Proelium[PL] :: Zobacz temat

id:813 · Wysłany: 2012-12-08, 19:11 **Bump.exe, Find.exe, cmd.exe**

Ostatnimi czasy postanowiĹem aktywowaÄ windows 7 poprzez program chew7. JakoĹ wczoraj zaczÄĹy wyskakiwaÄ mi procesy Bump.exe, Find.exe, cmd.exe, ktĂłre z tego co wiem strasznie obciÄĹźajÄ procesor (w moim przypadku to 20%). Czy ktoĹ moĹźe wie jak te procesy usunÄÄ?

Parametry:
AMD FX(tm)-6100 Six-Core Processor, 3292 MHz
PamiÄÄ 2gb ddr3 goodram
ATI Radeon HD 4800 Series 4890 model bodajrze

Log z combofix (MoĹźe siÄ przyda):
ComboFix 12-12-04.01 - Bartek 2012-12-06 18:44:13.1.6 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.48.1045.18.2028.1304 [GMT 1:00]
Uruchomiony z: c:\users\Bartek\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Utworzono nowy punkt przywracania
.
.
((((((((((((((((((((((((((((((((((((((( UsuniÄto )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\CFLog
c:\cflog\CrashLog_20120326.txt
c:\cflog\CrashLog_20120401.txt
c:\cflog\CrashLog_20120414.txt
c:\cflog\CrashLog_20121105.txt
c:\cflog\CrashLog_20121117.txt
c:\program files (x86)\Java\jre7\bin\ssv.dll
.
.
((((((((((((((((((((((((( Pliki utworzone od 2012-11-06 do 2012-12-06 )))))))))))))))))))))))))))))))
.
.
2012-12-06 17:48 . 2012-12-06 17:48 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-12-06 17:48 . 2012-12-06 17:48 -------- d-----w- c:\users\Bartek\AppData\Local\temp
2012-12-04 11:41 . 2012-12-04 11:41 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-12-04 11:41 . 2012-12-04 11:40 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-12-04 11:41 . 2012-12-04 11:40 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-11-23 19:47 . 2012-11-23 19:47 2169856 --sha-w- c:\windows\system32\hale.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-04 11:40 . 2012-04-10 20:30 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-11-23 19:48 . 2012-03-06 18:07 419840 ----a-w- c:\windows\system32\systemcpl.dll
2012-11-23 19:48 . 2009-07-13 23:52 65536 ----a-w- c:\windows\system32\sppuinotify.dll
2012-11-23 19:48 . 2009-07-13 23:51 381952 ----a-w- c:\windows\system32\sppcommdlg.dll
2012-11-23 19:48 . 2012-03-06 18:07 1008128 ----a-w- c:\windows\system32\user32.dll
2012-11-23 19:48 . 2009-07-13 23:52 142336 ----a-w- c:\windows\system32\sppwmi.dll
2012-11-23 19:48 . 2012-03-06 18:07 15360 ----a-w- c:\windows\system32\slwga.dll
2012-11-23 19:47 . 2012-03-06 18:08 349696 ----a-w- c:\windows\system32\slui.exe
2012-11-23 19:47 . 2012-03-06 18:08 389632 ----a-w- c:\windows\system32\winlogon.exe
2012-11-23 19:47 . 2009-07-13 23:57 2048 ----a-w- c:\windows\system32\winver.exe
2012-11-23 19:47 . 2009-06-10 20:59 107946 ----a-w- c:\windows\system32\slmgr.vbs
2012-09-19 00:12 . 2012-08-14 00:09 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D9E0D47F-B092-424C-8DE7-F743AD554A52}\offreg.dll
2012-09-13 18:04 . 2012-09-13 18:04 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
2012-09-13 18:04 . 2012-09-13 18:04 1700352 ----a-w- c:\windows\SysWow64\gdiplus.dll
2012-09-13 18:04 . 2012-09-13 18:04 1060864 ----a-w- c:\windows\SysWow64\mfc71.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2010-11-20 . 1151B1BAA6F350B1DB6598E0FEA7C457 . 390656 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[7] 2009-07-14 . 132328DF455B0028F13BF0ABEE51A63A . 389120 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[-] 2012-11-23 . 87A00ED70FEC36D0DD968E5058C29AA1 . 389632 . . [6.1.7601.17514] .. c:\windows\system32\winlogon.exe
.
[7] 2010-11-20 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
[7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[-] 2012-11-23 . D186BABDFAE7C0D93C9F6AE63957EE96 . 1008128 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyĹlne, prawidĹowe wpisy nie sÄ pokazane
