Проблем с mozilla

2 април 201412 г.

Автор

Опитахте ли с преинсталация на Mozilla...?

Не, не исках да правя нищо, докато не получа вашия съвет. Заемам се с преинсталацията.Благодаря!

3 април 201412 г.

Автор

Дадох деинсталиране на мозила, инсталирах от сайта, който посочихте, сваляше се и отдолу пишеше, че след приключване на зареждането, мозила ще се стартира автоматично. Да,ама не. Помислих, че пак нещо съм объркала и пак стартира .ехе файла. Като се свали ми се отвори прозорец, че мозила вече работи/отворена е, да я затворя и отворя отново. Само че аз не виждам да е отворена мозилата. Някакви препоръки какво да правя от сега нататък?

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

4 април 201412 г.

Хм...! Да не сме пропуснали някой бацил...Да направим следната проверка:

Изтеглете ComboFix от тук и го запазете на десктопа си.
How to use ComboFix
Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.
Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to disable your security applications by amateur
Стартирайте Combo-Fix.com и следвайте инструкциите.
Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:ComboFix.txt в следващия Ви коментар в тази тема.
Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

4 април 201412 г.

Автор

Хм...! Да не сме пропуснали някой бацил...Да направим следната проверка:

Изтеглете ComboFix от тук и го запазете на десктопа си.

How to use ComboFix

Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to disable your security applications by amateur

Стартирайте Combo-Fix.com и следвайте инструкциите.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:ComboFix.txt в следващия Ви коментар в тази тема.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

Изключих антивирусната програма, но такова нещо като антишпионска-нищо не ми говори, а и от тези изброените на дадения от вас сайт нямах никоя инсталирана, освен AVG. Резултат:

ComboFix 14-04-03.01 - Magdalena 04.2014 г. 18:53:13.3.4 - x64

Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1026.18.6051.4179 [GMT 3:00]

Running from: c:usersMagdalenaDesktopComboFix.exe

AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

SP: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:windowsSysWow64Packet.dll

c:windowsSysWow64pthreadVC.dll

c:windowsSysWow64wpcap.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------Legacy_NPF

-------Service_npf

.

((((((((((((((((((((((((( Files Created from 2014-03-04 to 2014-04-04 )))))))))))))))))))))))))))))))

.

2014-04-04 16:46 . 2014-03-17 07:16 10521840 ----a-w- c:programdataMicrosoftWindows DefenderDefinition Updates{057E6868-CED0-4406-BEE7-CBEABEA8E828}mpengine.dll

2014-04-04 16:03 . 2014-04-04 16:03 -------- d-----w- c:usersUpdatusUserAppDataLocaltemp

2014-04-04 16:03 . 2014-04-04 16:03 -------- d-----w- c:usersPublicAppDataLocaltemp

2014-04-04 16:03 . 2014-04-04 16:03 -------- d-----w- c:usersDefaultAppDataLocaltemp

2014-04-03 17:01 . 2014-04-04 16:44 -------- d-----w- c:program files (x86)Mozilla Maintenance Service

2014-04-03 16:53 . 2014-04-03 16:53 282880 ----a-w- c:program files (x86)Firefox Setup Stub 28.0.exe

2014-04-01 05:19 . 2014-04-02 19:09 -------- d-----w- c:usersMagdalenaAppDataLocalCrashDumps

2014-03-31 19:50 . 2014-03-31 19:50 -------- d-----w- c:program files (x86)ESET

2014-03-31 19:38 . 2014-03-31 19:48 -------- d-----w- c:programdataHitmanPro

2014-03-26 19:14 . 2014-03-26 19:14 -------- d-----w- c:windowsERUNT

2014-03-25 20:00 . 2014-03-26 18:02 -------- d-----w- C:AdwCleaner

2014-03-25 18:46 . 2014-04-01 18:45 -------- d-----w- C:FRST

2014-03-11 21:21 . 2014-01-28 02:32 228864 ----a-w- c:windowssystem32wwansvc.dll

2014-03-11 21:20 . 2014-01-29 02:32 484864 ----a-w- c:windowssystem32wer.dll

2014-03-11 21:20 . 2014-01-29 02:06 381440 ----a-w- c:windowsSysWow64wer.dll

2014-03-11 21:19 . 2014-02-07 01:23 3156480 ----a-w- c:windowssystem32win32k.sys

2014-03-11 21:07 . 2014-02-04 02:32 624128 ----a-w- c:windowssystem32qedit.dll

2014-03-11 21:07 . 2014-02-04 02:04 509440 ----a-w- c:windowsSysWow64qedit.dll

2014-03-11 21:07 . 2014-02-04 02:32 1424384 ----a-w- c:windowssystem32WindowsCodecs.dll

