338432	----a-w-	C:WindowsSystem32conhost.exe2012-10-04 14:46:46	7680	----a-w-	C:WindowsSysWow64instnm.exe2012-10-04 14:46:46	25600	----a-w-	C:WindowsSysWow64setup16.exe2012-10-04 14:46:44	14336	----a-w-	C:WindowsSysWow64ntvdm64.dll2012-10-04 14:46:43	2048	----a-w-	C:WindowsSysWow64user.exe2012-10-04 14:41:50	6144	---ha-w-	C:WindowsSysWow64api-ms-win-security-base-l1-1-0.dll2012-10-04 14:41:50	4608	---ha-w-	C:WindowsSysWow64api-ms-win-core-threadpool-l1-1-0.dll2012-10-04 14:41:50	3584	---ha-w-	C:WindowsSysWow64api-ms-win-core-xstate-l1-1-0.dll2012-10-04 14:41:50	3072	---ha-w-	C:WindowsSysWow64api-ms-win-core-util-l1-1-0.dll2012-10-03 17:56:54	1914248	----a-w-	C:WindowsSystem32driverstcpip.sys2012-10-03 17:44:21	70656	----a-w-	C:WindowsSystem32nlaapi.dll2012-10-03 17:44:21	303104	----a-w-	C:WindowsSystem32nlasvc.dll2012-10-03 17:44:17	246272	----a-w-	C:WindowsSystem32netcorehc.dll2012-10-03 17:44:17	18944	----a-w-	C:WindowsSystem32netevent.dll2012-10-03 17:44:16	216576	----a-w-	C:WindowsSystem32ncsi.dll2012-10-03 17:42:16	569344	----a-w-	C:WindowsSystem32iphlpsvc.dll2012-10-03 16:42:24	18944	----a-w-	C:WindowsSysWow64netevent.dll2012-10-03 16:42:24	175104	----a-w-	C:WindowsSysWow64netcorehc.dll2012-10-03 16:42:23	156672	----a-w-	C:WindowsSysWow64ncsi.dll2012-10-03 16:07:26	45568	----a-w-	C:WindowsSystem32driverstcpipreg.sys.============= FINISH: 12:23:35.24 ===============

Attach.txt:

.UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_2011-09-30.01).Microsoft Windows 7 Professional Boot Device: DeviceHarddiskVolume1Install Date: 03/11/2012 17:16:14System Uptime: 28/12/2012 12:15:43 (0 hours ago).Motherboard: Acer            |  | JV50                           Processor: Pentium(R) Dual-Core CPU       T4400  @ 2.20GHz | U2E1 | 2200/200mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 50 GiB total, 21.953 GiB free.D: is FIXED (NTFS) - 273 GiB total, 181.907 GiB free.E: is FIXED (NTFS) - 273 GiB total, 166.855 GiB free.F: is CDROM ()G: is CDROM ().==== Disabled Device Manager Items =============.==== System Restore Points ===================.No restore point in system..==== Image File Execution Options =============.IFEO: dtlite.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: excel.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: groove.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: infopath.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: misc.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: msaccess.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: msoxmled.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: mspub.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: mstore.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: ois.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: onenote.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: outlook.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: powerpnt.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: sptdinst-x64.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: unins000.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"IFEO: winword.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: dtlite.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: excel.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: groove.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: infopath.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: misc.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: msaccess.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: msoxmled.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: mspub.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: mstore.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: ois.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: onenote.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: outlook.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: powerpnt.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: sptdinst-x64.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: unins000.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe"x64-IFEO: winword.exe - "C:Program Files (x86)TuneUp Utilities 2013TUAutoReactivator64.exe".==== Installed Programs ======================.µTorrentAcer Crystal Eye WebcamAdobe Acrobat X Pro - English, RussianAdobe Flash Player 11 ActiveXAdobe Flash Player 11 PluginAdobe Photoshop CS6AIDA64 Extreme Edition v2.70AMD Accelerated Video TranscodingAMD APP CPU SDK RuntimeAMD APP KernelAnalyzerAMD APP ProfilerAMD APP SDK DeveloperAMD APP SDK RuntimeAMD APP SDK SamplesAMD Catalyst Install ManagerAMD Drag and Drop TranscodingAMD Media Foundation DecodersBeware Planet Earth! version 1.0.1Catalyst Control Center - BrandingCatalyst Control Center InstallProxyCatalyst Control Center Localization AllCatalyst Pro Control Centerccc-utility64CCC Help Chinese StandardCCC Help Chinese TraditionalCCC Help DutchCCC Help EnglishCCC Help FinnishCCC Help FrenchCCC Help HungarianCCC Help ItalianCCC Help JapaneseCCC Help KoreanCCC Help NorwegianCCC Help PolishCCC Help PortugueseCCC Help RussianCCC Help SpanishCCC Help SwedishCCC Help ThaiCCC Help TurkishCorel Graphics - Windows Shell ExtensionCorel Graphics - Windows Shell Extension 32 BitCorelDRAW Graphics Suite X6 - Capture (x64)CorelDRAW Graphics Suite X6 - Common (x64)CorelDRAW Graphics Suite X6 - Connect (x64)CorelDRAW Graphics Suite X6 - Custom Data (x64)CorelDRAW Graphics Suite X6 - Draw (x64)CorelDRAW Graphics Suite X6 - EN (x64)CorelDRAW Graphics Suite X6 - Filters (x64)CorelDRAW Graphics Suite X6 - FontNav (x64)CorelDRAW Graphics Suite X6 - IPMCorelDRAW Graphics Suite X6 - PHOTO-PAINT (x64)CorelDRAW Graphics Suite X6 - Photozoom Plugin (x64)CorelDRAW Graphics Suite X6 - Redist (x64)CorelDRAW Graphics Suite X6 - RU (x64)CorelDRAW Graphics Suite X6 - Setup Files (x64)CorelDRAW Graphics Suite X6 - VBA (x64)CorelDRAW Graphics Suite X6 - VideoBrowser (x64)CorelDRAW Graphics Suite X6 - VSTA (x64)CorelDRAW Graphics Suite X6 - Writing Tools (x64)CorelDRAW Graphics Suite X6 (64-Bit)CorelDRAW Graphics Suite X6 (x64)DAEMON Tools LiteDreamSpell v1.2ESET NOD32 AntivirusFaster Than LightFlashGet 1.9.6.1073Foxit ReaderHotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946040)Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946308)Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946344)Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947540)Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789)Java 7 Update 9Java Auto UpdaterK-Lite Codec Pack 9.4.0 (Standard)LibreOffice 3.6Little Fighter 2 version 2.0aMagickaMicrosoft .NET Framework 4.5Microsoft Office Access MUI (English) 2010Microsoft Office Access Setup Metadata MUI (English) 2010Microsoft Office Excel MUI (English) 2010Microsoft Office Groove MUI (English) 2010Microsoft Office InfoPath MUI (English) 2010Microsoft Office Office 32-bit Components 2010Microsoft Office OneNote MUI (English) 2010Microsoft Office Outlook MUI (English) 2010Microsoft Office PowerPoint MUI (English) 2010Microsoft Office Professional Plus 2010Microsoft Office Proof (English) 2010Microsoft Office Proof (French) 2010Microsoft Office Proof (Spanish) 2010Microsoft Office Proofing (English) 2010Microsoft Office Publisher MUI (English) 2010Microsoft Office Shared 32-bit MUI (English) 2010Microsoft Office Shared MUI (English) 2010Microsoft Office Shared Setup Metadata MUI (English) 2010Microsoft Office Word MUI (English) 2010Microsoft Visual Basic for Applications 7.1 (x64)Microsoft Visual Basic for Applications 7.1 (x64) EnglishMicrosoft Visual C++ 2005 RedistributableMicrosoft Visual C++ 2005 Redistributable (x64)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219Microsoft Visual Studio Tools for Applications 2.0 - ENUMicrosoft Visual Studio Tools for Applications 2.0 RuntimeMicrosoft XNA Framework Redistributable 3.1Microsoft_VC80_CRT_x86Microsoft_VC90_CRT_x86Might & Magic Heroes VIMinecraft 1.4.5Mozilla Firefox 17.0.1 (x86 en-US)NCsoft LauncherPDF Settings CS6RAR Password Unlocker 4.2.0.0Realtek AC'97 AudioRealtek USB 2.0 Card ReaderRetro City Rampage™ 1.06Skype™ 6.0The KMPlayer (remove only)TuneUp Utilities 2013TuneUp Utilities Language Pack (en-US)Ubisoft Game LauncherVLC media player 2.0.4WinampWinRAR 4.20 (64-bit)Yahoo! Detect.==== Event Viewer Messages From Past Week ========.28/12/2012 12:17:28, Error: Microsoft-Windows-WMPNSS-Service [14332]  - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80070422'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.28/12/2012 12:17:25, Error: Service Control Manager [7001]  - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error:  The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.28/12/2012 12:16:57, Error: Service Control Manager [7001]  - The Windows Image Acquisition (WIA) service depends on the Shell Hardware Detection service which failed to start because of the following error:  The service cannot be started, either because it is disabled or because it has no enabled devices associated with it..==== End Of File ===========================

Благодаря предварително!

