igfxext.exe и може би други вредители.

10 януари 201313 г.

Здравейте!

Вчера приготвих логове от почти всякакви програми, и дано не се окаже,че системата ми е инфектирана.

Преди 2 дена забелязах,че има някакъв си igfxext.exe,чиито производител е Unkown и се намира в AppData/Roaming/Microsoft/Display/

Незнам какво прави затова разучих и използвах този метод да го махна:http://windowsvc.com/bbs/board.php?bo_table=windowsvc&wr_id=47119 Първият регистри проработи, но вторият отказа.... Незнам дали стана или не стана,но и двата адреса са еднакви май, тъй че :Д

Днеска като стартирах компютъра, Windows explorer stopped working.Трябвах да го рестартирам и после самият компютър за да приложа Уиндоус ъпдатите.

Ейто и логовете и бих искал да проверите много надълбоко и на широко всичко в Роот систем сектора на Хард драйв-а.Защото ако там има вирус,то и преинсталиране няма да помогне.

ДДС:

Атач.тцт:

РСИТ Инфо:

РСИТ Лог:

MБAM:

Всички скенери сканираха само Локалния диск,но не и другият - (D:), освен МБАМ!

Също,на някой от АВЗ4 сканове, бях забранил достъпа до интернет! Не съм сигурен дали бях забранявал и на други но на АВЗ4 2 от скановете бяха без интернет връзка, за да съм сигурен че вирусът (ако има такъв) не споделя информация или взима информация за действия или ъпдейти.Парола:123а

Редактирано 11 януари 201313 г. от B-boy[StyLe]
премахнати логове по желание на автора (преглед на промените)

10 януари 201313 г.

Здравейте,

Видях единствено остатък от ZeroAccess, който би трябвало да е безобиден и инфекцията би трябвало да е неактивна(почистена) в момента...
Но все пак...

СТЪПКА 1

Моля изтеглете последната версия на TDSSKiller оттук и я запазете на вашия декстоп.

[*]Стартирайте

TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.

[*]Сложете отметка през Loaded Modules.

[*]Необходим е рестарт за осъществяване на промените. Направете го! [*]TDSSKiller ще стартира автоматично след рестарта. Важно е да се отбележи, че вашия компютър може да изглежда по-бавен, на моменти неизползваем и с по-ниска производителност. Това е нормално и ще трае само един рестарт. Дайте му достатъчно време да зареди приложенията стартиращи с Операционната Система във фонов режим. [*]След това натиснете Change parameters в TDSSKiller отново. [*]Сложете всички отметки (този път рестарт не се изисква).

[*]Натиснете бутона Start Scan.

[*]Проверката не би трябвало да отмене повече от 2 минути. [*]Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.

[*]Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.
Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова. [*]Лог файл ще бъде създаден в свободната директория на дял C:. Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

СТЪПКА 2

Изтеглете OTL.exe и го запазете на десктопа.

[*]Стартирайте

OTL (ако е необходимо, потвърдете през UAC). [*]Направете следните настройки: [*]Сложете отметка пред Scan All Users [*]Под менюто File Age изберете 90 days [*]Под менюто Standard Registry променете на ALL [*]Сложете отметки пред LOP и Purity Check

