qmkw.exe

[MarianAlexandru]

I just scanned my computer with MalwareBytes and it found Ardamax Trojan and and a Malware Packer gen: qmkw.exe (in my C:\ drive). I managed to manually remove ardamax trojan but can't remove the qmkw.exe

I attached the log file to this post. I would really appreciate if anyoune could help me remove this malware.

Thanks!

mbam-log-2012-12-27 (13-31-14).txt

[MarianAlexandru]

I just scanned my computer with MalwareBytes and it found Ardamax Trojan and and a Malware Packer gen: qmkw.exe (in my C:\ drive). I managed to manually remove ardamax trojan but can't remove the qmkw.exe

I attached the log file to this post. I would really appreciate if anyoune could help me remove this malware.

Thanks!

I forgot to mention that the virus blocks access to most anti-virus websites so I can't download any virus removal tools. I only have MalwareBytes. I performed a full scan, it only finds qmkw.exe, it removes the file and after reboot the virus it's back in my C:/ drive.

[MrCharlie]

Welcome to the forum, please start at the link below:

http://forums.malwar...?showtopic=9573

Post back the 2 logs here.....DDS.txt and Attach.txt

<====><====><====><====><====><====><====><====>

Next.......

Please remove any usb or external drives from the computer before you run this scan!

Quit all running programs.

Please download and run RogueKiller to your desktop.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 48 hours, please send me a PM)

[MarianAlexandru]

Here are the two logs from dds.scr

:

attach.txt

dds.txt

[MarianAlexandru]

And here's the report from Rogue Killer:

RKreport1_S_12272012_02d1629.txt

[MrCharlie]

You have some DNS entries in the log, do these look familiar:

~~~~~~~~~~~~~~~~~~~~~~~

Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
  
• Open the folder where the contents were unzipped and run mbar.exe
  
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  
• Wait while the system shuts down and the cleanup process is performed.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
  

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.

Verify that your system is now functioning normally.

MrC

[MarianAlexandru]

The first DNS (RCS&RDS) is my ISP but I have no idea what RNC is.

After MBAR scans the computer, it reboots to delete the files, after reboot MBAR finds the same threats. Also, after reboot I can't open the C drive by double-click, a window appears asking me to choose a program to open the C drive:

I managed to open the C drive by going to regedit and deleting all "mountpoints2" entries.(found this trick on the net)

Also if I try to open Windows Firewall in CPanel, this error shows up:

I click Yes and it works, but after reboot it happens again, I have to enable the ICS service each time.

Everything seems to work normally, except I can't access most anti-virus websites, and the qmkw.exe is always in C:/ drive.

Here are the 2 logs from MBAR:

mbar-log-2012-12-27 (19-15-56).txt

system-log.txt

[MarianAlexandru]

I looked into autorun.inf in C drive and here's what I found:

[AutoRun]

;Rpmbgndtjw GdqwlWwpRLYhakQsj

;noAymebxug gtjQx isiNhyfauk

sheLL\Open\DEFaUlT=1

;WVnF

sheLl\opeN\comMaNd =qmkw.exe

;djfQ lwrQ dvnJfjiTyGQoQyaFx uYgVc

OpEN =qmkw.exe

;kdohgu Xpbrp lfXmqtviwvcA

sHEll\explorE\CoMMaND = qmkw.exe

;PodfcKhRARB

ShELl\AUTopLAy\commANd =qmkw.exe

I tried deleting the autorun.inf or replacing it's code with this:

[AutoRun]

open=C:\windows\explorer.exe

but it doesn't work.

[MrCharlie]

First...have you run fixdamage tool??

Next.........

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[MarianAlexandru]

I ran fixdamage tool and C drive opens normally.

Here is the log from ComboFix:

ComboFix.txt

[MrCharlie]

Can you take a look into these two folders > do you recognize them:

c:\windows\system32\BHIRBL

c:\windows\system32\GIRMGU

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Using ComboFix......

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

4. If ComboFix wants to update.....please allow it to.

File::

C:\qmkw.exe

c:\windows\DUMP3cca.tmp

Registry::

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ShowDeskFix"=-

ClearJavaCache::

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.

After reboot, (in case it asks to reboot)......

Please provide the contents of the ComboFix log (C:\ComboFix.txt) in your next reply.

MrC

[MarianAlexandru]

GIRMGU is a virus, here I found ardamax keylogger and deleted it's files. I don't know about the first folder (BHIRBL), but I'm pretty sure it's a malware. I'll post combofix log here. One more thing to mention, the virus seems to damage combofix somehow. If i try to run CF I get this error:

If I want to run CF I have to download it everytime.

ComboFix.txt

[MrCharlie]

OK, delete these two folders:

c:\windows\system32\BHIRBL

c:\windows\system32\GIRMGU

~~~~~~~~~~~~~~~

ComboFix through up this error:

Cryptography Services Error !!

