Помощ за откриване и премахване на вируси, троянски коне и..

21 декември 200817 г.

С програмката ше се опрая доколкото компетентни отговори и на по-простички решения съм доволен само да работят
UPDATE по темата:

няма хора пак е същото след пълен скан нищо ново под слънцето само намери един троянец махна го като реснахме компа пак същата боза бе други идеи???? това на мен не ми изглежда като системен процес....

ПОСЛЕДЕН UPDATE :

Използвах Hijackthis премахнах процеса вече не бози компа почистихме регистри и т.н вече всичко е добре ..

Благодаря на bo4man че все пак се включи и неговото решение помогна. Ще помоля някой модератор да затвори темата..

Аз не съм убеден, че всичко е почистено...Това е гадна зараза с трудно почистване.

Авира препоръчват формат при нея. MBAM намират само част от файловете.

С hlevoust я чистихме наскоро. Изобщо да не хващаш TDSS и Trojan.Win32.VB.gyh

Прочети всички съвети от тази тема:

http://www.kaldata.com/forums/index.php?showtopic=102104

Темата ти не е за затваряне, а за местене в правилния раздел...

21 декември 200817 г.

Аз не съм убеден, че всичко е почистено...Това е гадна зараза с трудно почистване.

Авира препоръчват формат при нея. MBAM намират само част от файловете.

С hlevoust я чистихме наскоро. Изобщо да не хващаш TDSS и Trojan.Win32.VB.gyh

Прочети всички съвети от тази тема:

http://www.kaldata.com/forums/index.php?showtopic=102104

Темата ти не е за затваряне, а за местене в правилния раздел...

Май става въпрос за подобно творение което RemoveIT Pro не успя да почисти,но dr.Web успя да карантинира безпроблемнно.Този „бонус”получих вчера след инсталирането на едно менте.

Редактирано 21 декември 200817 г. от sister (преглед на промените)

21 декември 200817 г.

Май става въпрос за подобно творение което RemoveIT Pro не успя да почисти,но dr.Web успя да карантинира безпроблемнно.Този „бонус”получих вчера след инсталирането на едно менте.

Говорех главно за това:

http://www.kaldata.com/forums/index.php?s=...t&p=1196233

За TDSS повече инфо тук =>

http://www.kaldata.com/forums/index.php?s=...t&p=1213831

21 декември 200817 г.

Говорех главно за това:

http://www.kaldata.com/forums/index.php?s=...t&p=1196233

За TDSS повече инфо тук =>

http://www.kaldata.com/forums/index.php?s=...t&p=1213831

Разбрах че говореш точно за това,но исках да се убедя че не бъркам.Това е първата гадина с която RemoveIT Pro не успява да се справи много устойчива и опасна излезе.

21 декември 200817 г.

"Tools" - "Add-ons" и махаш "Yandex Toolbar" после рестартираш Firefox-а. Можеш и да пратиш SMS ако искаш

Ако не стане виж това http://www.kaldata.com/forums/index.php?showtopic=104907

После рестартира ИЕ

22 декември 200817 г.

После инсталира Firefox или Opera и зарязва IE

22 декември 200817 г.

Не се връзвай на подобен рекет,не пращай смс-и.Влез в Tools---->manage add-ons---->enable or disable add-ons.

Направи 1 снимка 1 я дай. :eek:

26 декември 200817 г.

здравейте и весели празници

Имам проблем ,преди малко в търсене на крак за фар край 2 ми се появи това чудо-ms antispyware 2009 ,спрях го Уж от процесите ,но като пусна MalwereBytes anti malware ,за да го махна програмата не ми тръгва...дайте предложения как да се отърва от това чудо...

Редактирано 27 декември 200817 г. от stanley56 (преглед на промените)

26 декември 200817 г.

Влез в Safe Mode with Networking и опитай отново с MBAM:

http://support.microsoft.com/kb/315222

Редактирано 26 декември 200817 г. от Fixer (преглед на промените)

26 декември 200817 г.