28 декември 201213 г.

Здравейте,

Проверете този файл на VirusTotal и публикувайте резултатите:

C:UserskeleshAppDataRoamingMozillamscon.exe

Ако е бацилче, не го трийте (а го архивирайте и качете тук) и публикувайте линк за download в следващия си коментар.

28 декември 201213 г.

Автор

Това е от "AppCrash_msker.exe...", папка, която отваря на сърч от my computer, файл "Report.wer"

Version=1EventType=APPCRASHEventTime=130011650704839101ReportType=2Consent=1ReportIdentifier=8e90a0a8-50db-11e2-80c0-00262d89a6f1IntegratorReportIdentifier=8e90a0a7-50db-11e2-80c0-00262d89a6f1WOW64=1Response.type=4Sig[0].Name=Application NameSig[0].Value=msker.exeSig[1].Name=Application VersionSig[1].Value=0.0.0.0Sig[2].Name=Application TimestampSig[2].Value=50c71711Sig[3].Name=Fault Module NameSig[3].Value=StackHash_0a9eSig[4].Name=Fault Module VersionSig[4].Value=0.0.0.0Sig[5].Name=Fault Module TimestampSig[5].Value=00000000Sig[6].Name=Exception CodeSig[6].Value=c0000005Sig[7].Name=Exception OffsetSig[7].Value=00000000DynamicSig[1].Name=OS VersionDynamicSig[1].Value=6.1.7601.2.1.0.256.48DynamicSig[2].Name=Locale IDDynamicSig[2].Value=2057DynamicSig[22].Name=Additional Information 1DynamicSig[22].Value=0a9eDynamicSig[23].Name=Additional Information 2DynamicSig[23].Value=0a9e372d3b4ad19135b953a78882e789DynamicSig[24].Name=Additional Information 3DynamicSig[24].Value=0a9eDynamicSig[25].Name=Additional Information 4DynamicSig[25].Value=0a9e372d3b4ad19135b953a78882e789UI[2]=C:UserskeleshAppDataLocalTempjhpckjqmsker.exeUI[3]=msker.exe has stopped workingUI[4]=Windows can check online for a solution to the problem.UI[5]=Check online for a solution and close the programUI[6]=Check online for a solution later and close the programUI[7]=Close the programLoadedModule[0]=C:UserskeleshAppDataLocalTempjhpckjqmsker.exeLoadedModule[1]=C:WindowsSysWOW64ntdll.dllLoadedModule[2]=C:Windowssyswow64kernel32.dllLoadedModule[3]=C:Windowssyswow64KERNELBASE.dllLoadedModule[4]=C:UserskeleshAppDataLocalTempjhpckjqlibcurl.dllLoadedModule[5]=C:Windowssyswow64msvcrt.dllLoadedModule[6]=C:Windowssystem32WINMM.DLLLoadedModule[7]=C:Windowssyswow64USER32.dllLoadedModule[8]=C:Windowssyswow64GDI32.dllLoadedModule[9]=C:Windowssyswow64LPK.dllLoadedModule[10]=C:Windowssyswow64USP10.dllLoadedModule[11]=C:Windowssyswow64ADVAPI32.dllLoadedModule[12]=C:WindowsSysWOW64sechost.dllLoadedModule[13]=C:Windowssyswow64RPCRT4.dllLoadedModule[14]=C:Windowssyswow64SspiCli.dllLoadedModule[15]=C:Windowssyswow64CRYPTBASE.dllLoadedModule[16]=C:Windowssyswow64wldap32.dllLoadedModule[17]=C:Windowssyswow64WS2_32.dllLoadedModule[18]=C:Windowssyswow64NSI.dllLoadedModule[19]=C:UserskeleshAppDataLocalTempjhpckjqlibidn-11.dllLoadedModule[20]=C:UserskeleshAppDataLocalTempjhpckjqLIBEAY32.dllLoadedModule[21]=C:UserskeleshAppDataLocalTempjhpckjqSSLEAY32.dllLoadedModule[22]=C:UserskeleshAppDataLocalTempjhpckjqlibjansson-4.dllLoadedModule[23]=C:UserskeleshAppDataLocalTempjhpckjqlibpdcurses.dllLoadedModule[24]=C:UserskeleshAppDataLocalTempjhpckjqpthreadGC2.dllLoadedModule[25]=C:UserskeleshAppDataLocalTempjhpckjqlibblkmaker-0.1-0.dllLoadedModule[26]=C:UserskeleshAppDataLocalTempjhpckjqlibblkmaker_jansson-0.1-0.dllLoadedModule[27]=C:Windowssystem32IMM32.DLLLoadedModule[28]=C:Windowssyswow64MSCTF.dllLoadedModule[29]=C:Windowssystem32secur32.dllLoadedModule[30]=C:Windowssystem32mswsock.dllLoadedModule[31]=C:WindowsSystem32wshtcpip.dllLoadedModule[32]=C:Windowssystem32OpenCL.dllLoadedModule[33]=C:Windowssystem32amdocl.dllLoadedModule[34]=C:Windowssystem32OPENGL32.dllLoadedModule[35]=C:Windowssystem32GLU32.dllLoadedModule[36]=C:Windowssystem32DDRAW.dllLoadedModule[37]=C:Windowssystem32DCIMAN32.dllLoadedModule[38]=C:Windowssyswow64SETUPAPI.dllLoadedModule[39]=C:Windowssyswow64CFGMGR32.dllLoadedModule[40]=C:Windowssyswow64OLEAUT32.dllLoadedModule[41]=C:Windowssyswow64ole32.dllLoadedModule[42]=C:Windowssyswow64DEVOBJ.dllLoadedModule[43]=C:Windowssystem32dwmapi.dllLoadedModule[44]=C:Windowssystem32dbghelp.dllLoadedModule[45]=C:Windowssystem32atigktxx.dllLoadedModule[46]=C:Windowssystem32VERSION.dllLoadedModule[47]=C:Windowssyswow64WINTRUST.dllLoadedModule[48]=C:Windowssyswow64CRYPT32.dllLoadedModule[49]=C:Windowssyswow64MSASN1.dllFriendlyEventName=Stopped workingConsentKey=APPCRASHAppName=msker.exeAppPath=C:UserskeleshAppDataLocalTempjhpckjqmsker.exe

Резултата от virustotal е

5/46

Commtouch - W32/FakeAlert.FT.gen!Eldorado

F-Prot - W32/FakeAlert.FT.gen!Eldorado

K7AntiVirus - Riskware

Rising - Win32.Asim.a

TrendMicro-HouseCall - TROJ_GEN.R47H1LR

28 декември 201213 г.

архивирайте го и го качете тук и публикувайте линк за download в следващия си коментар.

28 декември 201213 г.

Автор

Линк към файла

Ако го изтрия няма ли да си реша проблема?

Редактирано 28 декември 201213 г. от B-boy[StyLe]
Скрит опасен линк. :) (преглед на промените)

28 декември 201213 г.