Microsoft has a fix for it, please run the "Fix It":

http://support.microsoft.com/kb/822798

~~~~~~~~~~~~~~~~~~

There's a lot of adware in your log also:

Please download AdwCleaner from here and save it on your Desktop.

1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
   
2. Now click on the Search tab.
   
3. Please post the contents of the log-file created in your next post.
   

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Please look over what was found, we're going to delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

MrC

[MarianAlexandru]

The FixIt from Microsoft didn't work, I still get the NSIS error when trying to open ComboFix.

I looked into AdwCleaner log and there's nothing I wan't to keep. Here's the log:

AdwCleanerR1.txt

[MrCharlie]

You only get the error when you run ComboFix?

~~~~~~~~~~~~~~~~~~~~~~~

Lots of adware found....lets clear it out.....

1. Please re-run AdwCleaner
   
2. Click on Delete button.
   
3. Confirm each time with OK if asked.
   
4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
   

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

MrC

[MarianAlexandru]

Yes, the error shows up only when opening ComboFix.

AdwCleanerS1.txt

[MrCharlie]

OK, I'm not going to worry about it if it's just ComboFix.

Howe's the computer running??

~~~~~~~~~~~~~~~~~~~

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt.
  
• Please Post the contents of that document.
  
• Do Not Attach It!!!
  

MrC

[MarianAlexandru]

The computer's running normally, but I still can't access anti-virus websites such as kasperksy or virustotal. The qmkw file doesn't appear in the C: drive anymore, though there's a new file now vafhd.exe (scanned it with MB and it's the same virus).

Here's the checkup.txt:

Results of screen317's Security Check version 0.99.56

Windows XP Service Pack 3 x86 (UAC is disabled!)

Internet Explorer 7 Out of date!

``````````````Antivirus/Firewall Check:``````````````

Windows Security Center service is not running! This report may not be accurate!

Please wait while WMIC compiles updated MOF files.

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.65.1.1000

JavaFX 2.1.1

Java 7 Update 9

Adobe Flash Player 11.5.502.135

Mozilla Firefox (17.0.1)

````````Process Check: objlist.exe by Laurent````````

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:: 18% Defragment your hard drive soon! (Do NOT defrag if SSD!)

````````````````````End of Log``````````````````````

[MrCharlie]

This is what seems to be on the system >> Ardamax Keylogger

http://www.ardamax.com/keylogger/

There's an uninstaller available for it.

MrC

[MarianAlexandru]

So ardamax keylogger prevents me from going to any ativirus website?

[MrCharlie]

So ardamax keylogger prevents me from going to any ativirus website?

No, but did you put this keylogger on the system??

MrC

[MarianAlexandru]

When I run the uninstaller it says Ardamax Keylogger not found.

[MarianAlexandru]

I have no idea how this keylogger got on my system.

[MrCharlie]

Did you run this uninstaller:

http://www.ardamax.com/downloads/aklremover.exe

Delete your copy of ComboFix and download a fresh one.

Now please run it and post the log.

MrC

[MarianAlexandru]

Yes I ran the uninstaller found on their website, I tried to run it from different locations with no result.

ComboFix log:

ComboFix 12-12-29.02 - Marian 29.12.2012 16:17:37.4.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1150.809 [GMT 2:00]

Running from: c:\documents and settings\Marian\Desktop\ComboFix.exe

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\autorun.inf

c:\documents and settings\Marian\Local Settings\Application Data\NGen.exe

D:\autorun.inf

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_AMSINT32

-------\Service_amsint32

.

.

((((((((((((((((((((((((( Files Created from 2012-11-28 to 2012-12-29 )))))))))))))))))))))))))))))))

.

.

2012-12-29 14:12 . 2012-12-29 14:12 92160 ----a-w- C:\aklremover.exe

2012-12-28 18:11 . 2012-12-29 00:21 103140 ----a-w- C:\vafhd.exe

2012-12-28 15:32 . 2012-12-29 14:08 -------- d-----w- c:\windows\system32\CatRoot2

2012-12-27 10:13 . 2012-12-27 10:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-12-27 10:13 . 2012-09-29 17:54 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-12-27 10:08 . 2012-12-27 10:08 -------- d-----w- C:\TDSSKiller_Quarantine

2012-12-22 22:08 . 2012-12-22 22:13 -------- d-----w- c:\documents and settings\Marian\Application Data\Realore All My Gods

2012-12-22 10:41 . 2012-12-22 10:41 -------- d-----w- c:\documents and settings\Marian\Application Data\AlawarEntertainment

2012-12-22 10:40 . 2012-12-22 10:40 -------- d-----w- C:\Downloads

2012-12-22 10:00 . 2012-12-22 10:05 -------- d-----w- c:\documents and settings\Marian\Application Data\adelantado_big_fish_en

2012-12-22 09:56 . 2012-12-22 10:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Big Fish Games

2012-12-22 09:54 . 2012-12-22 10:07 -------- d-----w- c:\documents and settings\All Users\Application Data\BigFishGamesCache