Влез в Safe Mode with Networking и опитай отново с MBAM:
http://support.microsoft.com/kb/315222

Ами не, че нещо колега, но не се препоръчва използването на MBAM под Safe Mode...Просто не е създадена да работи коректно под този режим. Все пак това не пречи да се опита разбира се, щом има проблеми с проверката под normal mode

MBAM works from safemore but it is not designed to work that way .MBAM will work better from regular mode both in terms of what it detects and what it can remove .Doing a safemode scan with MBAM should only be done when a regular mode scan fails.

Какво значи програмата не ти тръгва ? Не иска да се инсталира или какво ? Ако е така просто преименувай изпълнимия файл mbam-setup.exe на hellothere.exe. След това я инсталирай и почисти с нея.

Mоите препоръки са следните:

http://www.kaldata.com/forums/index.php?s=...t&p=1055496

http://www.kaldata.com/forums/index.php?showtopic=102469

Изпълни всичко това и публикувай съответнуите логове.

Уж вчера докладвахме най-новите варианти на тази зараза. Обнови дефинициите на MBAM преди да сканираш с нея !

http://www.malwarebytes.org/forums/index.php?showtopic=8885

Редактирано 26 декември 200817 г. от B-boy[StyLe] (преглед на промените)

26 декември 200817 г.

здравейте и весели празници
Имам проблем ,преди малко в търсене на крак за фар край 2 ми се появи това чудо-ms antispyware 2009 ,спрях го Уж от процесите ,но като пусна MalwereBytes anti malware ,за да го махна програмата не ми тръгва...дайте предложения как да се отърва от това чудо...

Пробвай с тази програма свали я от тук http://www.incodesolutions.com/removeit.php пиши какво е открила и дали е успяла да ги фиксне успешно.

26 декември 200817 г.

b-boy имам я инсталирана ,но като реча да я пусна не тръгва...като почна да тегля комбофикс ми пише че страницата е невалидна

Редактирано 26 декември 200817 г. от SilentScream (преглед на промените)

26 декември 200817 г.

b-boy имам я инсталирана ,но като реча да я пусна не тръгва...като почна да тегля комбофикс ми пише че страницата е невалидна

Заемай се ръчно тия ментета не са опасни.първо спри процеса в таск манажера на ментака,после отваряш Тотал командера и го убиваш до край.(ТРИЕШ ВСИЧКО НЕГОВО)

После пускаш МБАМ.

26 декември 200817 г.

b-boy имам я инсталирана ,но като реча да я пусна не тръгва...като почна да тегля комбофикс ми пише че страницата е невалидна

Намери файла Hosts.ini :

C:\WINDOWS\system32\drivers\etc\hosts


Отвори го с NOTEPAD...и го редактирай...Изтрий всичко от него освен този ред:


127.0.0.1 localhost


после го затвори и запази промените...SAVE

Сега би трябвало да успееш да го свалиш... Ако ли не изтегли оригиналния hosts.ini и го разархивирай в C:\WINDOWS\system32\drivers\etc\hosts и замести наличния файл там http://hosts-file.net/download/WinDef_Hosts.zip Ето ти и нарочно преименуван Combofix: http://rapidshare.com/files/177054215/Hellothere.exe.html След това го запази на десктопа и веведи командата в Start => Run =>

"%userprofile%\desktop\hellothere.exe" /killall

Редактирано 26 декември 200817 г. от B-boy[StyLe] (преглед на промените)

26 декември 200817 г.

combofix помогна много ,сложих суперантиспайуеър и с mbam изчистих всичко (или така мисля ) :cheers: ако имам още проблеми ще ви пиша тук

hijackthis показа тва

Logfile of HijackThis v1.99.1

Scan saved at 00:20, on 2008-12-27

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.20935)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\Program Files\McAfee\MSK\MskSrver.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\WINDOWS\system32\IoctlSvc.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\tsnpstd3.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Datecs\FlexType 2K\FType2K.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\WinRAR\WinRAR.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\DOCUME~1\Petio\LOCALS~1\Temp\Rar$EX00.297\HijackThis.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ircdown.com/en/index.php?rvs=ho...&d=79918987