2014-03-11 21:07 . 2014-02-04 02:04 1230336 ----a-w- c:windowsSysWow64WindowsCodecs.dll

2014-03-11 20:32 . 2014-03-11 20:32 5777288 ----a-w- c:windowsSysWow64FlashPlayerInstaller.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-03-31 06:35 . 2011-12-01 16:46 270496 ------w- c:windowssystem32MpSigStub.exe

2014-03-21 17:37 . 2011-12-01 17:51 90015360 ----a-w- c:windowssystem32MRT.exe

2014-03-17 07:16 . 2014-04-04 16:47 10521840 ----a-w- c:programdataMicrosoftWindows DefenderDefinition Updates{86E6E6EE-48E1-4DF9-B76B-5EEEEB95E113}mpengine.dll

2014-03-11 20:32 . 2012-04-03 08:20 692616 ----a-w- c:windowsSysWow64FlashPlayerApp.exe

2014-03-11 20:32 . 2011-12-01 16:54 71048 ----a-w- c:windowsSysWow64FlashPlayerCPLApp.cpl

2010-01-26 15:11 . 2013-08-18 07:58 444283 ----a-w- c:program filesCommon FilesWinPcapNmap.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]

"uTorrent"="c:usersMagdalenaAppDataRoaminguTorrentuTorrent.exe" [2014-01-30 905296]

"Sidebar"="c:program filesWindows Sidebarsidebar.exe" [2010-11-20 1475584]

"Skype"="c:program files (x86)SkypePhoneSkype.exe" [2014-02-10 20922016]

.

[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun]

"ModemListener"="d:install'sVIVACOM 3G USB MODEMModemListener.exe" [2010-01-27 98304]

"AVG_UI"="c:program files (x86)AVGAVG2014avgui.exe" [2014-03-19 4971024]

"Adobe ARM"="c:program files (x86)Common FilesAdobeARM1.0AdobeARM.exe" [2013-04-04 958576]

.

c:usersMagdalenaAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup

VDownloader.lnk - d:install'sVDownloaderVDownloader.exe /silent [2013-8-18 822272]

.

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINEsoftwarewow6432nodemicrosoftwindows ntcurrentversionwindows]

"AppInit_DLLs"=c:windowsSysWOW64nvinit.dll

.

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalhitmanpro37]

@=""

.

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalhitmanpro37.sys]

@=""

.

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWdf01000.sys]

@="Driver"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:windowsMicrosoft.NETFramework64v4.0.30319mscorsvw.exe;c:windowsMicrosoft.NETFramework64v4.0.30319mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:program files (x86)SkypeUpdaterUpdater.exe;c:program files (x86)SkypeUpdaterUpdater.exe [x]

R2 VIVACOM 3G USB Modem. RunOuc;VIVACOM 3G USB Modem. OUC;d:install'sVIVACOM 3G USB ModemUpdateDogouc.exe;d:install'sVIVACOM 3G USB ModemUpdateDogouc.exe [x]

R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:windowssystem32DRIVERSamppal.sys;c:windowsSYSNATIVEDRIVERSamppal.sys [x]

R3 btmaudio;Intel Bluetooth Audio Service;c:windowssystem32driversbtmaud.sys;c:windowsSYSNATIVEdriversbtmaud.sys [x]

R3 btmhsf;btmhsf;c:windowssystem32DRIVERSbtmhsf.sys;c:windowsSYSNATIVEDRIVERSbtmhsf.sys [x]

R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:windowssystem32DRIVERSew_hwusbdev.sys;c:windowsSYSNATIVEDRIVERSew_hwusbdev.sys [x]

R3 huawei_cdcacm;huawei_cdcacm;c:windowssystem32DRIVERSew_jucdcacm.sys;c:windowsSYSNATIVEDRIVERSew_jucdcacm.sys [x]

R3 iBtFltCoex;iBtFltCoex;c:windowssystem32DRIVERSiBtFltCoex.sys;c:windowsSYSNATIVEDRIVERSiBtFltCoex.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:windowssystem32IEEtwCollector.exe;c:windowsSYSNATIVEIEEtwCollector.exe [x]

R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:windowssystem32driversintelaud.sys;c:windowsSYSNATIVEdriversintelaud.sys [x]

R3 jrdusbser;Mobile Connector Device for Legacy Serial Communication;c:windowssystem32DRIVERSjrdusbser.sys;c:windowsSYSNATIVEDRIVERSjrdusbser.sys [x]