Нали трябва да видя какво точно прави файла...И затова го поисках. (само че в момента не съм у нас за да го анализирам).

Но ако ви даде го изтрийте...След това:

1. Изтеглете ComboFix от BleepingComputer
и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. Ако получите предупреждение от UAC, съгласете се.

5 ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

6 Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

Забележка: Ако се появи следното съобщение при отварянето на различни програми след завършване на сканирането с Combofix - "illegal operation on a registry key that has been marked for deletion." просто рестартирайте компютъра още веднъж и то ще изчезне.
По време на сканирането не използвайте компютъра си !

28 декември 201213 г.

Автор

ОК, сега ще пробвам и ще пиша.

Първо ще пробвам да изтрия файла.

28 декември 201213 г.

Автор

Резултата е, че изтрих файла след като му спрях процеса, пуснах ComboFix, рестартна се и лог файла е

ComboFix 12-12-28.02 - kelesh 28/12/2012  15:04:13.1.2 - x64Microsoft Windows 7 Professional   6.1.7601.1.1251.359.1033.18.4091.2737 [GMT 2:00]Running from: c:userskeleshDesktopComboFix.exeAV: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}SP: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point..(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))..c:userskeleshAppDataLocalassemblytmp..(((((((((((((((((((((((((   Files Created from 2012-11-28 to 2012-12-28  )))))))))))))))))))))))))))))))..2012-12-28 08:46 . 2012-11-08 17:24	9125352	----a-w-	c:programdataMicrosoftWindows DefenderDefinition Updates{2C90EDD7-836D-4E14-91ED-6BDCFE2062A3}mpengine.dll2012-12-28 08:46 . 2012-12-16 17:11	46080	----a-w-	c:windowssystem32atmlib.dll2012-12-28 08:46 . 2012-12-16 14:45	367616	----a-w-	c:windowssystem32atmfd.dll2012-12-28 08:46 . 2012-12-16 14:13	34304	----a-w-	c:windowsSysWow64atmlib.dll2012-12-28 08:46 . 2012-12-16 14:13	295424	----a-w-	c:windowsSysWow64atmfd.dll2012-12-28 08:10 . 2012-12-28 08:10	--------	d-----w-	c:userskeleshAppDataLocalMacromedia2012-12-25 15:34 . 2012-12-26 11:04	--------	d-----w-	c:userskeleshAppDataRoamingMight & Magic Heroes VI2012-12-24 21:31 . 2012-12-24 21:31	--------	d-----w-	c:program files (x86)Ubisoft2012-12-24 17:27 . 2012-12-25 15:31	--------	d-----w-	c:program files (x86)Password Unlocker2012-12-24 17:14 . 2012-12-24 17:14	--------	d-----w-	c:program files (x86)RAR Password Unlocker2012-12-23 20:06 . 2012-12-27 11:38	--------	d-----w-	c:userskeleshAppDataRoamingLittle Inferno2012-12-20 18:58 . 2012-12-20 18:58	--------	d-----w-	c:program files (x86)Retro City Rampage™2012-12-17 05:53 . 2012-12-17 05:53	--------	d-----w-	c:programdataLightmare Studio2012-12-14 18:00 . 2012-12-14 18:00	--------	d-----w-	c:windowsMigration2012-12-14 17:32 . 2012-08-21 14:20	46080	----a-w-	c:windowsSysWow64ncobjapi.dll2012-12-14 17:32 . 2012-08-21 13:49	58368	----a-w-	c:windowssystem32ncobjapi.dll2012-12-14 17:32 . 2012-08-21 13:12	74240	----a-w-	c:windowssystem32wbemNCProv.dll2012-12-14 17:29 . 2012-11-14 05:52	2382848	----a-w-	c:windowssystem32mshtml.tlb2012-12-14 17:28 . 2012-11-14 06:06	887296	----a-w-	c:program filesInternet Exploreriedvtool.dll2012-12-14 17:28 . 2012-11-14 06:06	499200	----a-w-	c:program filesInternet Explorerjsdbgui.dll2012-12-14 17:28 . 2012-11-14 02:01	678912	----a-w-	c:program files (x86)Internet Exploreriedvtool.dll2012-12-14 17:28 . 2012-11-14 02:00	387584	----a-w-	c:program files (x86)Internet Explorerjsdbgui.dll2012-12-14 17:28 . 2012-11-14 07:06	17811968	----a-w-	c:windowssystem32mshtml.dll2012-12-14 17:28 . 2012-11-14 06:32	10925568	----a-w-	c:windowssystem32ieframe.dll2012-12-14 17:28 . 2012-11-09 05:45	2048	----a-w-	c:windowssystem32tzres.dll2012-12-14 17:28 . 2012-11-09 04:42	2048	----a-w-	c:windowsSysWow64tzres.dll2012-12-14 17:26 . 2012-11-02 05:59	478208	----a-w-	c:windowssystem32dpnet.dll2012-12-14 17:26 . 2012-11-02 05:11	376832	----a-w-	c:windowsSysWow64dpnet.dll2012-12-09 09:16 . 2012-12-09 09:16	--------	d-----w-	c:programdataAlawar2012-12-09 09:09 . 2012-12-09 09:09	--------	d-----w-	c:userskeleshAppDataRoaming.mono2012-12-06 05:49 . 2012-12-06 05:49	--------	d-----w-	c:program files (x86)LittleFighter22012-12-01 23:04 . 2012-12-28 13:09	--------	d-----w-	c:userskeleshAppDataLocalassembly2012-12-01 20:40 . 2012-12-01 20:40	--------	d-----w-	c:programdataSTORAGE2012-11-30 16:55 . 2012-11-30 16:55	--------	d-----w-	c:windowsSun...((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2012-12-23 18:57 . 2012-11-03 16:09	73656	----a-w-	c:windowsSysWow64FlashPlayerCPLApp.cpl2012-12-23 18:57 . 2012-11-03 16:09	697272	----a-w-	c:windowsSysWow64FlashPlayerApp.exe2012-11-25 09:45 . 2012-11-03 18:17	319488	----a-w-	c:windowsHideWin.exe2012-11-04 11:36 . 2012-11-04 11:36	95208	----a-w-	c:windowsSysWow64WindowsAccessBridge-32.dll2012-11-04 11:36 . 2012-11-04 11:36	821736	----a-w-	c:windowsSysWow64npDeployJava1.dll2012-11-04 11:36 . 2012-11-04 11:36	746984	----a-w-	c:windowsSysWow64deployJava1.dll2012-11-03 19:42 . 2012-11-03 19:42	283200	----a-w-	c:windowssystem32driversdtsoftbus01.sys2012-11-03 17:25 . 2012-11-03 18:30	524288	----a-w-	c:windowsRtlExUpd.dll2012-10-16 08:38 . 2012-12-06 18:03	135168	----a-w-	c:windowsapppatchAppPatch64AcXtrnal.dll2012-10-16 08:38 . 2012-12-06 18:03	350208	----a-w-	c:windowsapppatchAppPatch64AcLayers.dll2012-10-16 07:39 . 2012-12-06 18:03	561664	----a-w-	c:windowsapppatchAcLayers.dll2012-10-09 18:17 . 2012-11-25 09:32	55296	----a-w-	c:windowssystem32dhcpcsvc6.dll2012-10-09 18:17 . 2012-11-25 09:32	226816	----a-w-	c:windowssystem32dhcpcore6.dll2012-10-09 17:40 . 2012-11-25 09:32	44032	----a-w-	c:windowsSysWow64dhcpcsvc6.dll2012-10-09 17:40 . 2012-11-25 09:32	193536	----a-w-	c:windowsSysWow64dhcpcore6.dll2012-10-04 16:40 . 2012-12-14 17:27	44032	----a-w-	c:windowsapppatchacwow64.dll2012-10-03 17:56 . 2012-11-25 09:31	1914248	----a-w-	c:windowssystem32driverstcpip.sys2012-10-03 17:44 . 2012-11-25 09:31	303104	----a-w-	c:windowssystem32nlasvc.dll2012-10-03 17:44 . 2012-11-25 09:31	70656	----a-w-	c:windowssystem32nlaapi.dll2012-10-03 17:44 . 2012-11-25 09:31	246272	----a-w-	c:windowssystem32netcorehc.dll2012-10-03 17:44 . 2012-11-25 09:31	18944	----a-w-	c:windowssystem32netevent.dll2012-10-03 17:44 . 2012-11-25 09:31	216576	----a-w-	c:windowssystem32ncsi.dll2012-10-03 17:42 . 2012-11-25 09:31	569344	----a-w-	c:windowssystem32iphlpsvc.dll2012-10-03 16:42 . 2012-11-25 09:31	175104	----a-w-	c:windowsSysWow64netcorehc.dll2012-10-03 16:42 . 2012-11-25 09:31	18944	----a-w-	c:windowsSysWow64netevent.dll2012-10-03 16:42 . 2012-11-25 09:31	156672	----a-w-	c:windowsSysWow64ncsi.dll2012-10-03 16:07 . 2012-11-25 09:31	45568	----a-w-	c:windowssystem32driverstcpipreg.sys..------- Sigcheck -------Note: Unsigned files aren't necessarily malware..[-] 2012-09-11 . 13F5B1E5F1585ECEF05C9F944EB186EF . 2388992 . . [6.1.7600.16385] .. c:windowsexplorer.exe[7] 2012-09-11 . 332FEAB1435662FC6C672E25BEB37BE3 . 2871808 . . [6.1.7600.16385] .. c:windowswinsxsamd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0baexplorer.exe[7] 2012-09-11 . 3B69712041F3D63605529BD66DC00C48 . 2871808 . . [6.1.7600.16385] .. c:windowswinsxsamd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332explorer.exe[7] 2010-11-21 . AC4C51EB24AA95B77F705AB159189E24 . 2872320 . . [6.1.7600.16385] .. c:windowswinsxsamd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900explorer.exe.(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]"uTorrent"="c:program files (x86)uTorrentuTorrent.exe" [2012-12-09 969104]"DAEMON Tools Lite"="c:program files (x86)DAEMON Tools LiteDTLite.exe" [2012-08-28 3671904].[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun]"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]"StartCCC"="c:program files (x86)ATI TechnologiesATI.ACECore-StaticCLIStart.exe" [2012-07-04 641704].[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]"ConsentPromptBehaviorAdmin"= 0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableLUA"= 0 (0x0)"EnableUIADesktopToggle"= 0 (0x0)"PromptOnSecureDesktop"= 0 (0x0).