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: McAfee Phishing Filter - {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\PROGRA~1\mcafee\msk\mskapbho.dll

O2 - BHO: Java Plug-In SSV Helper - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: scriptproxy - {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

O2 - BHO: McAfee SiteAdvisor BHO - {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl Class - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe

O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

O4 - HKCU\..\Run: [Comrade.exe] C:\Program Files\GameSpy\Comrade\Comrade.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Startup: Need for Speed™ Undercover Registration.lnk = C:\Program Files\EA Games\Need for Speed Undercover\Support\EAregister.exe

O4 - Global Startup: FlexType 2K.lnk = C:\Program Files\Datecs\FlexType 2K\FType2K.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O11 - Options group: [TABS] Tabbed Browsing

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: !saswinlogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)

O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

Редактирано 26 декември 200817 г. от SilentScream (преглед на промените)

26 декември 200817 г.

Версията на HijackThis е стара 1.99.1. Актуална е версия 2.0.2.

Имаш доста излишни неща в лога - Деинсталирай всички ненужни тулбари, замени McaFee с нещо по-нормално, за алтернативи на BSPLAYER, FLEXTYPE също е писано, но си остава въпрос на личен избор.

Можеш да смениш и Nero с BurnAware и да разкараш TuneUp Utilities за сметка на Advanced SystemCare 3.

Все пак е препоръчително да ги разкараш, и да обновиш JAVA до последната версия. След това пусни нов лог от новата версия на HijackThis.

Сложи отметки пред следните редове и избери Fix Checked:

O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU) 

O11 - Options group: [INTERNATIONAL] International*

O11 - Options group: [TABS] Tabbed Browsing

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

Едва се сдържам да не фиксна още нещо, но за сега това.

PS: Не видях лог от Combofix.

26 декември 200817 г.

ComboFix 08-12-26.02 - Petio 2008-12-26 23:58:50.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2047.1698 [GMT 2:00]

Running from: c:\documents and settings\Petio\desktop\hellothere.exe

Command switches used :: /killall

AV: McAfee VirusScan *On-access scanning disabled* (Updated)

FW: McAfee Personal Firewall *disabled*

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\documents and settings\Petio\Favorites\Download programs.url

c:\documents and settings\Petio\Favorites\Games.url

c:\documents and settings\Petio\Favorites\Translator.url

c:\documents and settings\Petio\Favorites\Videos.url

c:\documents and settings\Petio\Start Menu\Programs\Download programs.url

c:\documents and settings\Petio\Start Menu\Programs\Games.url

c:\documents and settings\Petio\Start Menu\Programs\Translator.url

c:\documents and settings\Petio\Start Menu\Programs\Videos.url

c:\windows\system32\awtqqrRK.dll

c:\windows\system32\drivers\TDSSpxfe.sys

c:\windows\system32\geBtSKAP.dll

c:\windows\system32\PAKStBeg.ini

c:\windows\system32\PAKStBeg.ini2

c:\windows\system32\TDSSdxgp.dll

c:\windows\system32\TDSSihys.log

c:\windows\system32\TDSSkkao.log

c:\windows\system32\TDSSmtpe.dat

c:\windows\system32\TDSSnmxh.log

c:\windows\system32\TDSSnpur.dll

c:\windows\system32\TDSSnrxx.dll

c:\windows\system32\TDSSoitu.dll

c:\windows\system32\TDSSsahc.dll

c:\windows\system32\TDSSyoqu.dll

c:\windows\system32\twuqnkfs.ini

----- BITS: Possible infected sites -----

hxxp://childhe.com

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_TDSSSERV.SYS

-------\Legacy_TDSSSERV.SYS

((((((((((((((((((((((((( Files Created from 2008-11-26 to 2008-12-26 )))))))))))))))))))))))))))))))

.

2008-12-26 23:36 . 2008-12-26 23:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion

2008-12-26 23:32 . 2008-12-26 23:32 <DIR> d-------- c:\program files\Yahoo!