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcsmsconfigsafebootminimalsafebootnetworkactivexdrivers32%SYSTEMDRIVE%*.*%USERPROFILE%*.*%USERPROFILE%temp*.exe%USERPROFILE%AppDataLocal*.*%USERPROFILE%AppDataLocal*.%USERPROFILE%AppDataLocaltemp*.exe%USERPROFILE%AppDataRoaming*.*%USERPROFILE%AppDataRoaming*.%Public%DocumentsFonts*.exe%Public%DocumentsConfig*.exe%Public%Documents*.*%ProgramData%*.*%ProgramData%*.%CommonProgramFiles%*.*%CommonProgramFiles%ComObjects*.exe%commonprogramfiles(x86)%*.*%ProgramFiles%*.*%ProgramFiles%*.%ProgramFiles(x86)%*.*%ProgramFiles(x86)%*.%programdata%MicrosoftWindowsDRM*.tmp%programdata%MicrosoftDRM*.tmp%systemroot%system32configsystemprofileAppDataLocal*.*%systemroot%system32configsystemprofileAppDataRoaming*.*%windir%SysWOW64configsystemprofileAppDataLocal*.*%windir%SysWOW64configsystemprofileAppDataRoaming*.*%windir%ServiceProfilesLocalServiceAppDataLocalTemp*.tlb%windir%ServiceProfilesNetworkServiceAppDataLocalTemp*.tlb%windir%temp*.exe%windir%*.%windir%installer*.%windir%system32*.%windir%sysnative*.%Temp%smtmp1*.*%Temp%smtmp2*.*%Temp%smtmp3*.*%Temp%smtmp4*.*%systemroot%system32*.dll /lockedfiles%systemroot%syswow64*.dll /lockedfiles%systemroot%Tasks*.job /lockedfiles%systemroot%system32drivers*.sys /90%systemroot%system32drivers*.sys /lockedfiles%systemroot%syswow64drivers*.sys /90%systemroot%syswow64drivers*.sys /lockedfiles%systemroot%system32Spoolprtprocsw32x86*.dll%systemroot%*. /rp /s%systemroot%assemblytmp*.* /S /MD5%systemroot%assemblytemp*.* /S /MD5%systemroot%assemblyGAC*.ini%systemroot%assemblyGAC_32*.ini%systemroot%assemblyGAC_64*.ini%SystemRoot%assemblyGAC_MSIL*.iniwsSystemRoot|l,n,u,@;True;False;True;$,{ /fn%systemdrive%$Recycle.Bin|@;true;true;true /fpHKEY_CLASSES_ROOTCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /sHKEY_CLASSES_ROOTCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /sHKEY_CURRENT_USERSoftwareClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /sHKEY_LOCAL_MACHINESOFTWAREClassesCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /sHKEY_LOCAL_MACHINESOFTWAREClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /sHKEY_LOCAL_MACHINESOFTWAREClassesCLSID{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /sHKEY_LOCAL_MACHINESOFTWAREClassesCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /sHKEY_CLASSES_ROOTclsid{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /sHKEY_CLASSES_ROOTclsid{fbeb8a05-beee-4442-804e-409d6c4515e9} /sHKEY_CURRENT_USERSoftwareClassesclsid{fbeb8a05-beee-4442-804e-409d6c4515e9} /sHKEY_LOCAL_MACHINESOFTWAREClassesCLSID{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /sHKEY_CURRENT_USERSoftwareClassesclsid{12d0253a-7c96-815c-11e0-3034bbd97cc0}] /sHKEY_CURRENT_USERSoftwareMSOLoad /sbcdedit /enum all /v >C:boot.txt /c>C:commands.txt echo list vol /raw /hide /c/wait>C:DiskReport.txt diskpart /s C:commands.txt /raw /hide /c/waittype c:diskreport.txt /c/waiterase c:commands.txt /hide /c/waiterase c:diskreport.txt /hide /c/md5starteventlog.dllscecli.dllnetlogon.dllcngaudit.dllsceclt.dllntelogon.dlllogevent.dllconsrv.dllservices.exeexplorer.exelsass.exesvchost.exewininit.exewinlogon.exeuserinit.exeatapi.sysiaStor.sysserial.sysvolsnap.sysdisk.sysredbook.sysi8042prt.sysafd.sysnetbt.syscsc.systcpip.sysdfsc.syshlp.datstr.syscrexv.ocxigfxext.exe/md5stop

[*]Натиснете маркираният в синьо бутон:

Run Scan. [*]Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

11 януари 201313 г.

Автор

TDSSKiller Log:

11 януари 201313 г.

Така...зарази не се виждат, но имам няколко препоръки:

Почистете остатъците от AVG.

Изтеглете и стартирайте този инструмент - AVG Remover(32bit) 2012

Ако ESET Smart Security е кракната, аз ви съветвам да я деинсталирате и да сложите някои от безплатните програми като Comodo Internet Security, AVIRA, MSE или AVG.

Обновете следните програми:

Java 7 Update 9 => Отворете сайта и кликнете върху JRE download => съгласете се с лицензионното споразомение и изтеглете и инсталирайте jre-7u10-windows-i586.exe

Adobe Reader X (10.1.4) => Изтеглете и инсталирайте: Adobe Reader 11.0.01 | BG Mirror (48.49 MB)

[*]Стартирайте файла с двукратен клик на мишката.