[HKEY_LOCAL_MACHINEsoftwarewow6432nodemicrosoftwindowscurrentversionrun-]"SunJavaUpdateSched"="c:program files (x86)Common FilesJavaJava Updatejusched.exe""Adobe Acrobat Speed Launcher"="c:program files (x86)AdobeAcrobat 10.0AcrobatAcrobat_sl.exe""Adobe ARM"="c:program files (x86)Common FilesAdobeARM1.0AdobeARM.exe""Acrobat Assistant 8.0"="c:program files (x86)AdobeAcrobat 10.0AcrobatAcrotray.exe""AdobeCS6ServiceManager"="c:program files (x86)Common FilesAdobeCS6ServiceManagerCS6ServiceManager.exe" -launchedbylogin"SwitchBoard"=c:program files (x86)Common FilesAdobeSwitchBoardSwitchBoard.exe.R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:windowsMicrosoft.NETFramework64v4.0.30319mscorsvw.exe [2012-07-08 123856]R2 SkypeUpdate;Skype Updater;c:program files (x86)SkypeUpdaterUpdater.exe [2012-10-19 160944]R3 btusbflt;Bluetooth USB Filter;c:windowssystem32driversbtusbflt.sys [2009-07-02 52264]R3 dmvsc;dmvsc;c:windowssystem32driversdmvsc.sys [2010-11-21 71168]R3 ose64;Office 64 Source Engine;c:program filesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2010-01-09 174440]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [2012-08-23 19456]R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:windowssystem32DriversRtsUStor.sys [x]R3 RtsUIR;Realtek IR Driver;c:windowssystem32DRIVERSRts516xIR.sys [x]R3 SwitchBoard;SwitchBoard;c:program files (x86)Common FilesAdobeSwitchBoardSwitchBoard.exe [2010-02-19 517096]R3 TsUsbFlt;TsUsbFlt;c:windowssystem32driverstsusbflt.sys [2012-08-23 57856]R3 TsUsbGD;Remote Desktop Generic USB Device;c:windowssystem32driversTsUsbGD.sys [2012-08-23 30208]R3 WatAdminSvc;Windows Activation Technologies Service;c:windowssystem32WatWatAdminSvc.exe [2012-11-04 1255736]S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32DRIVERSdtsoftbus01.sys [2012-11-03 283200]S1 ehdrv;ehdrv;c:windowssystem32DRIVERSehdrv.sys [2011-08-04 146432]S2 AMD External Events Utility;AMD External Events Utility;c:windowssystem32atiesrxx.exe [2012-07-04 238080]S2 eamonm;eamonm;c:windowssystem32DRIVERSeamonm.sys [2011-08-09 202576]S2 ekrn;ESET Service;c:program filesESETESET NOD32 Antivirusx86ekrn.exe [2011-08-09 974944]S2 epfwwfpr;epfwwfpr;c:windowssystem32DRIVERSepfwwfpr.sys [2011-08-04 137144]S2 PSI_SVC_2_x64;Protexis Licensing V2 x64;c:program filesCommon FilesProtexisLicense ServicePsiService_2.exe [2010-11-30 336824]S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:program files (x86)TuneUp Utilities 2013TuneUpUtilitiesService64.exe [2012-09-17 2365792]S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:windowssystem32driversAtihdW76.sys [2012-02-23 95760]S3 k57nd60a;Broadcom NetLink  Gigabit Ethernet - NDIS 6.0;c:windowssystem32DRIVERSk57nd60a.sys [2009-06-10 270848]S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:program files (x86)TuneUp Utilities 2013TuneUpUtilitiesDriver64.sys [2012-08-29 11880]..--- Other Services/Drivers In Memory ---.*NewlyCreated* - WS2IFSL..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]"egui"="c:program filesESETESET NOD32 Antivirusegui.exe" [2011-08-09 4030008]"BCSSync"="c:program filesMicrosoft OfficeOffice14BCSSync.exe" [2010-03-13 112512]"PLFSetI"="c:windowsPLFSetI.exe" [2008-07-29 200704].HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost  - NetSvcsUxTuneUp.------- Supplementary Scan -------.uLocal Page = c:windowssystem32blank.htmuStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3220468mLocal Page = c:windowsSysWOW64blank.htmIE: &Download All with FlashGet - c:progra~2FlashGetjc_all.htmIE: &Download with FlashGet - c:progra~2FlashGetjc_link.htmIE: E&xport to Microsoft Excel - c:progra~1MICROS~1Office14EXCEL.EXE/3000IE: Se&nd to OneNote - c:progra~1MICROS~1Office14ONBttnIE.dll/105TCP: DhcpNameServer = 192.168.0.1 192.168.0.1FF - ProfilePath - c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultFF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ncrFF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3220468&SearchSource=2&q=FF - ExtSQL: 2012-11-03 18:46; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensions{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpiFF - ExtSQL: 2012-11-03 18:47; {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensions{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpiFF - ExtSQL: 2012-11-03 22:46; {7f57cf46-4467-4c2d-adfa-0cba7c507e54}; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensions{7f57cf46-4467-4c2d-adfa-0cba7c507e54}.xpiFF - ExtSQL: 2012-11-04 11:25; [email protected]; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensionsfirefox@ghostery.comFF - ExtSQL: 2012-11-05 07:53; [email protected]; c:program files (x86)AdobeAcrobat 10.0AcrobatBrowserWCFirefoxExtnFF - ExtSQL: 2012-11-22 20:49; {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensions{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpiFF - ExtSQL: 2012-11-22 20:51; [email protected]; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensionsyoutube2mp3@mondayx.de.xpiFF - ExtSQL: 2012-11-24 16:08; {bee6eb20-01e0-ebd1-da83-080329fb9a3a}; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensions{bee6eb20-01e0-ebd1-da83-080329fb9a3a}FF - ExtSQL: 2012-11-24 16:11; {b9db16a4-6edc-47ec-a1f4-b86292ed211d}; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensions{b9db16a4-6edc-47ec-a1f4-b86292ed211d}FF - user.js: network.http.max-persistent-connections-per-server - 4FF - user.js: nglayout.initialpaint.delay - 600FF - user.js: content.notify.interval - 600000FF - user.js: content.max.tokenizing.time - 1800000FF - user.js: content.switch.threshold - 600000.- - - - ORPHANS REMOVED - - - -.URLSearchHooks-{7473b6bd-4691-4744-a82b-7854eb3d70b6} - (no file)Wow6432Node-HKCU-Run-PlayNC Launcher - (no file)Wow6432Node-HKCU-Run-Integrated Driver - c:userskeleshAppDataRoamingMozillamscon.exeWow6432Node-HKLM-Run-<NO NAME> - (no file)...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:Windowssystem32MacromedFlashFlashUtil64_11_4_402_287_ActiveX.exe,-101".[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}LocalServer32]@="c:Windowssystem32MacromedFlashFlashUtil64_11_4_402_287_ActiveX.exe".[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:WindowsSysWOW64MacromedFlashFlashUtil32_11_4_402_287_ActiveX.exe,-101".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}LocalServer32]@="c:WindowsSysWOW64MacromedFlashFlashUtil32_11_4_402_287_ActiveX.exe".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}InprocServer32]@="c:WindowsSysWOW64MacromedFlashFlash32_11_4_402_287.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}MiscStatus]@="0".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}ProgID]@="ShockwaveFlash.ShockwaveFlash.11".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}ToolboxBitmap32]@="c:WindowsSysWOW64MacromedFlashFlash32_11_4_402_287.ocx, 1".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}Version]@="1.0".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}InprocServer32]@="c:WindowsSysWOW64MacromedFlashFlash32_11_4_402_287.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}ToolboxBitmap32]@="c:WindowsSysWOW64MacromedFlashFlash32_11_4_402_287.ocx, 1".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}Version]@="1.0".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINESOFTWAREClassesVideoLAN.VLCPlugin.*1*]@="?????????????????? v1".[HKEY_LOCAL_MACHINESOFTWAREClassesVideoLAN.VLCPlugin.*1*CLSID]@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}".[HKEY_LOCAL_MACHINESOFTWAREClassesVideoLAN.VLCPlugin.*2*]@="?????????????????? v2".[HKEY_LOCAL_MACHINESOFTWAREClassesVideoLAN.VLCPlugin.*2*CLSID]@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}".[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000"MSCurrentCountry"=dword:000000b5.[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlPCWSecurity]@Denied: (Full) (Everyone).------------------------ Other Running Processes ------------------------.c:program files (x86)Winampwinamp.exe.**************************************************************************.Completion time: 2012-12-28  15:28:21 - machine was rebootedComboFix-quarantined-files.txt  2012-12-28 13:28.Pre-Run: 23,526,981,632 bytes freePost-Run: 23,448,731,648 bytes free.- - End Of File - - F006885A3CF256663E7F5BEC40C8A151