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IPLA!"="c:\program files (x86)\ipla\ipla.exe" [2012-05-11 19858432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-07-04 641704]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-08-29 1996200]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-03-05 53888]
R2 E4LOADER;General Purpose USB Driver (e4ldrx64.sys);c:\windows\system32\Drivers\e4ldrx64.sys [2007-01-04 71832]
R3 AsrCDDrv;AsrCDDrv;c:\windows\SysWOW64\Drivers\AsrCDDrv.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;UsĹuga Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-04-04 1255736]
R3 X6va005;X6va005;c:\users\Bartek\AppData\Local\Temp\005B250.tmp [x]
R3 X6va006;X6va006;c:\users\Bartek\AppData\Local\Temp\006FDED.tmp [x]
R3 X6va007;X6va007;c:\users\Bartek\AppData\Local\Temp\007468.tmp [x]
R3 X6va008;X6va008;c:\windows\SysWOW64\Drivers\X6va008 [x]
R3 X6va009;X6va009;c:\windows\SysWOW64\Drivers\X6va009 [x]
R3 X6va010;X6va010;c:\windows\SysWOW64\Drivers\X6va010 [x]
R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2012-03-06 834544]
S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [2011-05-10 17192]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-07-04 238080]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-07-03 361984]
S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-03-05 53888]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-08-29 2369960]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-02-23 95760]
S3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\DRIVERS\e4usbawx64.sys [2007-01-04 146968]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys [2011-07-29 56960]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys [2011-07-29 79104]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [2009-11-17 32344]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-04-21 471144]
.
.
ZawartoĹÄ folderu 'Zaplanowane zadania'
.
2012-12-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2565071774-4042895602-966426228-1000Core.job
- c:\users\Bartek\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-19 19:42]
.
2012-12-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2565071774-4042895602-966426228-1000UA.job
- c:\users\Bartek\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-19 19:42]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Chew7Hale"="c:\windows\System32\hale.exe" [2012-11-23 2169856]
.
------- Skan uzupeĹniajÄcy -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&ksport do programu Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: Interfaces\{567E765A-B7B7-439F-8B58-4F6648059262}: NameServer = 62.233.233.233 87.204.204.204
FF - ProfilePath - c:\users\Bartek\AppData\Roaming\Mozilla\Firefox\Profiles\zxb3q1kp.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:blank
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=110819&babsrc=KW_ss&mntrId=b2607ef8000000000000000000000000&q=
FF - user.js: extensions.searchya.autoRvrt - false
FF - user.js: extensions.searchya_i.hmpg - true
FF - user.js: extensions.searchya_i.hmpgUrl - hxxp://searchya.com/?chnl=tst-215&s=0&cr=467983840&cd=2XzutAtN2Y1L1Qzu0B0CyD0F0FyEtBtC0CtAzytAtDyB0E0FzztN0D0TzutBtDtCtBtDyEtDtB
FF - user.js: extensions.searchya_i.dfltSrch - true
FF - user.js: extensions.searchya.srchPrvdr - SearchYa!
FF - user.js: extensions.searchya_i.dnsErr - true
FF - user.js: extensions.searchya_i.newTab - true
FF - user.js: extensions.searchya.newTabUrl - hxxp://searchya.com/?chnl=tst-215&s=2&cr=467983840&cd=2XzutAtN2Y1L1Qzu0B0CyD0F0FyEtBtC0CtAzytAtDyB0E0FzztN0D0TzutBtDtCtBtDyEtDtB
FF - user.js: extensions.searchya.tlbrSrchUrl - hxxp://searchya.com/?chnl=tst-215&s=3&cr=467983840&cd=2XzutAtN2Y1L1Qzu0B0CyD0F0FyEtBtC0CtAzytAtDyB0E0FzztN0D0TzutBtDtCtBtDyEtDtB&q=
FF - user.js: extensions.searchya.id - b2607ef8000000000000000000000000