R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:program filesIntelWiFibinPanDhcpDns.exe;c:program filesIntelWiFibinPanDhcpDns.exe [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys;c:windowsSYSNATIVEdriversrdpvideominiport.sys [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:windowssystem32DriversRtsUStor.sys;c:windowsSYSNATIVEDriversRtsUStor.sys [x]

R3 Synth3dVsc;Synth3dVsc;c:windowssystem32driverssynth3dvsc.sys;c:windowsSYSNATIVEdriverssynth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:windowssystem32driverstsusbflt.sys;c:windowsSYSNATIVEdriverstsusbflt.sys [x]

R3 tsusbhub;tsusbhub;c:windowssystem32driverstsusbhub.sys;c:windowsSYSNATIVEdriverstsusbhub.sys [x]

R3 VGPU;VGPU;c:windowssystem32driversrdvgkmd.sys;c:windowsSYSNATIVEdriversrdvgkmd.sys [x]

R3 WatAdminSvc;Услуга на технологиите за активиране на Windows;c:windowssystem32WatWatAdminSvc.exe;c:windowsSYSNATIVEWatWatAdminSvc.exe [x]

S0 AVGIDSHA;AVGIDSHA;c:windowssystem32DRIVERSavgidsha.sys;c:windowsSYSNATIVEDRIVERSavgidsha.sys [x]

S0 Avgloga;AVG Logging Driver;c:windowssystem32DRIVERSavgloga.sys;c:windowsSYSNATIVEDRIVERSavgloga.sys [x]

S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:windowssystem32DRIVERSavgmfx64.sys;c:windowsSYSNATIVEDRIVERSavgmfx64.sys [x]

S0 Avgrkx64;AVG Anti-Rootkit Driver;c:windowssystem32DRIVERSavgrkx64.sys;c:windowsSYSNATIVEDRIVERSavgrkx64.sys [x]

S0 nvpciflt;nvpciflt;c:windowssystem32DRIVERSnvpciflt.sys;c:windowsSYSNATIVEDRIVERSnvpciflt.sys [x]

S1 Avgdiska;AVG Disk Driver;c:windowssystem32DRIVERSavgdiska.sys;c:windowsSYSNATIVEDRIVERSavgdiska.sys [x]

S1 AVGIDSDriver;AVGIDSDriver;c:windowssystem32DRIVERSavgidsdrivera.sys;c:windowsSYSNATIVEDRIVERSavgidsdrivera.sys [x]

S1 Avgldx64;AVG AVI Loader Driver;c:windowssystem32DRIVERSavgldx64.sys;c:windowsSYSNATIVEDRIVERSavgldx64.sys [x]

S1 Avgtdia;AVG TDI Driver;c:windowssystem32DRIVERSavgtdia.sys;c:windowsSYSNATIVEDRIVERSavgtdia.sys [x]

S2 AESTFilters;Andrea ST Filters Service;c:program filesIDTWDMAESTSr64.exe;c:program filesIDTWDMAESTSr64.exe [x]

S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:program filesIntelBluetoothHSBTHSAmpPalService.exe;c:program filesIntelBluetoothHSBTHSAmpPalService.exe [x]

S2 AVGIDSAgent;AVGIDSAgent;c:program files (x86)AVGAVG2014avgidsagent.exe;c:program files (x86)AVGAVG2014avgidsagent.exe [x]

S2 avgwd;AVG WatchDog;c:program files (x86)AVGAVG2014avgwdsvc.exe;c:program files (x86)AVGAVG2014avgwdsvc.exe [x]

S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:program files (x86)IntelBluetoothdevmonsrv.exe;c:program files (x86)IntelBluetoothdevmonsrv.exe [x]

S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:program filesIntelBluetoothHSBTHSSecurityMgr.exe;c:program filesIntelBluetoothHSBTHSSecurityMgr.exe [x]

S2 DeviceManager;DeviceManager;c:program files (x86)Common FilesDeviceHelperDeviceManager.exe;c:program files (x86)Common FilesDeviceHelperDeviceManager.exe [x]

S2 HWDeviceService64.exe;HWDeviceService64.exe;c:programdataDatacardServiceHWDeviceService64.exe;c:programdataDatacardServiceHWDeviceService64.exe [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:program files (x86)NVIDIA Corporation3D VisionnvSCPAPISvr.exe;c:program files (x86)NVIDIA Corporation3D VisionnvSCPAPISvr.exe [x]

S2 UNS;Intel® Management and Security Application User Notification Service;c:program files (x86)IntelIntel® Management Engine ComponentsUNSUNS.exe;c:program files (x86)IntelIntel® Management Engine ComponentsUNSUNS.exe [x]