По едно време преди рестарта ми даде deleting folders:

c:userskeleshappdatalocalassemblytmp

28 декември 201213 г.

Извинявам се за забавянето, но бях на работа досега. Отделно за капак си свалих вируса на флашката, която забравих в офиса и тази вечер не мога да го анализирам...а изтрих линка от вашия пост за да не се заради някой случаен потребител. Поне Combofix е изтрил някои от остатъците. Сега:

Моля натиснете Start Menu > All Programs > Accessories,кликнете с десен бутон върху Command Prompt и изберете "run as administrator".

С copy/paste въведете командата и натиснете Enter след нея за да я потвърдите.

sfc.exe /scanfile=c:windowsexplorer.exe

findstr /c:"[sR]" %windir%LogsCBSCBS.log >"%userprofile%Desktopsfcdetails.txt"

Ще се появи тесктов файл с името sfcdetails.txt на десктопа.

Прикачете съдържанието му в следващия си пост.

Рестартирайте компютъра за да се извършат необходимите промени (ако е необходимо).

[*]Отворете

notepad и с copy/paste въведете следната информация).

Folder::C:UserskeleshAppDataLocalTempjhpckjqDirLook::c:userskeleshAppDataLocalassemblyDDS::uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3220468Firefox::FF - ProfilePath - c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultFF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3220468&SearchSource=2&q=

[*]Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).

[*]По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката! [*]Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

29 декември 201213 г.

Автор

След първата команда трябваше да го рестартирам, след ComboFix - не. Ето ги и лог файловете:

sfcdetails.txt

2012-12-29 09:43:42, Info                  CSI    00000009 [SR] Verifying 1 components2012-12-29 09:43:42, Info                  CSI    0000000a [SR] Beginning Verify and Repair transaction2012-12-29 09:43:43, Info                  CSI    0000000c [SR] Repairing corrupted file [ml:520{260},l:28{14}]"??C:Windows"[l:24{12}]"explorer.exe" from store2012-12-29 09:43:43, Info                  CSI    0000000e [SR] Verify complete2012-12-29 09:43:43, Info                  CSI    0000000f [SR] Repairing 1 components2012-12-29 09:43:43, Info                  CSI    00000010 [SR] Beginning Verify and Repair transaction2012-12-29 09:43:43, Info                  CSI    00000012 [SR] Repairing corrupted file [ml:520{260},l:28{14}]"??C:Windows"[l:24{12}]"explorer.exe" from store2012-12-29 09:43:43, Info                  CSI    00000014 [SR] Repair complete2012-12-29 09:43:43, Info                  CSI    00000015 [SR] Committing transaction2012-12-29 09:43:43, Info                  CSI    00000019 [SR] Unable to complete Verify and Repair transaction because some of the files that need to be repaired are in use. A reboot is required to complete this operation.2012-12-29 09:43:43, Info                  CSI    0000001a [SR] Repairing 1 components2012-12-29 09:43:43, Info                  CSI    0000001b [SR] Beginning Verify and Repair transaction2012-12-29 09:43:43, Info                  CSI    0000001d [SR] Repairing corrupted file [ml:520{260},l:28{14}]"??C:Windows"[l:24{12}]"explorer.exe" from store2012-12-29 09:43:43, Info                  CSI    0000001f [SR] Repair complete