2008-12-26 23:32 . 2008-12-26 23:34 <DIR> d-------- c:\program files\CCleaner

2008-12-26 23:10 . 2008-12-26 23:10 <DIR> d-------- c:\documents and settings\Administrator

2008-12-26 22:47 . 2008-12-26 22:47 <DIR> d-------- c:\documents and settings\All Users\Application Data\CrucialSoft Ltd

2008-12-26 22:47 . 2008-12-27 00:12 112,364 --a------ c:\windows\system32\drivers\934c8640.sys

2008-12-26 22:46 . 2008-12-26 22:46 45,056 --a------ c:\windows\system32\tuvUNDSj.dll

2008-12-26 22:43 . 2008-12-26 22:43 <DIR> dr-h----- c:\documents and settings\Petio\Application Data\SecuROM

2008-12-26 22:35 . 2008-12-26 22:36 <DIR> d-------- c:\windows\LastGood.Tmp

2008-12-26 21:16 . 2008-12-26 21:20 <DIR> d-------- c:\program files\Ballance

2008-12-26 19:39 . 2008-12-26 19:40 <DIR> d-------- C:\Mercury MaxIM

2008-12-25 22:09 . 2008-12-25 22:09 <DIR> d-------- c:\documents and settings\Petio\Application Data\Activision

2008-12-25 22:08 . 2008-12-25 22:08 286 --a------ c:\windows\game.ini

2008-12-25 21:55 . 2008-12-25 21:55 <DIR> d--hs---- c:\windows\ftpcache

2008-12-25 12:53 . 2008-12-25 12:53 <DIR> d-------- c:\program files\GameSpy

2008-12-25 12:50 . 2008-12-25 12:50 22,328 --a------ c:\documents and settings\Petio\Application Data\PnkBstrK.sys

2008-12-25 12:49 . 2008-12-25 12:49 669,184 --a------ c:\windows\system32\pbsvc.exe

2008-12-24 20:11 . 2008-12-24 20:11 <DIR> d-------- c:\windows\system32\xlive

2008-12-24 20:11 . 2008-12-24 20:26 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE

2008-12-24 18:37 . 2008-12-24 18:37 <DIR> d-------- c:\program files\Activision

2008-12-24 13:15 . 2008-11-12 10:29 3,720,832 --a------ c:\windows\system32\drivers\RtHDMI.sys

2008-12-24 13:15 . 2008-09-19 17:48 1,200,128 --a------ c:\windows\RtkUpd.exe

2008-12-24 12:36 . 2008-12-24 12:36 <DIR> d-------- c:\documents and settings\Petio\Application Data\ATI

2008-12-24 12:36 . 2008-12-24 12:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\ATI

2008-12-24 12:36 . 2008-12-24 12:36 0 --a------ c:\windows\ativpsrm.bin

2008-12-24 12:31 . 2008-12-01 14:35 593,920 --a------ c:\windows\system32\ati2sgag.exe

2008-12-24 12:30 . 2008-12-24 12:30 <DIR> d-------- C:\ATI

2008-12-24 12:12 . 2008-05-21 01:53 141,824 -ra------ c:\windows\system32\drivers\AtiHdmi.sys

2008-12-24 12:11 . 2008-12-24 12:33 <DIR> d-------- c:\program files\ATI

2008-12-24 12:07 . 2008-12-24 12:32 <DIR> d-------- c:\program files\ATI Technologies

2008-12-21 15:07 . 2008-12-21 15:07 <DIR> d-------- c:\program files\Nu Generation Games Ltd

2008-12-21 14:57 . 2008-12-21 14:57 410,984 --a------ c:\windows\system32\deploytk.dll

2008-12-20 19:18 . 2008-12-20 19:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\Urban FreeStyle Soccer

2008-12-20 19:16 . 2008-12-20 19:16 <DIR> d-------- c:\program files\Acclaim Entertainment

2008-12-11 14:34 . 2008-10-23 14:36 286,720 -----c--- c:\windows\system32\dllcache\gdi32.dll