[*]Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

:OTLDRV - File not found [Kernel | On_Demand Unknown] -- -- (a75cqjxz)DRV - [2013.01.09 14:33:06 | 000,007,168 ---- M] () [Kernel | On_Demand Stopped] -- C:WindowsSystem32driversuti1otg1.sys -- (uti1otg1)O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.SafeBootMin: 84853830.sys - DriverSafeBootNet: 84853830.sys - Driver[2012.10.26 15:02:12 | 000,000,000 ---D C] -- C:ProgramDataAsk[2013.01.09 14:33:06 | 000,007,168 ---- M] () -- C:WindowsSystem32driversuti1otg1.sys[2009.07.14 06:42:31 | 000,000,227 RHS- M] () -- C:WindowsassemblyDesktop.ini[2013.01.11 18:05:30 | 002,213,976 ---- M] (Kaspersky Lab ZAO) -- C:UsersCompyAppDataLocaltempC1B9D831-F86A-46E7-89C3-1D55BDB26359.exe[2012.12.14 19:08:09 | 006,858,716 ---- M] (Dark Byte ) -- C:UsersCompyAppDataLocaltempCheatEngine62Clean.exe[2012.11.13 21:53:02 | 001,036,696 ---- M] () -- C:UsersCompyAppDataLocaltempgbinit.exe[2012.12.14 19:12:29 | 000,463,184 ---- M] () -- C:UsersCompyAppDataLocaltempincredibar_installer.exe[2012.10.20 14:33:48 | 001,715,920 ---- M] (mIRC Co. Ltd.) -- C:UsersCompyAppDataLocaltempmirc727.exe[2012.12.14 19:12:31 | 002,324,576 ---- M] () -- C:UsersCompyAppDataLocaltempsomoto-master.exe[2012.10.20 14:33:18 | 000,072,312 ---- M] (mIRC Co. Ltd.) -- C:UsersCompyAppDataLocaltempuninstall.exe[2012.12.14 19:12:33 | 000,260,040 ---- M] (Somoto Ltd.) -- C:UsersCompyAppDataLocaltempUpdateCheckerSetup.exe[2012.11.06 23:22:16 | 022,912,657 ---- M] () -- C:UsersCompyAppDataLocaltempvlc-2.0.4-win32.exe[2012.09.23 14:54:13 | 000,000,000 ---D M] -- C:ProgramDataMFAData[2012.08.09 09:53:46 | 000,000,000 ---D M] -- C:Program FilesAVG[2012.10.10 02:00:49 | 000,000,000 -HSD M] -- C:Windowssystem32%APPDATA%:reg [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules]"{055486DF-2E3C-430C-9658-1A4BE7593CF3}"=-"{0F1D7552-82D4-49D3-A71F-F7916FB7D3D3}"=-"{10CE3A56-64C6-4E49-8E15-5F64551F22C6}"=-"{5058C6D3-640C-4DCD-83CD-72B68D8A66C9}"=-"{6040BA80-D70E-4304-90DE-514207A4E510}"=-"{67358C7A-E51F-4884-91B0-D21818B07A2A}"=-"{D5C84786-7053-43A2-8DE7-533232695C62}"=-"{FB4DC1AD-2434-404B-B73D-146278DC2D86}"=-:commands[purity][emptyflash][emptyjava][emptytemp]

[*]След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

[*]Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

11 януари 201313 г.

Автор

Ако мога да питам,тези Firewall rules дупки ли бяха? В смисъл какво точно представляваха?

All processes killed========== OTL ==========Error: No service named a75cqjxz was found to stop!Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesa75cqjxz deleted successfully.Service uti1otg1 stopped successfully!Service uti1otg1 deleted successfully!C:WindowsSystem32driversuti1otg1.sys moved successfully.Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoadWebCheck deleted successfully.Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{E6FB5E20-DE35-11CF-9C87-00AA005127ED} not found.Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimal84853830.sys deleted successfully.Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootNetwork84853830.sys deleted successfully.C:ProgramDataAskAPN-StubESP folder moved successfully.C:ProgramDataAskAPN-Stub folder moved successfully.C:ProgramDataAsk folder moved successfully.File C:WindowsSystem32driversuti1otg1.sys not found.C:WindowsassemblyDesktop.ini moved successfully.C:UsersCompyAppDataLocalTempC1B9D831-F86A-46E7-89C3-1D55BDB26359.exe moved successfully.C:UsersCompyAppDataLocalTempCheatEngine62Clean.exe moved successfully.C:UsersCompyAppDataLocalTempgbinit.exe moved successfully.C:UsersCompyAppDataLocalTempincredibar_installer.exe moved successfully.C:UsersCompyAppDataLocalTempmirc727.exe moved successfully.C:UsersCompyAppDataLocalTempsomoto-master.exe moved successfully.C:UsersCompyAppDataLocalTempuninstall.exe moved successfully.C:UsersCompyAppDataLocalTempUpdateCheckerSetup.exe moved successfully.C:UsersCompyAppDataLocalTempvlc-2.0.4-win32.exe moved successfully.Folder C:ProgramDataMFAData not found.Folder C:Program FilesAVG not found.C:WindowsSystem32%APPDATA%MicrosoftWindowsIETldCache folder moved successfully.C:WindowsSystem32%APPDATA%MicrosoftWindows folder moved successfully.C:WindowsSystem32%APPDATA%Microsoft folder moved successfully.C:WindowsSystem32%APPDATA% folder moved successfully.========== REGISTRY ==========Registry value HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules{055486DF-2E3C-430C-9658-1A4BE7593CF3} deleted successfully.Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{055486DF-2E3C-430C-9658-1A4BE7593CF3} not found.Registry value HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules{0F1D7552-82D4-49D3-A71F-F7916FB7D3D3} deleted successfully.Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{0F1D7552-82D4-49D3-A71F-F7916FB7D3D3} not found.Registry value HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules{10CE3A56-64C6-4E49-8E15-5F64551F22C6} deleted successfully.Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{10CE3A56-64C6-4E49-8E15-5F64551F22C6} not found.Registry value HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules{5058C6D3-640C-4DCD-83CD-72B68D8A66C9} deleted successfully.Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{5058C6D3-640C-4DCD-83CD-72B68D8A66C9} not found.Registry value HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules{6040BA80-D70E-4304-90DE-514207A4E510} deleted successfully.Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{6040BA80-D70E-4304-90DE-514207A4E510} not found.Registry value HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules{67358C7A-E51F-4884-91B0-D21818B07A2A} deleted successfully.Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{67358C7A-E51F-4884-91B0-D21818B07A2A} not found.Registry value HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules{D5C84786-7053-43A2-8DE7-533232695C62} deleted successfully.Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{D5C84786-7053-43A2-8DE7-533232695C62} not found.Registry value HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules{FB4DC1AD-2434-404B-B73D-146278DC2D86} deleted successfully.Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{FB4DC1AD-2434-404B-B73D-146278DC2D86} not found.========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Compy->Flash cache emptied: 212844 bytes User: Default->Flash cache emptied: 56504 bytes User: Default User->Flash cache emptied: 0 bytes User: Public User: UpdatusUser Total Flash Files Cleaned = 0,00 mb  [EMPTYJAVA] User: All Users User: Compy->Java cache emptied: 443483 bytes User: Default User: Default User User: Public User: UpdatusUser Total Java Files Cleaned = 0,00 mb  [EMPTYTEMP] User: All Users User: Compy->Temp folder emptied: 1531546752 bytes->Temporary Internet Files folder emptied: 84231949 bytes->Java cache emptied: 0 bytes->FireFox cache emptied: 468725004 bytes->Flash cache emptied: 0 bytes User: Default->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 33237 bytes->Flash cache emptied: 0 bytes User: Default User->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 0 bytes->Flash cache emptied: 0 bytes User: Public User: UpdatusUser->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes%systemroot% .tmp files removed: 0 bytes%systemroot%System32 .tmp files removed: 0 bytes%systemroot%System32drivers .tmp files removed: 0 bytesWindows Temp folder emptied: 337353060 bytesRecycleBin emptied: 1487002982 bytes Total Files Cleaned = 3 728,00 mb  OTL by OldTimer - Version 3.2.69.0 log created on 01112013_194415FilesFolders moved on Reboot...PendingFileRenameOperations files...Registry entries deleted on Reboot...