log.txt от ComboFix

ComboFix 12-12-29.02 - kelesh 29/12/2012  10:00:47.2.2 - x64Microsoft Windows 7 Professional   6.1.7601.1.1251.359.1033.18.4091.2817 [GMT 2:00]Running from: c:userskeleshDesktopComboFix.exeCommand switches used :: c:userskeleshDesktopCFScript.txtAV: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}SP: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point..(((((((((((((((((((((((((   Files Created from 2012-11-28 to 2012-12-29  )))))))))))))))))))))))))))))))..2012-12-29 08:05 . 2012-12-29 08:05	--------	d-----w-	c:usersDefaultAppDataLocaltemp2012-12-28 08:46 . 2012-11-08 17:24	9125352	----a-w-	c:programdataMicrosoftWindows DefenderDefinition Updates{2C90EDD7-836D-4E14-91ED-6BDCFE2062A3}mpengine.dll2012-12-28 08:46 . 2012-12-16 17:11	46080	----a-w-	c:windowssystem32atmlib.dll2012-12-28 08:46 . 2012-12-16 14:45	367616	----a-w-	c:windowssystem32atmfd.dll2012-12-28 08:46 . 2012-12-16 14:13	34304	----a-w-	c:windowsSysWow64atmlib.dll2012-12-28 08:46 . 2012-12-16 14:13	295424	----a-w-	c:windowsSysWow64atmfd.dll2012-12-28 08:10 . 2012-12-28 08:10	--------	d-----w-	c:userskeleshAppDataLocalMacromedia2012-12-25 15:34 . 2012-12-26 11:04	--------	d-----w-	c:userskeleshAppDataRoamingMight & Magic Heroes VI2012-12-24 21:31 . 2012-12-24 21:31	--------	d-----w-	c:program files (x86)Ubisoft2012-12-24 17:27 . 2012-12-25 15:31	--------	d-----w-	c:program files (x86)Password Unlocker2012-12-24 17:14 . 2012-12-24 17:14	--------	d-----w-	c:program files (x86)RAR Password Unlocker2012-12-23 20:06 . 2012-12-27 11:38	--------	d-----w-	c:userskeleshAppDataRoamingLittle Inferno2012-12-20 18:58 . 2012-12-20 18:58	--------	d-----w-	c:program files (x86)Retro City Rampage™2012-12-17 05:53 . 2012-12-17 05:53	--------	d-----w-	c:programdataLightmare Studio2012-12-14 18:00 . 2012-12-14 18:00	--------	d-----w-	c:windowsMigration2012-12-14 17:32 . 2012-08-21 14:20	46080	----a-w-	c:windowsSysWow64ncobjapi.dll2012-12-14 17:32 . 2012-08-21 13:49	58368	----a-w-	c:windowssystem32ncobjapi.dll2012-12-14 17:32 . 2012-08-21 13:12	74240	----a-w-	c:windowssystem32wbemNCProv.dll2012-12-14 17:29 . 2012-11-14 05:52	2382848	----a-w-	c:windowssystem32mshtml.tlb2012-12-14 17:28 . 2012-11-14 06:06	887296	----a-w-	c:program filesInternet Exploreriedvtool.dll2012-12-14 17:28 . 2012-11-14 06:06	499200	----a-w-	c:program filesInternet Explorerjsdbgui.dll2012-12-14 17:28 . 2012-11-14 02:01	678912	----a-w-	c:program files (x86)Internet Exploreriedvtool.dll2012-12-14 17:28 . 2012-11-14 02:00	387584	----a-w-	c:program files (x86)Internet Explorerjsdbgui.dll2012-12-14 17:28 . 2012-11-14 07:06	17811968	----a-w-	c:windowssystem32mshtml.dll2012-12-14 17:28 . 2012-11-14 06:32	10925568	----a-w-	c:windowssystem32ieframe.dll2012-12-14 17:28 . 2012-11-09 05:45	2048	----a-w-	c:windowssystem32tzres.dll2012-12-14 17:28 . 2012-11-09 04:42	2048	----a-w-	c:windowsSysWow64tzres.dll2012-12-14 17:26 . 2012-11-02 05:59	478208	----a-w-	c:windowssystem32dpnet.dll2012-12-14 17:26 . 2012-11-02 05:11	376832	----a-w-	c:windowsSysWow64dpnet.dll2012-12-09 09:16 . 2012-12-09 09:16	--------	d-----w-	c:programdataAlawar2012-12-09 09:09 . 2012-12-09 09:09	--------	d-----w-	c:userskeleshAppDataRoaming.mono2012-12-06 05:49 . 2012-12-06 05:49	--------	d-----w-	c:program files (x86)LittleFighter22012-12-01 23:04 . 2012-12-28 13:09	--------	d-----w-	c:userskeleshAppDataLocalassembly2012-12-01 20:40 . 2012-12-01 20:40	--------	d-----w-	c:programdataSTORAGE2012-11-30 16:55 . 2012-11-30 16:55	--------	d-----w-	c:windowsSun...((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2012-12-23 18:57 . 2012-11-03 16:09	73656	----a-w-	c:windowsSysWow64FlashPlayerCPLApp.cpl2012-12-23 18:57 . 2012-11-03 16:09	697272	----a-w-	c:windowsSysWow64FlashPlayerApp.exe2012-11-25 09:45 . 2012-11-03 18:17	319488	----a-w-	c:windowsHideWin.exe2012-11-04 11:36 . 2012-11-04 11:36	95208	----a-w-	c:windowsSysWow64WindowsAccessBridge-32.dll2012-11-04 11:36 . 2012-11-04 11:36	821736	----a-w-	c:windowsSysWow64npDeployJava1.dll2012-11-04 11:36 . 2012-11-04 11:36	746984	----a-w-	c:windowsSysWow64deployJava1.dll2012-11-03 19:42 . 2012-11-03 19:42	283200	----a-w-	c:windowssystem32driversdtsoftbus01.sys2012-11-03 17:25 . 2012-11-03 18:30	524288	----a-w-	c:windowsRtlExUpd.dll2012-10-16 08:38 . 2012-12-06 18:03	135168	----a-w-	c:windowsapppatchAppPatch64AcXtrnal.dll2012-10-16 08:38 . 2012-12-06 18:03	350208	----a-w-	c:windowsapppatchAppPatch64AcLayers.dll2012-10-16 07:39 . 2012-12-06 18:03	561664	----a-w-	c:windowsapppatchAcLayers.dll2012-10-09 18:17 . 2012-11-25 09:32	55296	----a-w-	c:windowssystem32dhcpcsvc6.dll2012-10-09 18:17 . 2012-11-25 09:32	226816	----a-w-	c:windowssystem32dhcpcore6.dll2012-10-09 17:40 . 2012-11-25 09:32	44032	----a-w-	c:windowsSysWow64dhcpcsvc6.dll2012-10-09 17:40 . 2012-11-25 09:32	193536	----a-w-	c:windowsSysWow64dhcpcore6.dll2012-10-04 16:40 . 2012-12-14 17:27	44032	----a-w-	c:windowsapppatchacwow64.dll2012-10-03 17:56 . 2012-11-25 09:31	1914248	----a-w-	c:windowssystem32driverstcpip.sys2012-10-03 17:44 . 2012-11-25 09:31	303104	----a-w-	c:windowssystem32nlasvc.dll2012-10-03 17:44 . 2012-11-25 09:31	70656	----a-w-	c:windowssystem32nlaapi.dll2012-10-03 17:44 . 2012-11-25 09:31	246272	----a-w-	c:windowssystem32netcorehc.dll2012-10-03 17:44 . 2012-11-25 09:31	18944	----a-w-	c:windowssystem32netevent.dll2012-10-03 17:44 . 2012-11-25 09:31	216576	----a-w-	c:windowssystem32ncsi.dll2012-10-03 17:42 . 2012-11-25 09:31	569344	----a-w-	c:windowssystem32iphlpsvc.dll2012-10-03 16:42 . 2012-11-25 09:31	175104	----a-w-	c:windowsSysWow64netcorehc.dll2012-10-03 16:42 . 2012-11-25 09:31	18944	----a-w-	c:windowsSysWow64netevent.dll2012-10-03 16:42 . 2012-11-25 09:31	156672	----a-w-	c:windowsSysWow64ncsi.dll2012-10-03 16:07 . 2012-11-25 09:31	45568	----a-w-	c:windowssystem32driverstcpipreg.sys..((((((((((((((((((((((((((((((((((((((((((((   Look   ))))))))))))))))))))))))))))))))))))))))))))))))))))))))).---- Directory of c:userskeleshAppDataLocalassembly ----.2012-12-01 23:04 . 2012-12-01 23:04	142	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZ448991ac93a60036_18d0cd01__AssemblyInfo__.ini2012-12-01 23:04 . 2012-12-01 23:04	143360	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZ448991ac93a60036_18d0cd01NLog.DLL2012-12-01 23:04 . 2012-12-01 23:04	144	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZ640b8abd9fc86f37_18d0cd01__AssemblyInfo__.ini2012-12-01 23:04 . 2012-12-01 23:04	217088	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZ640b8abd9fc86f37_18d0cd01UnRar.Net.DLL2012-12-01 23:04 . 2012-12-01 23:04	134	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZ7aff67d53af76237_18d0cd01__AssemblyInfo__.ini2012-12-01 23:04 . 2012-12-01 23:04	24576	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZ7aff67d53af76237_18d0cd01NC.Logging.DLL2012-12-01 23:04 . 2012-12-01 23:04	130	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZaa8bf98a4c136c36_18d0cd01__AssemblyInfo__.ini2012-12-01 23:04 . 2012-12-01 23:04	3432792	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZaa8bf98a4c136c36_18d0cd01_Launcher.EXE2012-12-01 23:04 . 2012-12-01 23:04	142	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZ448991ac00de10b7_36cfca01__AssemblyInfo__.ini2012-12-01 23:04 . 2012-12-01 23:04	143360	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZ448991ac00de10b7_36cfca01NLog.DLL2012-12-01 23:04 . 2012-12-01 23:04	144	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZ640b8abd00ca71d8_36cfca01__AssemblyInfo__.ini2012-12-01 23:04 . 2012-12-01 23:04	217088	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZ640b8abd00ca71d8_36cfca01UnRar.Net.DLL2012-12-01 23:04 . 2012-12-01 23:04	134	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZ7aff67d5000b42b8_36cfca01__AssemblyInfo__.ini2012-12-01 23:04 . 2012-12-01 23:04	24576	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZ7aff67d5000b42b8_36cfca01NC.Logging.DLL2012-12-01 23:04 . 2012-12-01 23:04	132	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZaa8bf98a0045152d_37cfca01__AssemblyInfo__.ini2012-12-01 23:04 . 2012-12-01 23:04	3189544	----a-w-	c:userskeleshAppDataLocalassemblydl3L2KEO983.WHBT6YYPMKN.VGZaa8bf98a0045152d_37cfca01_Launcher.EXE..