2008-12-07 10:27 . 2008-12-07 10:27 126 --a------ c:\windows\kaillera.ini

2008-12-04 16:59 . 2008-12-04 16:59 <DIR> d-------- c:\program files\Common Files\DirectX

2008-12-01 22:52 . 2008-12-01 22:52 425,984 --a------ c:\windows\system32\ATIDEMGX.dll

2008-12-01 22:46 . 2008-12-01 22:46 11,304,960 --a------ c:\windows\system32\atioglxx.dll

2008-12-01 22:41 . 2008-12-01 22:41 188,416 --a------ c:\windows\system32\atipdlxx.dll

2008-12-01 22:40 . 2008-12-01 22:40 147,456 --a------ c:\windows\system32\Oemdspif.dll

2008-12-01 22:40 . 2008-12-01 22:40 143,360 --a------ c:\windows\system32\ati2evxx.dll

2008-12-01 22:40 . 2008-12-01 22:40 43,520 --a------ c:\windows\system32\ati2edxx.dll

2008-12-01 22:40 . 2008-12-01 22:40 26,112 --a------ c:\windows\system32\Ati2mdxx.exe

2008-12-01 22:38 . 2008-12-01 22:38 598,016 --a------ c:\windows\system32\ati2evxx.exe

2008-12-01 22:37 . 2008-12-01 22:37 53,248 --a------ c:\windows\system32\ATIDDC.DLL

2008-12-01 22:19 . 2008-12-01 22:19 307,200 --a------ c:\windows\system32\atiiiexx.dll

2008-12-01 22:11 . 2008-12-01 22:11 3,107,788 --a------ c:\windows\system32\ativvaxx.dat

2008-12-01 22:11 . 2008-12-01 22:11 3,107,788 --a------ c:\windows\system32\ativva5x.dat

2008-12-01 22:11 . 2008-12-01 22:11 887,724 --a------ c:\windows\system32\ativva6x.dat

2008-12-01 22:11 . 2008-12-27 00:07 69,112 --a------ c:\windows\system32\ativvaxx.cap

2008-12-01 21:57 . 2008-12-01 21:57 48,640 --a------ c:\windows\system32\amdpcom32.dll

2008-12-01 21:53 . 2008-12-01 21:53 401,408 --a------ c:\windows\system32\atikvmag.dll

2008-12-01 21:53 . 2008-12-01 21:53 45,056 --a------ c:\windows\system32\amdcalrt.dll

2008-12-01 21:53 . 2008-12-01 21:53 45,056 --a------ c:\windows\system32\amdcalcl.dll

2008-12-01 21:52 . 2008-12-01 21:52 86,016 --a------ c:\windows\system32\atiadlxx.dll

2008-12-01 21:52 . 2008-12-01 21:52 17,408 --a------ c:\windows\system32\atitvo32.dll

2008-12-01 21:51 . 2008-12-01 21:51 53,248 --a------ c:\windows\system32\drivers\ati2erec.dll

2008-12-01 21:50 . 2008-12-01 21:50 3,252,224 --a------ c:\windows\system32\Amdcaldd.dll

2008-12-01 21:50 . 2008-12-01 21:50 286,720 --a------ c:\windows\system32\atiok3x2.dll

2008-11-29 18:04 . 2008-11-29 18:04 <DIR> d-------- c:\program files\YouTube Downloader

2008-11-29 18:01 . 2008-11-29 18:01 <DIR> d-------- c:\program files\Spider Video Downloader

2008-11-28 12:19 . 2001-08-17 22:36 8,704 --a------ c:\windows\system32\kbdjpn.dll

2008-11-28 12:19 . 2001-08-17 22:36 8,704 --a--c--- c:\windows\system32\dllcache\kbdjpn.dll

2008-11-28 12:19 . 2001-08-17 22:36 8,192 --a------ c:\windows\system32\kbdkor.dll

2008-11-28 12:19 . 2001-08-17 22:36 8,192 --a--c--- c:\windows\system32\dllcache\kbdkor.dll

2008-11-28 12:19 . 2008-04-14 05:39 6,144 --a------ c:\windows\system32\kbd106.dll