Редактирано 11 януари 201313 г. от SpiritBob (преглед на промените)

11 януари 201313 г.

Да направим 1 последна проверка:

Изтеглете Gmer

Временно спрете Интернета си,всички работещи програми,както и антивирусната си програма.
Разархивирайте архива и стартирате програмата.
След завършването на автоматичната проверка се уверете, че следните отметки са сложени:

Натиснете бутона Scan
Изчакайте програмата да завърши сканирането,след което натиснете бутона Save и запишете (save as) резултатите на десктопа с име Gmer.log.
Включете Интернета си и прикачете Gmer.log в следващия си коментар.

Забележка:
Не предприемайте никакви действия върху редовете маркирани с "<--- ROOТKIT" ,защото това може да доведе до проблеми с Windows.

11 януари 201313 г.

Автор

Изписа ми "Не можете да качвате такъв тип файл" Затова ще копирам съдържанието тука:

GMER 2.0.18444 - http://www.gmer.netRootkit scan 2013-01-11 21:38:54Windows 6.1.7601 Service Pack 1 DeviceHarddisk0DR0 -> Device00000062 WDC_WD10 rev.05.0 931,51GBRunning: gmer.exe; Driver: C:UsersCompyAppDataLocalTempfgloqpoc.sys---- System - GMER 2.0 ----SSDT    SystemRootsystem32DRIVERSehdrv.sys (ESET Helper driver/ESET)                                                                          ZwCreateThread [0x908E77F0]SSDT    SystemRootsystem32DRIVERSehdrv.sys (ESET Helper driver/ESET)                                                                          ZwLoadDriver [0x908E78B0]SSDT    SystemRootsystem32DRIVERSehdrv.sys (ESET Helper driver/ESET)                                                                          ZwSetSystemInformation [0x908E7870]SSDT    SystemRootsystem32DRIVERSehdrv.sys (ESET Helper driver/ESET)                                                                          ZwSystemDebugControl [0x908E7830]---- Kernel code sections - GMER 2.0 ----.text   ntkrnlpa.exe!ZwRollbackEnlistment + 140D                                                                                                  82C40A49 1 Byte  [06].text   ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                                    82C7A4D2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}.text   ntkrnlpa.exe!KeRemoveQueueEx + 1203                                                                                                       82C81638 4 Bytes  [F0, 77, 8E, 90] {JA 0xffffff91; NOP }.text   ntkrnlpa.exe!KeRemoveQueueEx + 1313                                                                                                       82C81748 4 Bytes  [B0, 78, 8E, 90].text   ntkrnlpa.exe!KeRemoveQueueEx + 161F                                                                                                       82C81A54 4 Bytes  [70, 78, 8E, 90].text   ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                                                       82C81A9C 4 Bytes  [30, 78, 8E, 90] {XOR [EAX-0x72], BH; NOP }.sptd1  C:WindowsSystem32Driverssptd.sys                                                                                                      entry point in ".sptd1" section [0x8BB18B2E].text   USBPORT.SYS!DllUnload                                                                                                                     99DCBDB9 5 Bytes  JMP 86463410 ?       C:WindowsSystem32Driversaoun6ocf.SYS                                                                                                  suspicious PE modification.text   peauth.sys                                                                                                                                A8A12C9D 28 Bytes  JMP CE2D5E34 .text   peauth.sys                                                                                                                                A8A12CC1 28 Bytes  JMP CE2D5E58 ---- User code sections - GMER 2.0 ----.text   C:Program FilesESETESET Smart Securityekrn.exe[1876] kernel32.dll!SetUnhandledExceptionFilter                                         7642F4FB 4 Bytes  [C2, 04, 00, 00].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtCreateFile + 6                                    76E455CE 4 Bytes  [28, 00, 23, 00] {SUB [EAX], AL; AND EAX, [EAX]}.text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtCreateFile + B                                    76E455D3 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtCreateKey + 6                                     76E4560E 4 Bytes  [68, 01, 23, 00].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtCreateKey + B                                     76E45613 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtCreateMutant + 6                                  76E4564E 4 Bytes  [68, 02, 23, 00].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtCreateMutant + B                                  76E45653 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtCreateSection + 6                                 76E456EE 4 Bytes  [A8, 02, 23, 00] {TEST AL, 0x2; AND EAX, [EAX]}.text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtCreateSection + B                                 76E456F3 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtMapViewOfSection + 6                              76E45C2E 4 Bytes  CALL 75E47F37 C:Windowssystem32SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation).text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtMapViewOfSection + B                              76E45C33 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenFile + 6                                      76E45CDE 4 Bytes  [68, 00, 23, 00].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenFile + B                                      76E45CE3 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenKey + 6                                       76E45D0E 4 Bytes  [A8, 01, 23, 00] {TEST AL, 0x1; AND EAX, [EAX]}.text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenKey + B                                       76E45D13 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenKeyEx + 6                                     76E45D1E 4 Bytes  CALL 75E48024 C:Windowssystem32SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation).text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenKeyEx + B                                     76E45D23 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenMutant + 6                                    76E45D5E 4 Bytes  [28, 02, 23, 00] {SUB [EDX], AL; AND EAX, [EAX]}.text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenMutant + B                                    76E45D63 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenProcess + 6                                   76E45D8E 1 Byte  [68].