Virtumonde

[faith72]

Ciao a tutti, su uno dei pc della mia azienda non si riesce a cancellare il virus in oggetto... ho fatto girare AVG antispyware e spybot search and destroy sia in modalità normale che provvisoria ma niente da fare; il virus è individuato e apparentemente cancellato ma dopo un pò risalta fuori....Sul pc è installato il trendmicro smb. Prima di formattare la macchina, posto il log di hijackthis, per chiunque abbia tempo e voglia di darci un'occhiata...
grazie in anticipo
Fede

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16.26.38, on 09/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programmi\InterBase Corp\InterBase\bin\ibguard.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Programmi\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\Programmi\Trend Micro\Client Server Security Agent\OfcPfwSvc.exe
C:\Programmi\InterBase Corp\InterBase\bin\ibserver.exe
C:\WINNT\TEMP\TDEF3E.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\PKL8LMST.exe
C:\Programmi\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINNT\system32\ctfmon.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\WINNT\system32\userinit.exe
C:\Programmi\Microsoft Office\Office\OSA.EXE
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arcoprofil.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.arcoprofil.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://securityresponse.symantec.com...r/fix_homepage
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [LMSPKL8] PKL8LMST.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Programmi\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [a0a62899] rundll32.exe "C:\WINNT\system32\entcblfg.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [internat.exe] internat.exe (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Programmi\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [internat.exe] internat.exe (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Programmi\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-21-1085031214-1614895754-1417001333-1109\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe (User 'PagliosaR')
O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Programmi\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Programmi\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Avvio Office.lnk = C:\Programmi\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office2k\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = arcoprofil.grp
O17 - HKLM\Software\..\Telephony: DomainName = arcoprofil.grp
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = arcoprofil.grp
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = arcoprofil.grp
O20 - AppInit_DLLs: NVDESK32.DLL,avgrsstx.dll
O23 - Service: InterBase Guardian (InterBaseGuardian) - InterBase Software Corp. - C:\Programmi\InterBase Corp\InterBase\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - InterBase Software Corp. - C:\Programmi\InterBase Corp\InterBase\bin\ibserver.exe
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\winnt\system32\mssrv32.exe
O23 - Service: Scansione in tempo reale di Trend Micro Client/Server Security Agent (ntrtscan) - Trend Micro Inc. - C:\Programmi\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Personal Firewall di Trend Micro Client/Server Security Agent (OfcPfwSvc) - Trend Micro Inc. - C:\Programmi\Trend Micro\Client Server Security Agent\OfcPfwSvc.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Programmi\Trend Micro\Client Server Security Agent\tmlisten.exe

--
End of file - 6100 bytes

[Deifobe]

scarica SystemScan, disconnetti il pc da internet => disattiva l'antivirus => esegui systemscan => clicca su "Scan Now". Finita la scansione, riattiva l'antivirus, carica il rapporto che trovi sul desktop su Savefile e posta il link ottenuto.

[faith72]

Ecco il link...
grazie ancora
http://www.savefile.com/files/1601309

[Deifobe]

1) Visto che il pc è aziendale, controlla questi i due servizi (vedi nelle proprietà)
C:\WINNT\system32\drivers\Ubh06.sys
C:\WINNT\system32\drivers\kqW28.sys
ma non credo proprio siano i vostri. In caso contrario, fermati che correggo lo script per avenger.

2) Virtumonde... ma forse non solo questo... lo vedremo con la scansione.

Scarica Avenger e CCleaner

Apri il blocco note e nella pagina copia/incolla:

Windows Registry Editor Version 5.00

[-HKCR\CLSID\{EF4CC146-43C9-4741-8D21-EB5035A4EBEC}]

[-HKCR\CLSID\{02E857FD-2262-415D-BC0F-124F9E6241F0}]

[-HKCR\CLSID\{33940B89-B786-4278-A55C-285A98BAAB2A}]

[-HKCR\CLSID\{EF4CC146-43C9-4741-8D21-EB5035A4EBEC}]

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"cmds"=-

salvalo in c:\ con il nome nome: fix.reg
tipo di file: tutti i file

senza chiuderlo, salvalo nuovamente come fix2.reg


Esegui avenger e nella finestra copia/incolla tutta la citazione:

files to delete:
C:\WINNT\system32\geBrsRkl.dll
C:\WINNT\system32\vlutsjcw.dll
C:\WINNT\system32\xotohxts.ini
C:\WINNT\system32\wcjstulv.ini
C:\WINNT\system32\klugpvvw.ini
C:\WINNT\system32\mcrh.tmp
C:\WINNT\system32\xrfomfju.ini
C:\WINNT\system32\njbpocnt.ini
C:\WINNT\system32\hlfjipmc.ini
C:\WINNT\system32\wlgttkbx.dll
C:\WINNT\system32\xbkttglw.ini
C:\WINNT\system32\sbijxdfi.ini
C:\WINNT\system32\iesxbsby.dll
C:\WINNT\system32\sberfpjr.dll
C:\WINNT\system32\rjpfrebs.ini
C:\WINNT\system32\ybsbxsei.ini
C:\WINNT\system32\QYcLlnpo.ini2
C:\WINNT\system32\QYcLlnpo.ini
C:\WINNT\system32\gflbctne.ini
C:\WINNT\system32\gbkmudyx.dll
C:\WINNT\system32\xydumkbg.ini
C:\WINNT\system32\crpqqmtq.dll
C:\WINNT\system32\qtmqqprc.ini
C:\WINNT\system32\grjscedj.dll
C:\WINNT\system32\jdecsjrg.ini
C:\WINNT\system32\hjoordio.dll
C:\WINNT\system32\oidroojh.ini
C:\WINNT\system32\otcrwosi.dll
C:\WINNT\system32\isowrcto.ini
C:\WINNT\system32\jlltomls.dll
C:\WINNT\system32\slmotllj.ini
C:\WINNT\system32\mssrv32.exe
C:\WINNT\system32\clkcnt.txt
C:\WINNT\system32\yahexuse.dll
C:\WINNT\system32\esuxehay.ini
C:\WINNT\system32\WinCtrl32.dll
C:\WINNT\system32\WinCtrl32.dl_
C:\WINNT\system32\entcblfg.dll
C:\WINNT\system32\opnlLcYQ.dll
C:\WINDOWS\SYSTEM32\WLCtrl32.dll
C:\WINNT\system32\drivers\Ubh06.sys
C:\WINNT\system32\drivers\kqW28.sys
C:\DOCUME~1\PAGLIO~1\IMPOST~1\Temp\nnnOeEVM.dll
C:\DOCUME~1\PAGLIO~1\IMPOST~1\Temp\MVEeOnnn.ini2
C:\DOCUME~1\PAGLIO~1\IMPOST~1\Temp\MVEeOnnn.ini

registry values to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run | a0a62899
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellExecuteHooks | {EF4CC146-43C9-4741-8D21-EB5035A4EBEC}

registry keys to delete:
HKEY_LOCAL_MACHINE\system\controlset001\services\m supdate
HKEY_LOCAL_MACHINE\system\controlset002\services\m supdate
HKEY_LOCAL_MACHINE\system\currentcontrolset\servic es\msupdate
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\r oot\legacy_msupdate
HKEY_LOCAL_MACHINE\system\controlset001\enum\root\ legacy_msupdate
HKEY_LOCAL_MACHINE\system\controlset002\enum\root\ legacy_msupdate
HKEY_LOCAL_MACHINE\system\controlset001\services\U bh06
HKEY_LOCAL_MACHINE\system\controlset002\services\U bh06
HKEY_LOCAL_MACHINE\system\currentcontrolset\servic es\Ubh06
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\r oot\legacy_Ubh06
HKEY_LOCAL_MACHINE\system\controlset001\enum\root\ legacy_Ubh06
HKEY_LOCAL_MACHINE\system\controlset002\enum\root\ legacy_Ubh06
HKEY_LOCAL_MACHINE\system\controlset001\services\k qW28
HKEY_LOCAL_MACHINE\system\controlset002\services\k qW28
HKEY_LOCAL_MACHINE\system\currentcontrolset\servic es\kqW28
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\r oot\legacy_kqW28
HKEY_LOCAL_MACHINE\system\controlset001\enum\root\ legacy_kqW28
HKEY_LOCAL_MACHINE\system\controlset002\enum\root\ legacy_kqW28
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\geBrsRkl
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinCtrl32
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WLCtrl32
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{02E857FD-2262-415D-BC0F-124F9E6241F0}
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{33940B89-B786-4278-A55C-285A98BAAB2A}
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{9CAE5185-3115-4089-954E-0E4D59B80048}
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{EF4CC146-43C9-4741-8D21-EB5035A4EBEC}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Sa feBoot\Minimal\Ubh06.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Sa feBoot\Network\Ubh06.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Sa feBoot\Minimal\Ubh06.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Sa feBoot\Network\Ubh06.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Ubh06.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Network\Ubh06.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Sa feBoot\Minimal\kqW28.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Sa feBoot\Network\kqW28.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Sa feBoot\Minimal\kqW28.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Sa feBoot\Network\kqW28.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\kqW28.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Network\kqW28.sys

programs to launch on reboot:
c:\fix.reg

Spunta "Automatically disable any rootkits found" e clicca su "execute".
Il pc dovrebbe riavviarsi da solo, altrimenti riavvialo tu. Posta il report rilasciato

Esegui CCleaner e ripulisci i file temporanei e i cookie (eseguilo 2 volte).

Svuota C:\WINDOWS\Prefetch

Esegui una scansione: scarica, installa e aggiorna malwarebytes, esegui una scansione completa e posta il rapporto (lo trovi in "File di log": apri il file di testo copia/incolla il rapporto).