2008-11-28 12:19 . 2001-08-17 14:55 6,144 --a------ c:\windows\system32\kbd101c.dll

2008-11-28 12:19 . 2001-08-17 14:55 6,144 --a------ c:\windows\system32\kbd101b.dll

2008-11-28 12:19 . 2008-04-14 05:39 6,144 --a--c--- c:\windows\system32\dllcache\kbd106.dll

2008-11-28 12:19 . 2001-08-17 14:55 6,144 --a--c--- c:\windows\system32\dllcache\kbd101c.dll

2008-11-28 12:19 . 2001-08-17 14:55 6,144 --a--c--- c:\windows\system32\dllcache\kbd101b.dll

2008-11-28 12:19 . 2001-08-17 14:55 5,632 --a------ c:\windows\system32\kbd103.dll

2008-11-28 12:19 . 2001-08-17 14:55 5,632 --a--c--- c:\windows\system32\dllcache\kbd103.dll

2008-11-28 12:08 . 2008-12-09 18:01 <DIR> d-------- c:\program files\KoZ Mu S4 MaX

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-26 22:10 --------- d-----w c:\documents and settings\Petio\Application Data\Skype

2008-12-26 20:39 --------- d-----w c:\documents and settings\Petio\Application Data\uTorrent

2008-12-26 20:30 --------- d--h--w c:\program files\InstallShield Installation Information

2008-12-26 18:51 --------- d-----w c:\documents and settings\All Users\Application Data\Test Drive Unlimited

2008-12-26 15:35 --------- d-----w c:\documents and settings\Petio\Application Data\skypePM

2008-12-25 19:22 --------- d-----w c:\program files\TuneUp Utilities 2008

2008-12-25 15:18 138,184 ----a-w c:\windows\system32\drivers\PnkBstrK.sys

2008-12-25 10:33 --------- d-----w c:\program files\Electronic Arts

2008-12-24 19:00 --------- d-----w c:\program files\PC Wizard 2008

2008-12-21 12:56 --------- d-----w c:\program files\Java

2008-12-20 17:16 --------- d-----w c:\program files\Common Files\InstallShield

2008-12-15 06:19 --------- d-----w c:\program files\McAfee

2008-12-03 16:37 --------- d-----w c:\documents and settings\Petio\Application Data\Media Player Classic

2008-12-02 05:24 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore

2008-12-01 22:13 3,452,928 ----a-w c:\windows\system32\drivers\ati2mtag.sys

2008-11-24 15:47 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2008-11-23 18:08 --------- d-----w c:\program files\Lavalys

2008-11-23 17:01 --------- d-----w c:\program files\EA Games

2008-11-23 16:19 --------- d-----w c:\program files\Winamp

2008-11-19 15:05 --------- d-----w c:\program files\SystemRequirementsLab

2008-11-19 15:04 --------- d-----w c:\documents and settings\Petio\Application Data\SystemRequirementsLab

2008-11-18 17:31 --------- d-----w c:\program files\Autoplay Repair

2008-11-18 16:32 --------- d-----w c:\program files\K-Lite Codec Pack

2008-11-17 19:18 --------- d-----w c:\documents and settings\Petio\Application Data\Leadertech

2008-11-17 16:46 --------- d-----w c:\program files\Reference Assemblies

2008-11-17 16:46 --------- d-----w c:\program files\MSBuild

2008-11-14 21:29 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2008-11-13 13:49 --------- d-----w c:\documents and settings\Petio\Application Data\Red Alert 3

2008-11-12 14:01 --------- d-----w c:\program files\MSXML 4.0

2008-11-10 14:26 --------- d-----w c:\program files\Microsoft.NET

2008-11-10 14:25 --------- d-----w c:\program files\Microsoft ActiveSync

2008-11-05 18:28 --------- d-----w c:\program files\NeroInstall.bak

2008-11-05 18:24 --------- d-----w c:\documents and settings\Petio\Application Data\Nero