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenProcess + 6                                   76E45D8E 4 Bytes  [68, 03, 23, 00].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenProcess + B                                   76E45D93 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenProcessToken + 6                              76E45D9E 1 Byte  [A8].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenProcessToken + 6                              76E45D9E 4 Bytes  [A8, 03, 23, 00] {TEST AL, 0x3; AND EAX, [EAX]}.text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenProcessToken + B                              76E45DA3 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenProcessTokenEx + 6                            76E45DAE 4 Bytes  [68, 04, 23, 00].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenProcessTokenEx + B                            76E45DB3 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenSection + 6                                   76E45DCE 4 Bytes  CALL 75E480D5 C:Windowssystem32SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation).text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenSection + B                                   76E45DD3 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenThread + 6                                    76E45E0E 1 Byte  [28].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenThread + 6                                    76E45E0E 4 Bytes  [28, 03, 23, 00] {SUB [EBX], AL; AND EAX, [EAX]}.text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenThread + B                                    76E45E13 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenThreadToken + 6                               76E45E1E 4 Bytes  [28, 04, 23, 00].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenThreadToken + B                               76E45E23 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenThreadTokenEx + 6                             76E45E2E 4 Bytes  [A8, 04, 23, 00] {TEST AL, 0x4; AND EAX, [EAX]}.text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtOpenThreadTokenEx + B                             76E45E33 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtQueryAttributesFile + 6                           76E45F3E 4 Bytes  [A8, 00, 23, 00] {TEST AL, 0x0; AND EAX, [EAX]}.text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtQueryAttributesFile + B                           76E45F43 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtQueryFullAttributesFile + 6                       76E45FEE 4 Bytes  CALL 75E482F3 C:Windowssystem32SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation).text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtQueryFullAttributesFile + B                       76E45FF3 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtSetInformationFile + 6                            76E4663E 4 Bytes  [28, 01, 23, 00] {SUB [ECX], AL; AND EAX, [EAX]}.text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtSetInformationFile + B                            76E46643 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtSetInformationThread + 6                          76E4669E 1 Byte  [E8].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtSetInformationThread + 6                          76E4669E 4 Bytes  CALL 75E489A6 C:Windowssystem32SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation).text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtSetInformationThread + B                          76E466A3 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtUnmapViewOfSection + 6                            76E469BE 4 Bytes  [28, 05, 23, 00].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ntdll.dll!NtUnmapViewOfSection + B                            76E469C3 1 Byte  [E2].text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] kernel32.dll!CreateProcessW                                   763E204D 5 Bytes  JMP 00010030 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] kernel32.dll!CreateProcessA                                   763E2082 5 Bytes  JMP 00010070 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!DeleteObject                                        76B95F14 5 Bytes  JMP 002D01B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!SelectObject                                        76B96640 5 Bytes  JMP 002D05F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!SetTextColor                                        76B96906 5 Bytes  JMP 002D0A30 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!SetBkMode                                           76B969B1 5 Bytes  JMP 002D08F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!DeleteDC                                            76B96EAA 5 Bytes  JMP 002D0170 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!GetDeviceCaps                                       76B96F7F 5 Bytes  JMP 002D03B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!ExtSelectClipRgn                                    76B97114 5 Bytes  JMP 002D02F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!SelectClipRgn                                       76B97242 5 Bytes  JMP 002D05B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!SetStretchBltMode                                   76B97705 5 Bytes  JMP 002D06B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!GetCurrentObject                                    76B97917 5 Bytes  JMP 002D0370 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!GetTextMetricsW                                     76B97B8F 5 Bytes  JMP 002D0E30 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!GetTextAlign                                        76B97DAF 5 Bytes  JMP 002D0D70 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!IntersectClipRect                                   76B97DFE 5 Bytes  JMP 002D03F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!ExtTextOutW                                         76B98192 5 Bytes  JMP 002D0970 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!SetTextAlign                                        76B9828E 5 Bytes  JMP 