FF - user.js: extensions.searchya.instlDay - 15432
FF - user.js: extensions.searchya.vrsn - 1.5.20.2
FF - user.js: extensions.searchya.vrsni - 1.5.20.2
FF - user.js: extensions.searchya_i.vrsnTs - 1.5.20.217:06
FF - user.js: extensions.searchya.prtnrId - ironsrc
FF - user.js: extensions.searchya.prdct - searchya
FF - user.js: extensions.searchya.aflt - foxtab
FF - user.js: extensions.searchya_i.smplGrp - none
FF - user.js: extensions.searchya.tlbrId - base
FF - user.js: extensions.searchya.instlRef - tst-215
FF - user.js: extensions.searchya.dfltLng -
FF - user.js: extensions.searchya.excTlbr - false
FF - user.js: extensions.searchya.admin - false
FF - user.js: extensions.funmoods.autoRvrt - false
FF - user.js: extensions.funmoods_i.hmpg - true
FF - user.js: extensions.funmoods_i.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=ironto
FF - user.js: extensions.funmoods_i.dfltSrch - true
FF - user.js: extensions.funmoods.srchPrvdr - Search
FF - user.js: extensions.funmoods_i.dnsErr - true
FF - user.js: extensions.funmoods_i.newTab - true
FF - user.js: extensions.funmoods.newTabUrl - hxxp://start.funmoods.com/?f=2&a=ironto
FF - user.js: extensions.funmoods.tlbrSrchUrl - hxxp://start.funmoods.com/results.php?f=3&a=ironto&q=
FF - user.js: extensions.funmoods.id - b2607ef8000000000000000000000000
FF - user.js: extensions.funmoods.instlDay - 15432
FF - user.js: extensions.funmoods.vrsn - 1.5.19.3
FF - user.js: extensions.funmoods.vrsni - 1.5.19.3
FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.19.317:10
FF - user.js: extensions.funmoods.prtnrId - funmoods
FF - user.js: extensions.funmoods.prdct - funmoods
FF - user.js: extensions.funmoods.aflt - ironto
FF - user.js: extensions.funmoods_i.smplGrp - none
FF - user.js: extensions.funmoods.tlbrId - base
FF - user.js: extensions.funmoods.instlRef -
FF - user.js: extensions.funmoods.dfltLng -
FF - user.js: extensions.funmoods.excTlbr - false
FF - user.js: extensions.funmoods.admin - false
user_pref('extensions.dealply.partner', 'iron');
user_pref('extensions.dealply.channel', 'iron3');
user_pref('extensions.dealply.installId', 'v23600215582581191303232012040217104527');
user_pref('extensions.dealply.installIdSource', 'inst');
user_pref('extensions.dealply.sampleGroup', '7');
FF - user.js: extensions.BabylonToolbar_i.id - b2607ef8000000000000000000000000
FF - user.js: extensions.BabylonToolbar_i.hardId - b2607ef8000000000000000000000000
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15452
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1718:04
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110819
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - USUNIÄTO PUSTE WPISY - - - -
.
Wow6432Node-HKCU-Run-uTorrent - c:\program files (x86)\uTorrent\uTorrent.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va005]
"ImagePath"="\??\c:\users\Bartek\AppData\Local\Temp\005B250.tmp"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va006]
"ImagePath"="\??\c:\users\Bartek\AppData\Local\Temp\006FDED.tmp"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va007]
"ImagePath"="\??\c:\users\Bartek\AppData\Local\Temp\007468.tmp"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va008]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va008"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va009]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va009"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va010]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va010"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va011]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Czas ukoĹczenia: 2012-12-06 18:50:28
ComboFix-quarantined-files.txt 2012-12-06 17:50
.
Przed: 19Â 692Â 498Â 944 bajtĂłw wolnych
Po: 19Â 586Â 023Â 424 bajtĂłw wolnych
.
- - End Of File - - F09C085741B7788E44EAC036C0339DA2