2008-11-05 18:23 --------- d-----w c:\program files\Common Files\Nero

2008-11-05 18:22 --------- d-----w c:\program files\Nero

2008-11-05 18:22 --------- d-----w c:\documents and settings\All Users\Application Data\Nero

2008-10-26 11:05 --------- d-----w c:\program files\VirtualDJ

2008-10-26 09:19 --------- d-----w c:\program files\GameShadow

2008-10-11 16:39 720,896 ----a-w c:\windows\iun6002.exe

2008-09-30 15:01 16,864,768 ----a-w c:\windows\RTHDCPL.EXE

2008-09-30 13:38 2,168,320 ----a-w c:\windows\MicCal.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{32099AAC-C132-4136-9E9A-4E364A424E17}"= "c:\program files\DAEMON Tools Toolbar\DTToolbar.dll" [2008-07-17 691656]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{32099AAC-C132-4136-9E9A-4E364A424E17}"= "c:\program files\DAEMON Tools Toolbar\DTToolbar.dll" [2008-07-17 691656]

[HKEY_CLASSES_ROOT\clsid\{32099aac-c132-4136-9e9a-4e364a424e17}]

[HKEY_CLASSES_ROOT\DTToolbar.ToolBandObj.1]

[HKEY_CLASSES_ROOT\TypeLib\{3E288F79-03E4-4983-A48E-0D879B51FF19}]

[HKEY_CLASSES_ROOT\DTToolbar.ToolBandObj]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]

"Comrade.exe"="c:\program files\GameSpy\Comrade\Comrade.exe" [2007-06-29 36864]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]

"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2008-06-13 1176808]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-21 136600]

"tsnpstd3"="c:\windows\tsnpstd3.exe" [2007-03-30 262144]

"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-18 843776]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]

"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]

"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]

"RTHDCPL"="RTHDCPL.EXE" [2008-09-30 c:\windows\RTHDCPL.EXE]

"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ShowDeskFix"="shell32" [X]

c:\documents and settings\Petio\Start Menu\Programs\Startup\

Need for SpeedT Undercover Registration.lnk - c:\program files\EA Games\Need for Speed Undercover\Support\EAregister.exe [2008-10-23 4369408]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2008-10-09 95232]

[HKLM\~\startupfolder\C:^Documents and Settings^Petio^Start Menu^Programs^Startup^Need for Speed™ Undercover Registration.lnk]

path=c:\documents and settings\Petio\Start Menu\Programs\Startup\Need for Speed™ Undercover Registration.lnk

backup=c:\windows\pss\Need for Speed™ Undercover Registration.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

--a------ 2008-07-24 17:02 490952 c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=

"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"d:\\Games\\Deer Hunter Tournament\\DHT.exe"=

"d:\\Games\\Deer Hunter Tournament\\Updater.exe"=

"c:\\Program Files\\Activision\\Spider-Man - Web of Shadows\\image\\pc\\Spider-Man Web of Shadows.exe"=

"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=

"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"d:\\Games\\fc\\Far Cry 2\\bin\\FarCry2.exe"=

"d:\\Games\\fc\\Far Cry 2\\bin\\FC2Launcher.exe"=

"d:\\Games\\fc\\Far Cry 2\\bin\\FC2Editor.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-10-08 206096]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Contents of the 'Scheduled Tasks' folder

2008-12-26 c:\windows\Tasks\1-Click Maintenance.job

- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 08:09]

2008-12-26 c:\windows\Tasks\fsvvqjyn.job

- c:\windows\system32\rundll32.exe [2008-04-14 04:42]

2008-10-08 c:\windows\Tasks\McDefragTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]

2008-10-08 c:\windows\Tasks\McQcTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]

.