002D09F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!GetClipBox                                          76B98525 5 Bytes  JMP 002D0330 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!MoveToEx                                            76B98C21 5 Bytes  JMP 002D0470 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!StretchDIBits                                       76B9A53E 5 Bytes  JMP 002D0770 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!RestoreDC                                           76B9A67B 5 Bytes  JMP 002D0530 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!SaveDC                                              76B9A74B 5 Bytes  JMP 002D0570 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!GetTextExtentPoint32W                               76B9B4B5 5 Bytes  JMP 002D0670 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!GetTextFaceW                                        76B9B73A 2 Bytes  JMP 002D0D30 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!GetTextFaceW + 3                                    76B9B73D 2 Bytes  [73, 89] {JAE 0xffffff8b}.text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!GetFontData                                         76B9BCC4 5 Bytes  JMP 002D0C70 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!SetWorldTransform                                   76B9C90A 5 Bytes  JMP 002D06F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!CreateDCA                                           76B9CCA9 5 Bytes  JMP 002D00B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!CreateDCW                                           76B9CF79 5 Bytes  JMP 002D00F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!CreateICW                                           76B9CFD0 5 Bytes  JMP 002D0130 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!GetTextMetricsA                                     76B9D0F2 5 Bytes  JMP 002D0DF0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!Rectangle                                           76B9F1FF 5 Bytes  JMP 002D09B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!LineTo                                              76B9F59B 5 Bytes  JMP 002D0430 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!SetICMMode                                          76B9FAA4 5 Bytes  JMP 002D0DB0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!ExtTextOutA                                         76BA03F9 5 Bytes  JMP 002D0930 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!GetTextExtentPoint32A                               76BA07B0 5 Bytes  JMP 002D0630 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!ExtEscape                                           76BA2949 5 Bytes  JMP 002D02B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!Escape                                              76BA3939 5 Bytes  JMP 002D0270 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!GetTextFaceA                                        76BA3E6A 5 Bytes  JMP 002D0CF0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!SetPolyFillMode                                     76BAD851 5 Bytes  JMP 002D0B30 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!SetMiterLimit                                       76BADA0D 5 Bytes  JMP 002D0B70 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!EndPage                                             76BB00D7 5 Bytes  JMP 002D0230 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!ResetDCW                                            76BB050D 5 Bytes  JMP 002D0AB0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!GetGlyphOutlineW                                    76BBC1BA 5 Bytes  JMP 002D0CB0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!CreateScalableFontResourceW                         76BBE817 5 Bytes  JMP 002D0BB0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!AddFontResourceW                                    76BBEC13 5 Bytes  JMP 002D0BF0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!RemoveFontResourceW                                 76BBF109 5 Bytes  JMP 002D0C30 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!AbortDoc                                            76BC4C63 5 Bytes  JMP 002D0030 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!EndDoc                                              76BC50AA 5 Bytes  JMP 002D01F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!StartPage                                           76BC5195 5 Bytes  JMP 002D0730 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!StartDocW                                           76BC5BB0 5 Bytes  JMP 002D07F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!BeginPath                                           76BC635D 5 Bytes  JMP 002D0830 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!SelectClipPath                                      76BC63B4 5 Bytes  JMP 002D0AF0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!CloseFigure                                         76BC640F 5 Bytes  JMP 002D0070 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!EndPath                                             76BC6466 5 Bytes  JMP 002D0A70 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!StrokePath                                          76BC6699 5 Bytes  JMP 002D07B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!FillPath                                            76BC6726 5 Bytes  JMP 002D0870 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!PolylineTo                                          76BC6B94 5 Bytes  JMP 002D04F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!PolyBezierTo                                        76BC6C25 5 Bytes  JMP 002D04B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] GDI32.dll!PolyDraw                                            76BC6CD7 5 Bytes  JMP 002D08B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!ActivateKeyboardLayout                             75588203 5 Bytes  JMP 002E04F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!ScreenToClient                                     7558A506 7 Bytes  JMP 002E0670 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!RegisterClipboardFormatA                           7558C091 5 Bytes  JMP 002E02F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!RegisterClipboardFormatW                           