2012-12-19 22:13 . 2012-12-19 22:13 -------- d-----w- c:\documents and settings\Marian\Application Data\Canneverbe Limited

2012-12-19 22:13 . 2012-12-19 22:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Canneverbe Limited

2012-12-19 20:15 . 2012-12-29 00:32 -------- d-----w- c:\documents and settings\Marian\Application Data\vlc

2012-12-19 20:14 . 2012-12-19 20:14 -------- d-----w- c:\program files\VideoLAN

2012-12-18 14:31 . 2012-12-18 14:31 -------- d-----w- c:\program files\Axantum

2012-12-09 13:13 . 2012-12-10 20:44 -------- d-----w- c:\documents and settings\All Users\Application Data\notracks.com

2012-12-09 12:28 . 2012-11-22 13:10 380240 ----a-w- c:\windows\system32\EasyRedirect.dll

2012-12-03 17:38 . 2012-12-03 17:43 -------- d-----w- c:\documents and settings\Marian\Application Data\Charles

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-12-11 19:58 . 2012-08-18 13:38 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-12-11 19:58 . 2012-08-18 13:38 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-10-12 13:43 . 2012-08-18 14:14 821736 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-10-12 13:43 . 2012-08-18 14:14 746984 ----a-w- c:\windows\system32\deployJava1.dll

2012-12-06 06:27 . 2012-12-06 06:27 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys

[-] 2008-04-13 21:10 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys

[7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-03-12 81920]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\persistentroutes]

"62.75.206.182,255.255.255.255,10.10.13.113,1"=""

"173.245.61.58,255.255.255.255,10.10.13.113,1"=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"FirewallOverride"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"UacDisableNotify"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableNotifications"= 1 (0x1)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\WINDOWS\\system32\\taskmgr.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\ymsgr_tray.exe"=

"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=

"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"d:\\vipmetin2\\metin2client.bin"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Documents and Settings\\Marian\\Desktop\\mbar-1.01.0.1011\\mbar\\fixdamage.exe"=

"c:\\WINDOWS\\system32\\Ati2evxx.exe"=

"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbamgui.exe"=

"c:\\Documents and Settings\\Marian\\Desktop\\ComboFix.exe"=

"c:\\Program Files\\Microsoft Office\\OFFICE11\\POWERPNT.EXE"=

"c:\\Documents and Settings\\Marian\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=

"c:\\Documents and Settings\\Marian\\My Documents\\MSDCSC\\msdcsc.exe"=

"c:\\Program Files\\Glary Utilities\\initialize.exe"=

.

R0 d346bus;d346bus;c:\windows\system32\drivers\d346bus.sys [10/26/2012 9:35 PM 156800]

R0 d346prt;d346prt;c:\windows\system32\drivers\d346prt.sys [10/26/2012 9:35 PM 5248]

R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [12/27/2012 12:13 PM 399432]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [12/27/2012 12:13 PM 676936]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12/27/2012 12:13 PM 22856]

S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

.

2012-12-29 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-18 19:58]

.

2012-12-29 c:\windows\Tasks\GlaryInitialize.job

- c:\program files\Glary Utilities\initialize.exe [2012-08-19 23:22]

.

2012-12-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1177238915-1604221776-839522115-1003Core.job

- c:\documents and settings\Marian\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-09-16 11:09]

.

2012-12-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1177238915-1604221776-839522115-1003UA.job

- c:\documents and settings\Marian\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-09-16 11:09]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com

mStart Page = about:blank

IE: E&xport în Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Marian\Application Data\Mozilla\Firefox\Profiles\5rewtv1m.default-1352558750515\

FF - ExtSQL: 2012-11-10 16:51; {e4a8a97b-f2ed-450b-b12d-ee082ba24781}; c:\documents and settings\Marian\Application Data\Mozilla\Firefox\Profiles\5rewtv1m.default-1352558750515\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi

FF - ExtSQL: 2012-12-03 19:41; {3e9a3920-1b27-11da-8cd6-0800200c9a66}; c:\documents and settings\Marian\Application Data\Mozilla\Firefox\Profiles\5rewtv1m.default-1352558750515\extensions\{3e9a3920-1b27-11da-8cd6-0800200c9a66}.xpi

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-/sam/man - c:\documents and settings\Marian\Local Settings\Application Data\NGen.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-12-29 16:27

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-1177238915-1604221776-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(676)

c:\windows\system32\Ati2evxx.dll

.

- - - - - - - > 'explorer.exe'(2404)

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Java\jre7\bin\jqs.exe

c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe

.

**************************************************************************

.

Completion time: 2012-12-29 16:30:54 - machine was rebooted

ComboFix-quarantined-files.txt 2012-12-29 14:30

ComboFix2.txt 2012-12-28 11:27

ComboFix3.txt 2012-12-27 20:59

.

Pre-Run: 8.453.410.816 bytes free

Post-Run: 8.389.349.376 bytes free

.

- - End Of File - - 3A2A110CB12ACED06744CD3DF2CC7A70