- - - - ORPHANS REMOVED - - - -

BHO-{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - c:\windows\system32\awtqqrRK.dll

BHO-{b6acadab-2ddb-4e0e-814e-5f90aad42f48} - c:\windows\system32\geBtSKAP.dll

ShellExecuteHooks-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\awtqqrRK.dll

MSConfigStartUp-LowRateVoip - c:\program files\LowRateVoip\LowRateVoip.exe

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.ircdown.com/en/index.php?rvs=hompag&d=79918987

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Petio\Application Data\Mozilla\Firefox\Profiles\bjoc7deh.default\

FF - component: c:\program files\BS.Player ControlBar\FirefoxDTT\components\BSToolbarFF.dll

FF - component: c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll

FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-27 00:11:55

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\934c8640]

"ImagePath"="\SystemRoot\System32\drivers\934c8640.sys"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(764)

c:\windows\system32\Ati2evxx.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\progra~1\McAfee\MSC\mcmscsvc.exe

c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe

c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe

c:\program files\McAfee\MPF\MpfSrv.exe

c:\program files\McAfee\MSK\msksrver.exe

c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe

c:\windows\system32\IoctlSvc.exe

c:\windows\system32\PnkBstrA.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\Common Files\Nero\Lib\NMIndexingService.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe

c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe

.

**************************************************************************

.

Completion time: 2008-12-27 0:15:50 - machine was rebooted

ComboFix-quarantined-files.txt 2008-12-26 22:15:47

Pre-Run: 13,673,467,904 bytes free

Post-Run: 13,597,941,760 bytes free

311 --- E O F --- 2008-12-18 14:00:50

combofix

26 декември 200817 г.

ооо нее...Пак TDSS...сега ще го анализирам внимателно. През това време ще те помоля да архивираш папката C:\Qoobox с WinRaR или друга подобна програма под ръка и да я качиш на адрес http://www.rapidshare.com След това публикувай линка в следващия си пост. Мерси :rolleyes:

Отвори notepad и въведи:

Killall::


Driver::

934c8640.sys


File::

C:\WINDOWS\system32\tuvUNDSj.dll

C:\WINDOWS\ativpsrm.bin

c:\windows\Tasks\fsvvqjyn.job


Registry::

[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\934c8640]


sysrst::

Запази файла с име CFScript.txt и го провлачи с мишката в иконата на Combofix (hellothere):

След това ще те помоля да публикуваш отново лог от Combofix (след изпълнението на CFScript).

Остава само да архивираш папката Qoobox и да я качиш някъде и да публикуваш линка към нея:

Вече можеш да деинсталираш Combofix с командата:

Start => Run => combofix /u (или hellothere /u ако още е с това име)

Редактирано 27 декември 200817 г. от B-boy[StyLe] (преглед на промените)

27 декември 200817 г.

ComboFix 08-12-26.03 - Petio 2008-12-27 16:10:35.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2047.1338 [GMT 2:00]

Running from: c:\documents and settings\Petio\Desktop\Hellothere.exe

Command switches used :: c:\documents and settings\Petio\Desktop\CFScript.txt.txt

AV: McAfee VirusScan *On-access scanning enabled* (Updated)

FW: McAfee Personal Firewall *enabled*

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

c:\windows\ativpsrm.bin

c:\windows\system32\tuvUNDSj.dll

c:\windows\Tasks\fsvvqjyn.job

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\ativpsrm.bin

c:\windows\Tasks\fsvvqjyn.job

.

((((((((((((((((((((((((( Files Created from 2008-11-27 to 2008-12-27 )))))))))))))))))))))))))))))))

.

2008-12-27 00:17 . 2008-12-27 15:53 <DIR> d-------- c:\program files\SUPERAntiSpyware

2008-12-27 00:17 . 2008-12-27 00:17 <DIR> d-------- c:\documents and settings\Petio\Application Data\SUPERAntiSpyware.com

2008-12-27 00:17 . 2008-12-27 00:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2008-12-26 23:36 . 2008-12-26 23:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion

2008-12-26 23:32 . 2008-12-26 23:32 <DIR> d-------- c:\program files\Yahoo!

2008-12-26 23:32 . 2008-12-26 23:34 <DIR> d-------- c:\program files\CCleaner

2008-12-26 23:10 . 2008-12-26 23:10 <DIR> d-------- c:\documents and settings\Administrator

2008-12-26 22:47 . 2008-12-27 16:20 112,364 --a------ c:\windows\system32\drivers\934c8640.sys