(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]"uTorrent"="c:program files (x86)uTorrentuTorrent.exe" [2012-12-09 969104]"DAEMON Tools Lite"="c:program files (x86)DAEMON Tools LiteDTLite.exe" [2012-08-28 3671904].[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun]"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]"StartCCC"="c:program files (x86)ATI TechnologiesATI.ACECore-StaticCLIStart.exe" [2012-07-04 641704].[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]"ConsentPromptBehaviorAdmin"= 0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableLUA"= 0 (0x0)"EnableUIADesktopToggle"= 0 (0x0)"PromptOnSecureDesktop"= 0 (0x0).[HKEY_LOCAL_MACHINEsoftwarewow6432nodemicrosoftwindowscurrentversionrun-]"SunJavaUpdateSched"="c:program files (x86)Common FilesJavaJava Updatejusched.exe""Adobe Acrobat Speed Launcher"="c:program files (x86)AdobeAcrobat 10.0AcrobatAcrobat_sl.exe""Adobe ARM"="c:program files (x86)Common FilesAdobeARM1.0AdobeARM.exe""Acrobat Assistant 8.0"="c:program files (x86)AdobeAcrobat 10.0AcrobatAcrotray.exe""AdobeCS6ServiceManager"="c:program files (x86)Common FilesAdobeCS6ServiceManagerCS6ServiceManager.exe" -launchedbylogin"SwitchBoard"=c:program files (x86)Common FilesAdobeSwitchBoardSwitchBoard.exe.R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:windowsMicrosoft.NETFramework64v4.0.30319mscorsvw.exe [2012-07-08 123856]R2 SkypeUpdate;Skype Updater;c:program files (x86)SkypeUpdaterUpdater.exe [2012-10-19 160944]R3 btusbflt;Bluetooth USB Filter;c:windowssystem32driversbtusbflt.sys [2009-07-02 52264]R3 dmvsc;dmvsc;c:windowssystem32driversdmvsc.sys [2010-11-21 71168]R3 ose64;Office 64 Source Engine;c:program filesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2010-01-09 174440]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [2012-08-23 19456]R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:windowssystem32DriversRtsUStor.sys [x]R3 RtsUIR;Realtek IR Driver;c:windowssystem32DRIVERSRts516xIR.sys [x]R3 SwitchBoard;SwitchBoard;c:program files (x86)Common FilesAdobeSwitchBoardSwitchBoard.exe [2010-02-19 517096]R3 TsUsbFlt;TsUsbFlt;c:windowssystem32driverstsusbflt.sys [2012-08-23 57856]R3 TsUsbGD;Remote Desktop Generic USB Device;c:windowssystem32driversTsUsbGD.sys [2012-08-23 30208]R3 WatAdminSvc;Windows Activation Technologies Service;c:windowssystem32WatWatAdminSvc.exe [2012-11-04 1255736]S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32DRIVERSdtsoftbus01.sys [2012-11-03 283200]S1 ehdrv;ehdrv;c:windowssystem32DRIVERSehdrv.sys [2011-08-04 146432]S2 AMD External Events Utility;AMD External Events Utility;c:windowssystem32atiesrxx.exe [2012-07-04 238080]S2 eamonm;eamonm;c:windowssystem32DRIVERSeamonm.sys [2011-08-09 202576]S2 ekrn;ESET Service;c:program filesESETESET NOD32 Antivirusx86ekrn.exe [2011-08-09 974944]S2 epfwwfpr;epfwwfpr;c:windowssystem32DRIVERSepfwwfpr.sys [2011-08-04 137144]S2 PSI_SVC_2_x64;Protexis Licensing V2 x64;c:program filesCommon FilesProtexisLicense ServicePsiService_2.exe [2010-11-30 336824]S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:program files (x86)TuneUp Utilities 2013TuneUpUtilitiesService64.exe [2012-09-17 2365792]S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:windowssystem32driversAtihdW76.sys [2012-02-23 95760]S3 k57nd60a;Broadcom NetLink  Gigabit Ethernet - NDIS 6.0;c:windowssystem32DRIVERSk57nd60a.sys [2009-06-10 270848]S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:program files (x86)TuneUp Utilities 2013TuneUpUtilitiesDriver64.sys [2012-08-29 11880]...--------- X64 Entries -----------..[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]"egui"="c:program filesESETESET NOD32 Antivirusegui.exe" [2011-08-09 4030008]"BCSSync"="c:program filesMicrosoft OfficeOffice14BCSSync.exe" [2010-03-13 112512]"PLFSetI"="c:windowsPLFSetI.exe" [2008-07-29 200704].HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost  - NetSvcsUxTuneUp.------- Supplementary Scan -------.uLocal Page = c:windowssystem32blank.htmmLocal Page = c:windowsSysWOW64blank.htmIE: &Download All with FlashGet - c:progra~2FlashGetjc_all.htmIE: &Download with FlashGet - c:progra~2FlashGetjc_link.htmIE: E&xport to Microsoft Excel - c:progra~1MICROS~1Office14EXCEL.EXE/3000IE: Se&nd to OneNote - c:progra~1MICROS~1Office14ONBttnIE.dll/105TCP: DhcpNameServer = 192.168.0.1FF - ProfilePath - c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultFF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ncrFF - ExtSQL: 2012-11-03 18:46; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensions{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpiFF - ExtSQL: 2012-11-03 18:47; {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensions{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpiFF - ExtSQL: 2012-11-03 22:46; {7f57cf46-4467-4c2d-adfa-0cba7c507e54}; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensions{7f57cf46-4467-4c2d-adfa-0cba7c507e54}.xpiFF - ExtSQL: 2012-11-04 11:25; [email protected]; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensionsfirefox@ghostery.comFF - ExtSQL: 2012-11-05 07:53; [email protected]; c:program files (x86)AdobeAcrobat 10.0AcrobatBrowserWCFirefoxExtnFF - ExtSQL: 2012-11-22 20:49; {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensions{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpiFF - ExtSQL: 2012-11-22 20:51; [email protected]; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensionsyoutube2mp3@mondayx.de.xpiFF - ExtSQL: 2012-11-24 16:08; {bee6eb20-01e0-ebd1-da83-080329fb9a3a}; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensions{bee6eb20-01e0-ebd1-da83-080329fb9a3a}FF - ExtSQL: 2012-11-24 16:11; {b9db16a4-6edc-47ec-a1f4-b86292ed211d}; c:userskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultextensions{b9db16a4-6edc-47ec-a1f4-b86292ed211d}FF - user.js: network.http.max-persistent-connections-per-server - 4FF - user.js: nglayout.initialpaint.delay - 600FF - user.js: content.notify.interval - 600000FF - user.js: content.max.tokenizing.time - 1800000FF - user.js: content.switch.threshold - 600000.- - - - ORPHANS REMOVED - - - -.Wow6432Node-HKLM-Run-<NO NAME> - (no file)...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:Windowssystem32MacromedFlashFlashUtil64_11_4_402_287_ActiveX.exe,-101".[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}LocalServer32]@="c:Windowssystem32MacromedFlashFlashUtil64_11_4_402_287_ActiveX.exe".[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:WindowsSysWOW64MacromedFlashFlashUtil32_11_4_402_287_ActiveX.exe,-101".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}LocalServer32]@="c:WindowsSysWOW64MacromedFlashFlashUtil32_11_4_402_287_ActiveX.exe".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}InprocServer32]@="c:WindowsSysWOW64MacromedFlashFlash32_11_4_402_287.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}MiscStatus]@="0".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}ProgID]@="ShockwaveFlash.ShockwaveFlash.11".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}ToolboxBitmap32]@="c:WindowsSysWOW64MacromedFlashFlash32_11_4_402_287.ocx, 1".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}Version]@="1.0".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}InprocServer32]@="c:WindowsSysWOW64MacromedFlashFlash32_11_4_402_287.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}ToolboxBitmap32]@="c:WindowsSysWOW64MacromedFlashFlash32_11_4_402_287.ocx, 1".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}Version]@="1.0".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINESOFTWAREClassesVideoLAN.VLCPlugin.*1*]@="?????????????????? v1".[HKEY_LOCAL_MACHINESOFTWAREClassesVideoLAN.VLCPlugin.*1*CLSID]@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}".[HKEY_LOCAL_MACHINESOFTWAREClassesVideoLAN.VLCPlugin.*2*]@="?????????????????? v2".[HKEY_LOCAL_MACHINESOFTWAREClassesVideoLAN.VLCPlugin.*2*CLSID]@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}".[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000"MSCurrentCountry"=dword:000000b5.[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlPCWSecurity]@Denied: (Full) (Everyone).Completion time: 2012-12-29  10:07:57ComboFix-quarantined-files.txt  2012-12-29 08:07ComboFix2.txt  2012-12-28 13:28.Pre-Run: 23,501,111,296 bytes freePost-Run: 23,446,093,824 bytes free.- - End Of File - - 36D89425DCBEEA084C93562032F7E163