6^6*656-3427+12! · Wysłany: 2012-12-08, 19:41

TwĂłj komputer doĹÄczyĹ do bot-net'a z nisko-poziomowym rootkit'em, ktĂłry zostaĹ napisany przez hackera

https://www.virustotal.co...e16b7/analysis/
http://forum.purepc.pl/to...i/#entry3685113
http://exefreeware.blogsp...ersion-and.html

id:813 · Wysłany: 2012-12-08, 20:03

Extra, tylko teraz powiedz mi jak to usunÄÄ...format?

id:813 · Wysłany: 2012-12-08, 20:05

Aha...JuĹź pobieram program....Skanuje go jeszcze bit defenderem 2012, moĹźe coĹ to da

AWM / XM8 · Wysłany: 2012-12-08, 21:27

hmm Bruni

nie podpuszczam Cie

ale nie przerobil bys tego by dzialalo w turbo Pascalu

6^6*656-3427+12! · Wysłany: 2012-12-08, 21:46

Nie jestem programistÄ

Umiem, ale nie lubiÄ :-D

id:813 · Wysłany: 2012-12-09, 14:00

Ok... Teraz tylko problem taki, Ĺźe program coĹ wykrywa, niby usuwa, czyĹci system, ale procesy dalej sÄ...Szukam w tym momencie jakiĹ tutorial do tego programu bo moĹźe ja coĹ robie Ĺşle... Ewentualnie jeĹli bruni masz ten program w jednym palcu to mĂłgĹbyĹ coĹ poradziÄ na to......

Ps. Tak prawdopodobnie jestem za gĹupi na ten program

id:813 · Wysłany: 2012-12-09, 14:44

Ok teraz sprawa wyglÄda tak: znĂłw muszÄ aktywowaÄ windowsa, plik taki jak hale.exe jest nie do znalezienia by usunÄÄ, ale jest na staĹe w procesach i moge go wyĹÄczyÄ co daje 100% powodzenie.... Teraz tylko musze usunÄÄ plik hale.exe i reszte tego syfu... Jak macie jakieĹ pomysĹy gdzie to moĹźe siedzieÄ to piszcie..Procesor w tym momencie przy gothicu 3 na full 2%-7% a nie 70%

6^6*656-3427+12! · Wysłany: 2012-12-09, 17:06

TwĂłj komputer ma rootkit'a, ktĂłrego sam zainstalowaĹeĹ. Tego nie usuniesz w prosty sposĂłb, w Twoim przypadku najlepiej zrobiÄ format'a i kupiÄ oryginalnego Windows 7 HOME za niecaĹe 350 PLN.

id:813 · Wysłany: 2012-12-10, 19:04

WĹaĹnie szykuje komputer do formatowania... TakĹźe jak bÄdzie wszystko cacy to wrĂłce do gry

id:813 · Wysłany: 2012-12-10, 23:38

Jest udaĹo siÄ bez formata, ale mam tak naje$%^&* w systemie, Ĺźe sam siÄ za gĹowe ĹapiÄ.... Teraz tylko bruni powiedz mi o pliku user32.dll. Mam go juz na komputerze, ale zostaĹ mi siÄ plik po starym: user32.Dll.BAK - Czy jest taka opcja Ĺźeby po tym pliku BAK daĹo siÄ cofnÄÄ mĂłj stary user32.Dll? z tego co siÄ domyĹlam to chyba skrĂłt bak od tego jest.... ;S (nie jestem informatykiem, stworzenie mojego komputera jak i system w nim to wynik przypuszczeĹ xD)

6^6*656-3427+12! · Wysłany: 2012-12-11, 23:55

http://support.microsoft.com/kb/142676/pl poczytaj sobie :-D