S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:windowssystem32DRIVERSAMPPAL.sys;c:windowsSYSNATIVEDRIVERSAMPPAL.sys [x]

S3 btmaux;Intel Bluetooth Auxiliary Service;c:windowssystem32DRIVERSbtmaux.sys;c:windowsSYSNATIVEDRIVERSbtmaux.sys [x]

S3 huawei_enumerator;huawei_enumerator;c:windowssystem32DRIVERSew_jubusenum.sys;c:windowsSYSNATIVEDRIVERSew_jubusenum.sys [x]

S3 iwdbus;IWD Bus Enumerator;c:windowssystem32DRIVERSiwdbus.sys;c:windowsSYSNATIVEDRIVERSiwdbus.sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:windowssystem32DRIVERSnusb3hub.sys;c:windowsSYSNATIVEDRIVERSnusb3hub.sys [x]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:windowssystem32DRIVERSnusb3xhc.sys;c:windowsSYSNATIVEDRIVERSnusb3xhc.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32DRIVERSRt64win7.sys;c:windowsSYSNATIVEDRIVERSRt64win7.sys [x]

S3 usb3Hub;USB-IF USB 3.0 Hub;c:windowssystem32DRIVERSusb3Hub.sys;c:windowsSYSNATIVEDRIVERSusb3Hub.sys [x]

S3 XHCIPort;USB-IF xHCI USB Host Controller;c:windowssystem32DRIVERSXHCIPort.sys;c:windowsSYSNATIVEDRIVERSXHCIPort.sys [x]

.

Contents of the 'Scheduled Tasks' folder

.

2014-04-04 c:windowsTasksAdobe Flash Player Updater.job

- c:windowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe [2012-04-03 20:32]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

"BTMTrayAgent"="c:program files (x86)IntelBluetoothbtmshell.dll" [2010-11-03 10228224]

"IntelPAN"="c:program filesCommon FilesIntelWirelessCommoniFrmewrk.exe" [2011-07-27 1935120]

"Apoint"="c:program filesDellTPadApoint.exe" [2011-04-12 609144]

"SysTrayApp"="c:program filesIDTWDMsttray64.exe" [2011-05-27 1128448]

"IgfxTray"="c:windowssystem32igfxtray.exe" [2011-04-19 168216]

"HotKeysCmds"="c:windowssystem32hkcmd.exe" [2011-04-19 392472]

"Persistence"="c:windowssystem32igfxpers.exe" [2011-04-19 416024]

"NVHotkey"="c:windowssystem32nvHotkey.dll" [2011-04-21 312936]

"VDownloader"="d:install'sVDownloaderVDownloader.exe" [2013-08-17 822272]

.

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]

"AppInit_DLLs"=c:windowsSystem32nvinitx.dll

.

------- Supplementary Scan -------

.

uLocal Page = c:windowssystem32blank.htm

uStart Page = hxxp://www.google.com/

mLocal Page = c:windowsSysWOW64blank.htm

IE: E&xport to Microsoft Excel - c:progra~2MICROS~1Office12EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.0.1

TCP: Interfaces{7EE20ED0-8CCC-4718-9C10-14E82D6DD83F}: NameServer = 192.168.88.12 192.168.88.13

FF - ProfilePath - c:usersMagdalenaAppDataRoamingMozillaFirefoxProfilesfaesx0lq.default

FF - prefs.js: browser.startup.homepage - www.forum.bg-mamma.com

FF - prefs.js: network.proxy.type - 0

.

- - - - ORPHANS REMOVED - - - -

.

Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:windowsSystem32StikyNot.exe

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

AddRemove-oggcodecs - f:нова папкаoggcodecsuninst.exe

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERSS-1-5-21-151414521-1932448694-3614143933-1000SoftwareSecuROMLicense information*]

"datasecu"=hex:1a,c7,63,67,4e,e5,e0,20,d8,ef,b5,ad,76,44,80,b1,56,f9,7f,56,0c,

d6,2e,7a,e7,de,92,7d,92,a9,b1,c1,a2,44,e3,9a,a7,40,34,9c,5a,13,2b,fa,18,1d,

"rkeysecu"=hex:44,cd,8a,b8,b0,33,9b,fd,b8,d5,c5,90,0a,fb,3d,a1

.

[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:Windowssystem32MacromedFlashFlashUtil64_11_4_402_265_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}LocalServer32]

@="c:Windowssystem32MacromedFlashFlashUtil64_11_4_402_265_ActiveX.exe"

.