29 декември 201213 г.

Как е сега положението?

Изтеглете и стартирайте програмата AdwCleaner (by Xplode).

[*]Затворете всички стартирани програми и браузъри [*]Кликнете два пъти върху

adwcleaner.exe за да стартирате инструмента. [*]Този път маркирайте Delete [*]Вашият компютър ще се рестартира автоматично. Текстовия файл ще се отвори след рестарта. [*]Моля, да публикувате съдържанието на този лог в отговора си [*]Можете да намерите лога,който автоматично се запомня тук C:AdwCleaner[s1].txt.

Моля изтеглете Junkware Removal Tool на вашия десктоп.

[*]Спрете временно работата на защитните програми. [*]Стартирайте инструмента

JRT.exe [*]Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата. [*]Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши. [*]Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt). [*]Моля копирайте съдържанието на лог файла в следващия си пост.

Изтеглете Malwarebytes' Anti-Malware

[*]Кликнете два пъти върху

mbam-setup.exe, за да инсталирате програмата. [*]Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish. [*]Ако има намерени обновявания, тя ще ги изтегли и инсталира. [*]Стартирайте програмата и изберете "Perform Quick Scan", след това кликнете на Scan. [*]Сканирането ще отнеме малко време, затова моля да бъдете търпеливи. [*]Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата. [*]Уверете се, че на всички редове има отметки, и кликнете на Remove Selected. [*]Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. [*]Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

29 декември 201213 г.

Автор

Ето логовете:

AdwCleaner[s1]

# AdwCleaner v2.103 - Logfile created 12/29/2012 at 13:10:01# Updated 25/12/2012 by Xplode# Operating system : Windows 7 Professional Service Pack 1 (64 bits)# User : kelesh - KELESH-PC# Boot Mode : Normal# Running from : C:UserskeleshDesktopadwcleaner.exe# Option [Delete]***** [Services] ********** [Files / Folders] *****Folder Deleted : C:Program Files (x86)ConduitFolder Deleted : C:UserskeleshAppDataLocalLowConduit***** [Registry] *****Key Deleted : HKCUSoftwareAPN PIPKey Deleted : HKCUSoftwareAppDataLowSoftwareSmartBarKey Deleted : HKCUSoftwareConduitKey Deleted : HKCUSoftwarePIPKey Deleted : HKCUSoftwareSoftonicKey Deleted : HKLMSoftwareConduitKey Deleted : HKLMSoftwarePIPKey Deleted : HKLMSOFTWAREWow6432NodeClassesCLSID{3C471948-F874-49F5-B338-4F214A2EE0B1}Key Deleted : HKLMSOFTWAREClassesInterface{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}***** [Internet Browsers] *****- Internet Explorer v9.0.8112.16457[OK] Registry is clean.- Mozilla Firefox v17.0.1 (en-US)File : C:UserskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultprefs.jsC:UserskeleshAppDataRoamingMozillaFirefoxProfiles5lx3j6qa.defaultuser.js ... Deleted !Deleted : user_pref("Smartbar.ConduitHomepagesList", "");Deleted : user_pref("Smartbar.ConduitSearchEngineList", "uTorrentControl_v2 Customized Web Search");Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3220468[...]Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3220468");*************************AdwCleaner[S1].txt - [1662 octets] - [29/12/2012 13:10:01]########## EOF - C:AdwCleaner[S1].txt - [1722 octets] ##########

JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Junkware Removal Tool (JRT) by ThisisuVersion: 4.2.9 (12.28.2012:1)OS: Windows 7 Professional x64Ran by kelesh on 29/12/2012 at 13:13:06.28Blog: http://thisisudax.blogspot.com~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Services~~~ Registry Values~~~ Registry Keys~~~ Files~~~ Folders~~~ Event Viewer Logs were cleared~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Scan was completed on 29/12/2012 at 13:22:31.76End of JRT log~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

mbam-log-2012-12-29 (13-25-02)

Malwarebytes Anti-Malware 1.70.0.1100www.malwarebytes.orgDatabase version: v2012.12.29.05Windows 7 Service Pack 1 x64 NTFSInternet Explorer 9.0.8112.16421kelesh :: KELESH-PC [administrator]29/12/2012 13:25:02mbam-log-2012-12-29 (13-25-02).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 209899Time elapsed: 2 minute(s), 18 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end)

29 декември 201213 г.

Има ли някаква промяна или пак се появяват съобщенията?

29 декември 201213 г.

Автор

След първото пускане на Combofix и рестарта няма вече съобщения.

Знаех си, че тук ще намеря отговор на проблема. Google не ми даде нито един резултат с въпросното .exе.

Благодаря за бързата реакция!

Ползотворна нова година!

29 декември 201213 г.

Всъщност аз предполагам, че не Combofix, а изтриването на mscon.exe даде резултат.

Combofix после забърса остатъците от него:

Wow6432Node-HKCU-Run-Integrated Driver - c:userskeleshAppDataRoamingMozillamscon.exe

И ми даде индикация за пачнат explorer.exe, който оправихме с командата sfc и рестарта после.

Време е да почистим тогава:

Start => в полето за търсене => въведете командата Combofix /Uninstall => натиснете Enter

Изтеглете OTC.exe и го стартирайте. Натиснете бутона CleanUp!.

Рестартирайте компютъра, ако ви попита!

Изтеглете Delfix.exe и го стартирайте. Натиснете бутона Recherche (Search) и след това Suppression (Delete)

След това натиснете Desinstallation. (Uninstall)

Изтрийте всички файлове и папки от използваните инструменти ръчно, ако не са се изтрили след гореспоменатите процедури!

Ако NOD32 е кракната, по-добре се насочете към някоя от безплатните програми за сигурност като Avira, avast или Comodo Internet Security

Желая ви приятна и спокойна вечер и весели празници!

Справихте се блестящо!

Добре дошли!

msker.exe has stopped working уйндоус 7

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)