7558DF8D 5 Bytes  JMP 002E02B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!SetCursor                                          75593075 5 Bytes  JMP 002E0530 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!MonitorFromWindow                                  75593622 7 Bytes  JMP 002E0630 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!PostMessageW                                       7559447B 5 Bytes  JMP 002E05F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!IsWindowVisible                                    75594D69 7 Bytes  JMP 002E06B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!GetClientRect                                      755954DD 7 Bytes  JMP 002E05B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!MapWindowPoints                                    75595CAA 5 Bytes  JMP 002E0570 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!GetParent                                          75596029 7 Bytes  JMP 002E06F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!EmptyClipboard                                     755A290C 5 Bytes  JMP 002E0130 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!SetClipboardData                                   755A2962 5 Bytes  JMP 002E0170 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!GetClipboardData                                   755A2BA7 5 Bytes  JMP 002E0030 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!GetClipboardFormatNameW                            755A5FD2 5 Bytes  JMP 002E0230 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!SetClipboardViewer                                 755A6FF6 5 Bytes  JMP 002E04B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!GetClipboardFormatNameA                            755A700A 5 Bytes  JMP 002E0270 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!ChangeClipboardChain                               755B147C 5 Bytes  JMP 002E0430 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!GetTopWindow                                       755B24D9 7 Bytes  JMP 002E0730 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!CloseClipboard                                     755B446C 5 Bytes  JMP 002E00B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!OpenClipboard                                      755B447E 5 Bytes  JMP 002E0070 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!IsClipboardFormatAvailable                         755B44FF 5 Bytes  JMP 002E00F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!GetClipboardSequenceNumber                         755B4513 5 Bytes  JMP 002E0330 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!GetClipboardOwner                                  755B4525 5 Bytes  JMP 002E0370 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!CountClipboardFormats                              755B470A 5 Bytes  JMP 002E01F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!EnumClipboardFormats                               755B47EC 5 Bytes  JMP 002E01B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!GetOpenClipboardWindow                             755B480B 5 Bytes  JMP 002E03F0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!SetCursorPos                                       755CC1B0 5 Bytes  JMP 002E0770 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!GetClipboardViewer                                 755E4AF7 5 Bytes  JMP 002E0470 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] USER32.dll!GetPriorityClipboardFormat                         755E4BF9 5 Bytes  JMP 002E03B0 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ole32.dll!OleSetClipboard                                     766C0045 5 Bytes  JMP 002F0030 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ole32.dll!OleIsCurrentClipboard                               766C36B2 5 Bytes  JMP 002F0070 .text   C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] ole32.dll!OleGetClipboard                                     766EFDCD 5 Bytes  JMP 002F00B0 .text   C:Program FilesTortoiseSVNbinTSVNCache.exe[3096] kernel32.dll!SetUnhandledExceptionFilter + 2                                         7642F4FD 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}.text   C:Program FilesMozilla Firefoxfirefox.exe[3428] ntdll.dll!LdrGetProcedureAddress + 26                                                  76E62239 7 Bytes  JMP 5A6EED80 C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation).text   C:Program FilesMozilla Firefoxfirefox.exe[3428] kernel32.dll!K32GetDeviceDriverBaseNameW + 5D                                          7642941E 7 Bytes  JMP 5AA354E2 C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation).text   C:Program FilesMozilla Firefoxfirefox.exe[3428] kernel32.dll!QueryPerformanceCounter + 13                                              7642C435 2 Bytes  JMP 5AA35505 C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation).text   C:Program FilesMozilla Firefoxfirefox.exe[3428] kernel32.dll!QueryPerformanceCounter + 16                                              7642C438 4 Bytes  [60, E4, EB, F9] {PUSHA ; IN AL, 0xeb; STC }.text   C:Program FilesMozilla Firefoxfirefox.exe[3428] kernel32.dll!LoadAppInitDlls + 355                                                     7642F4F6 7 Bytes  JMP 5A7053B7 C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation).text   C:Program FilesMozilla Firefoxfirefox.exe[3428] GDI32.dll!GetViewportOrgEx + 26C                                                       76B9884B 7 Bytes  JMP 5AA35463 C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation).text   C:Program FilesMozilla Firefoxplugin-container.exe[3504] USER32.dll!RegisterMessagePumpHook + 2F1                                      75588B9E 7 Bytes  JMP 5AC5464A C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation).text   C:Program FilesMozilla Firefoxplugin-container.exe[3504] USER32.dll!IsDialogMessageW + 340                                             75594444 1 Byte  [E9].text   C:Program FilesMozilla Firefoxplugin-container.exe[3504] USER32.dll!IsDialogMessageW + 340                                             75594444 7 Bytes  JMP 5AC545D9 C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation).text   C:Program FilesMozilla Firefoxplugin-container.exe[3504] USER32.dll!GetWindowInfo                                                      75594B5E 5 Bytes  JMP 