Posta il rapporto della scansione con malwarebytes, il rapporto di avenger e un nuovo systemscam (caricali su savefile)

[faith72]

1) Visto che il pc è aziendale, controlla questi i due servizi (vedi nelle proprietà)
C:\WINNT\system32\drivers\Ubh06.sys
C:\WINNT\system32\drivers\kqW28.sys
ma non credo proprio siano i vostri. In caso contrario, fermati che correggo lo script per avenger.
--- ciao, i file indicati sono presenti, ma cosa intendi per -vedi nelle proprietà-??

[hell's bells]

Per vedere le proprietà del file, clicca su i 2 files con il destro nel mouse, e verifica produttore, versione e data del files, poi posta i risultati sul forum.

[Deifobe]

clicca 1 sola volta sui files (con il tasto destro del mouse) e seleziona "proprieta'"
se appartendgono a qualche applicazione molto probabilmente la troverai indicata li'.

@ hell's bells:

[faith72]

Ok, scusate la domanda stupida.Cmq da proprietà si può accedere solo alla tab - generale - con tipo file-> file di sistema
e apri con -> applicazione sconosciuta. Se può essere d'aiuto le date di creazione e modifica sono rispettivamente per KqW28 19/05/08-11/06/08
e per UbH06 16/05/08-16/05/08.
ciao

[Deifobe]

ok, allora prima di avenger fai questo:

scarica Registry Search Tool e cerca:
Ubh06
kqW28
posta i risultati ottenuti.

Poi, vai su Virustotal e analizza (copia/incolla i percorsi)
C:\WINNT\system32\drivers\Ubh06.sys
C:\WINNT\system32\drivers\kqW28.sys
e posta i risultati ottenuti.

[faith72]

Allora, da Registry Search Tool:


REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "Ubh06" 11/06/08 15.18.28

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Sa feBoot\Minimal\Ubh06.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Sa feBoot\Network\Ubh06.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_UBH06]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_UBH06\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_UBH06\0000]
"Service"="Ubh06"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_UBH06\0000]
"DeviceDesc"="Ubh06"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_UBH06\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_UBH06\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_UBH06\0000\Control]
"ActiveService"="Ubh06"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\U bh06]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\U bh06]
"ImagePath"="System32\\Drivers\\Ubh06.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\U bh06\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\U bh06\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\U bh06\Enum]
"0"="Root\\LEGACY_UBH06\\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Sa feBoot\Minimal\Ubh06.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Sa feBoot\Network\Ubh06.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\ LEGACY_UBH06]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\ LEGACY_UBH06\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\ LEGACY_UBH06\0000]
"Service"="Ubh06"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\ LEGACY_UBH06\0000]
"DeviceDesc"="Ubh06"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\ LEGACY_UBH06\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\U bh06]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\U bh06]
"ImagePath"="System32\\Drivers\\Ubh06.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\U bh06\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Ubh06.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Network\Ubh06.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_UBH06]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_UBH06\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_UBH06\0000]
"Service"="Ubh06"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_UBH06\0000]
"DeviceDesc"="Ubh06"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_UBH06\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_UBH06\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_UBH06\0000\Control]
"ActiveService"="Ubh06"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Ubh06]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Ubh06]
"ImagePath"="System32\\Drivers\\Ubh06.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Ubh06\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Ubh06\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Ubh06\Enum]
"0"="Root\\LEGACY_UBH06\\0000"

.................................................. ......................

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "kqW28" 11/06/08 15.19.37

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Sa feBoot\Minimal\kqW28.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Sa feBoot\Network\kqW28.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_KQW28]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_KQW28\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_KQW28\0000]
"Service"="kqW28"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_KQW28\0000]
"DeviceDesc"="kqW28"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_KQW28\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_KQW28\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\ LEGACY_KQW28\0000\Control]
"ActiveService"="kqW28"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\k qW28]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\k qW28]
"ImagePath"="System32\\Drivers\\kqW28.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\k qW28\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\k qW28\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\k qW28\Enum]
"0"="Root\\LEGACY_KQW28\\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Sa feBoot\Minimal\kqW28.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Sa feBoot\Network\kqW28.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\ LEGACY_KQW28]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\ LEGACY_KQW28\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\ LEGACY_KQW28\0000]
"Service"="kqW28"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\ LEGACY_KQW28\0000]
"DeviceDesc"="kqW28"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\ LEGACY_KQW28\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\k qW28]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\k qW28]
"ImagePath"="System32\\Drivers\\kqW28.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\k qW28\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\kqW28.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Network\kqW28.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_KQW28]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_KQW28\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_KQW28\0000]
"Service"="kqW28"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_KQW28\0000]
"DeviceDesc"="kqW28"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_KQW28\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_KQW28\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\LEGACY_KQW28\0000\Control]
"ActiveService"="kqW28"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\kqW28]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\kqW28]
"ImagePath"="System32\\Drivers\\kqW28.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\kqW28\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\kqW28\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\kqW28\Enum]
"0"="Root\\LEGACY_KQW28\\0000"

.................................................
da virustotal

0 bytes size received / Se ha recibido un archivo vacio
0 bytes size received / Se ha recibido un archivo vacio