[HKEY_LOCAL_MACHINEsoftwareClassesCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINEsoftwareClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINEsoftwareClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINEsoftwareClassesInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:WindowsSysWOW64MacromedFlashFlashUtil32_11_4_402_265_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}LocalServer32]

@="c:WindowsSysWOW64MacromedFlashFlashUtil32_11_4_402_265_ActiveX.exe"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}InprocServer32]

@="c:WindowsSysWOW64MacromedFlashFlash32_11_4_402_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}ToolboxBitmap32]

@="c:WindowsSysWOW64MacromedFlashFlash32_11_4_402_265.ocx, 1"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}Version]

@="1.0"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}InprocServer32]

@="c:WindowsSysWOW64MacromedFlashFlash32_11_4_402_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}ToolboxBitmap32]

@="c:WindowsSysWOW64MacromedFlashFlash32_11_4_402_265.ocx, 1"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}Version]

@="1.0"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeInterface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINEsystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINEsystemControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0002AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINEsystemControlSet001ControlPCWSecurity]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:program files (x86)Common FilesAdobeARM1.0armsvc.exe

c:programdataVIVACOM 3G USB ModemOnlineUpdateouc.exe

c:program files (x86)IntelIntel® Management Engine ComponentsLMSLMS.exe

c:program files (x86)NVIDIA CorporationNVIDIA Updatusdaemonu.exe

.

**************************************************************************

.

Completion time: 2014-04-04 19:52:58 - machine was rebooted

ComboFix-quarantined-files.txt 2014-04-04 16:52

.

Pre-Run: 5 692 301 312 bytes free

Post-Run: 6 059 044 864 bytes free

.

- - End Of File - - 8A095C4C84A284CA3C6E796B2E0A067D

A36C5E4F47E84449FF07ED3517B43A31

След това ми се рестартира компютъра и на IE постоянно ми се появява съобщението: Предстой Ви да напуснете защитена интернет връзка. Ще стане възможно и други да виждат информацията, която изпращате. Желаете ли да продължите?"

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

4 април 201412 г.

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

KILLALL::File::install'sVDownloaderVDownloader.exec:usersMagdalenaAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupVDownloader.lnkFolder::c:program files (x86)ESETc:programdataHitmanProC:AdwCleanerC:FRSTRegNull::[HKEY_USERSS-1-5-21-151414521-1932448694-3614143933-1000SoftwareSecuROMLicense information*]

След съхранението преместете CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт копирайте и го поставете в следващия си коментар...!

5 април 201412 г.

Автор

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:
KILLALL::File::install'sVDownloaderVDownloader.exec:usersMagdalenaAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupVDownloader.lnkFolder::2014-03-31 19:50 . 2014-03-31 19:50 -------- d-----w- c:program files (x86)ESET2014-03-31 19:38 . 2014-03-31 19:48 -------- d-----w- c:programdataHitmanPro2014-03-25 20:00 . 2014-03-26 18:02 -------- d-----w- C:AdwCleaner2014-03-25 18:46 . 2014-04-01 18:45 -------- d-----w- C:FRSTRegNull::[HKEY_USERSS-1-5-21-151414521-1932448694-3614143933-1000SoftwareSecuROMLicense information*]
След съхранението преместете CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт копирайте и го поставете в следващия си коментар...!

Нещо съм объркала, не видях първия рапорт и пуснах повторно.

ComboFix 14-04-03.01 - Magdalena 04.2014 г. 11:23:32.5.4 - x64

Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1026.18.6051.4302 [GMT 3:00]

Running from: c:usersMagdalenaDesktopComboFix.exe

Command switches used :: c:usersMagdalenaDesktopCFScript.txt

AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

SP: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:usersMagdalenaAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupVDownloader.lnk"

"d:install'sVDownloaderVDownloader.exe"

.

((((((((((((((((((((((((( Files Created from 2014-03-05 to 2014-04-05 )))))))))))))))))))))))))))))))

.

2014-04-05 08:30 . 2014-04-05 08:30 -------- d-----w- c:usersUpdatusUserAppDataLocaltemp

2014-04-05 08:30 . 2014-04-05 08:30 -------- d-----w- c:usersPublicAppDataLocaltemp

2014-04-05 08:30 . 2014-04-05 08:30 -------- d-----w- c:usersDefaultAppDataLocaltemp

2014-04-04 16:47 . 2014-03-17 07:16 10521840 ----a-w- c:programdataMicrosoftWindows DefenderDefinition Updates{86E6E6EE-48E1-4DF9-B76B-5EEEEB95E113}mpengine.dll