5A8AA642 C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation).text   C:Program FilesMozilla Firefoxplugin-container.exe[3504] USER32.dll!ToUnicodeEx + 71                                                   755A2223 7 Bytes  JMP 5A8AAC18 C:Program FilesMozilla Firefoxxul.dll (Mozilla Foundation).text   C:Program FilesTortoiseSVNbinTSVNCache.exe[3900] kernel32.dll!SetUnhandledExceptionFilter + 2                                         7642F4FD 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}---- Kernel IAT/EAT - GMER 2.0 ----IAT     SystemRootsystem32driversatapi.sys[ataport.SYS!AtaPortReadPortUchar]                                                                  [8BA23730] SystemRootSystem32Driverssptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)IAT     SystemRootsystem32driversatapi.sys[ataport.SYS!AtaPortWritePortUchar]                                                                 [8BA23F12] SystemRootSystem32Driverssptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)IAT     SystemRootsystem32driversatapi.sys[ataport.SYS!AtaPortWritePortUlong]                                                                 [8BA24232] SystemRootSystem32Driverssptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)IAT     SystemRootsystem32driversatapi.sys[ataport.SYS!AtaPortWritePortBufferUshort]                                                          [8BA240F0] SystemRootSystem32Driverssptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)IAT     SystemRootsystem32driversatapi.sys[ataport.SYS!AtaPortReadPortBufferUshort]                                                           [8BA23914] SystemRootSystem32Driverssptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)---- User IAT/EAT - GMER 2.0 ----IAT     C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] @ C:Windowssystem32WININET.dll [KERNEL32.dll!MoveFileExW]  00010090IAT     C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] @ C:Windowssystem32SHELL32.dll [USER32.dll!GetFocus]       002E0790IAT     C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] @ C:Windowssystem32SHELL32.dll [USER32.dll!GetKeyState]    002E07D0IAT     C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] @ C:Windowssystem32SHELL32.dll [KERNEL32.dll!MoveFileExW]  00010090IAT     C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_135.exe[2548] @ C:Windowssystem32USERENV.dll [KERNEL32.dll!MoveFileExW]  00010090---- Registry - GMER 2.0 ----Reg     HKLMSYSTEMCurrentControlSetservicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC                                                          Reg     HKLMSYSTEMCurrentControlSetservicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                       0x00 0x00 0x00 0x00 ...Reg     HKLMSYSTEMCurrentControlSetservicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                       0Reg     HKLMSYSTEMCurrentControlSetservicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                    0xC4 0xF5 0xF7 0xA6 ...Reg     HKLMSYSTEMCurrentControlSetservicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                       C:Program FilesDAEMON Tools LiteReg     HKLMSYSTEMCurrentControlSetservicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC00000001                                                 Reg     HKLMSYSTEMCurrentControlSetservicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC00000001@a0                                              0xA0 0x02 0x00 0x00 ...Reg     HKLMSYSTEMCurrentControlSetservicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC00000001@hdf12                                           0xFC 0x0B 0xF5 0x26 ...Reg     HKLMSYSTEMCurrentControlSetservicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC00000001gdq0                                            Reg     HKLMSYSTEMCurrentControlSetservicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC00000001gdq0@hdf12                                      0xC6 0x61 0xE8 0xCF ...Reg     HKLMSYSTEMControlSet002servicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                      Reg     HKLMSYSTEMControlSet002servicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                           0x00 0x00 0x00 0x00 ...Reg     HKLMSYSTEMControlSet002servicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                           0Reg     HKLMSYSTEMControlSet002servicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                        0x42 0x56 0x2F 0x86 ...Reg     HKLMSYSTEMControlSet002servicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                           C:Program FilesDAEMON Tools LiteReg     HKLMSYSTEMControlSet002servicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC00000001 (not active ControlSet)                             Reg     HKLMSYSTEMControlSet002servicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC00000001@a0                                                  0xA0 0x02 0x00 0x00 ...Reg     HKLMSYSTEMControlSet002servicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC00000001@hdf12                                               0xFC 0x0B 0xF5 0x26 ...Reg     HKLMSYSTEMControlSet002servicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC00000001gdq0 (not active ControlSet)                        Reg     HKLMSYSTEMControlSet002servicessptdCfg14919EA49A8F3B4AA3CF1058D9A64CEC00000001gdq0@hdf12                                          0xC6 0x61 0xE8 0xCF ...---- EOF - GMER 2.0 ----

11 януари 201313 г.

Лог файла е чист...Не мисля, че са нужни повече и по-дълбоки проверки.

MBR също е наред. Няма индикации за повече зарази в системата.

Все пак като допълнителна проверка можете да направите едно сканиране с HitmanPro и с Emsisoft Emergency Kit

Време е да почистим тогава:

Изтеглете OTC.exe и го стартирайте. Натиснете бутона CleanUp!.
Рестартирайте компютъра, ако ви попита!

Изтеглете Delfix.exe и го стартирайте. Сложете отметка пред Remove disinfection tools => натиснете бутона Run

Инструмента ще се самоизтрие след като приключи своята задача!

Изтрийте всички файлове и папки от използваните инструменти ръчно, ако не са се изтрили след гореспоменатите процедури!

Желая ви приятна и спокойна вечер!

14 януари 201313 г.

Автор

Мерси, и на вас! Извинете ме за късният отговор, но бях зает :Д

Добре дошли!

igfxext.exe и може би други вредители.

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)