Компютърът ми забива при пускане на скайп [РЕШЕН]

23 октомври 200916 г.

Компютърът ми забива при пускане или опит за деинсталация на скайп.

Вчера май отворих някакъв вирус и екрана стана син, после компютърът не искаше да се пуска дори на safe mode, но за щастие се пусна на debugging mode и тогава инсталирах Kaspersky (преди това бях с AVG Free, която няколко години ми върши добра работа), той намери два троянски конника и по всичко личеше, че всичко е наред, докато не пуснах скайп...

Malwarebytes' Anti-Malware 1.41

Версия на базата от данни: 3019

Windows 5.1.2600 Service Pack 2

23.10.2009 г. 18:21:56

mbam-log-2009-10-23 (18-21-56).txt

Тип сканиране: Пълно сканиране (C:\|Z:\|)

Сканирани обекти: 196546

Изминало време: 25 minute(s), 23 second(s)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 1

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 0

Заразени файлове: 2

Заразени процеси в паметта:

(Не бяха открити заплахи)

Заразени модули в паметта:

(Не бяха открити заплахи)

Заразени ключове в регистратурата:

HKEY_CURRENT_USER\SOFTWARE\advantage (Adware.Vomba) -> Quarantined and deleted successfully.

Заразени стойности в регистратурата:

(Не бяха открити заплахи)

Заразени информационни обекти в регистратурата:

(Не бяха открити заплахи)

Заразени папки:

(Не бяха открити заплахи)

Заразени файлове:

C:\WINDOWS\system32\drivers\oreans32.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\Reinstall\NOD32 Complete Software 2008 -4in1- (AIO)\NOD32 Complete 2008\Antivirus\Nod32Patch.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:23:16, on 23.10.2009 г.

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe

C:\Program Files\BlueSoleil\BTNtService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\DUDU\Desktop\Kaldata.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

O2 - BHO: (no name) - {9018F6A8-2495-45DF-9F16-C738F8F3C8FF} - (no file)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray

O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')

O4 - HKUS\S-1-5-21-842925246-854245398-725345543-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: &Сваляне на всички с FlashGet - C:\Program Files\FlashGet\jc_all.htm

O8 - Extra context menu item: &Сваляне с FlashGet - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{92A948B5-F3FB-4643-9AA9-1785A9243BCC}: NameServer = 78.90.92.1,89.190.192.162

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: winmm.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\BlueSoleil\BTNtService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 6718 bytes

Редактирано 23 октомври 200916 г. от radisto (преглед на промените)

23 октомври 200916 г.

Здравейте radisto,

*. Временно спрете защитата на антивирусната си програма в реално време.

*. Изтеглете Combofix.

*. Запазете го на Десктопа.

*. Отворете Start => run => и въведете следната команда:

"%userprofile%\desktop\ComboFix.exe" /KillAll

*. По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

*. Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

23 октомври 200916 г.

Автор

ComboFix 09-10-22.01 - DUDU 10.2009 г. 19:46.1.2 - FAT32x86

Running from: c:\documents and settings\DUDU\desktop\ComboFix.exe

Command switches used :: /KillAll

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_OREANS32

-------\Service_oreans32

((((((((((((((((((((((((( Files Created from 2009-09-23 to 2009-10-23 )))))))))))))))))))))))))))))))

.

2009-10-23 14:54 . 2009-10-23 14:54 -------- d-----w- c:\documents and settings\DUDU\Application Data\Malwarebytes

2009-10-23 14:54 . 2009-09-10 11:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-23 14:54 . 2009-10-23 14:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-10-23 14:54 . 2009-09-10 11:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-10-23 14:54 . 2009-10-23 14:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-10-23 14:45 . 2009-10-23 14:45 -------- d-----w- C:\FOUND.021

2009-10-23 14:35 . 2009-10-23 14:35 -------- d-----w- C:\FOUND.020

2009-10-23 14:27 . 2009-10-23 14:27 -------- d-----w- C:\FOUND.019

2009-10-23 13:47 . 2009-10-23 13:47 -------- d-----w- c:\program files\Common Files\Skype

2009-10-23 13:47 . 2009-10-23 13:47 -------- d-----r- c:\program files\Skype

2009-10-23 13:43 . 2009-10-23 13:43 -------- d-----w- C:\FOUND.018

2009-10-23 13:35 . 2009-10-23 13:35 -------- d-----w- C:\FOUND.017

2009-10-22 20:39 . 2009-10-22 20:39 -------- d-----w- c:\program files\CCleaner

2009-10-22 20:23 . 2009-10-22 20:23 -------- d-----w- C:\FOUND.016

2009-10-22 18:31 . 2009-10-22 18:31 -------- d-----w- c:\program files\QuickTime

2009-10-22 18:31 . 2009-10-22 18:31 -------- d-----w- c:\program files\3GP Video Converter 3

2009-10-22 15:03 . 2009-10-22 15:18 95259 ----a-w- c:\windows\system32\drivers\klick.dat

2009-10-22 15:03 . 2009-10-22 15:18 108059 ----a-w- c:\windows\system32\drivers\klin.dat

2009-10-22 14:54 . 2009-10-23 16:50 46624 --sha-w- c:\windows\system32\drivers\fidbox.dat

2009-10-22 14:54 . 2009-10-23 16:50 32 --sha-w- c:\windows\system32\drivers\fidbox2.dat

2009-10-22 14:54 . 2009-10-22 14:54 -------- d-----w- c:\program files\Kaspersky Lab

2009-10-22 14:54 . 2009-10-22 14:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab

2009-10-22 09:42 . 2009-10-22 09:42 -------- d-----w- c:\program files\Common Files\Symantec Shared

2009-10-22 09:41 . 2009-10-22 09:41 -------- d-----w- c:\windows\system32\drivers\NSS

2009-10-22 09:41 . 2009-10-22 09:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec

2009-10-22 09:41 . 2009-10-22 09:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton

2009-10-22 09:41 . 2009-10-22 09:41 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller

2009-10-22 09:20 . 2009-10-22 09:20 -------- d-----w- c:\windows\BDOSCAN8

2009-10-21 22:32 . 2009-10-21 22:32 -------- d-----w- c:\documents and settings\DUDU\Application Data\SumatraPDF

2009-10-21 22:32 . 2009-10-21 22:32 -------- d-----w- c:\program files\SumatraPDF

2009-10-20 16:43 . 2009-10-20 16:43 -------- d-----w- C:\$AVG

2009-10-20 15:52 . 2009-10-20 15:52 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2009-10-20 15:52 . 2009-10-20 15:52 -------- d-----w- c:\windows\SxsCaPendDel

2009-10-20 15:40 . 2009-10-20 15:40 -------- d-----w- c:\windows\Sun

2009-10-20 15:39 . 2009-10-20 15:39 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-10-20 15:39 . 2009-10-20 15:39 -------- d-----w- c:\program files\Java

2009-10-20 14:57 . 2009-10-20 14:57 23600 ----a-w- c:\windows\system32\drivers\TVICHW32.SYS

2009-10-20 14:57 . 2009-10-20 14:57 -------- d-----w- c:\documents and settings\DUDU\Local Settings\Application Data\eSupport.com

2009-10-19 09:13 . 2009-10-19 09:13 -------- d-----w- C:\FOUND.015

2009-10-12 14:21 . 2009-10-12 14:21 -------- d-----w- C:\FOUND.014

2009-10-09 14:45 . 2009-10-09 14:45 -------- d-----w- c:\program files\Common Files\Autodesk Shared

2009-10-09 14:45 . 2009-10-09 14:45 -------- d-----w- c:\program files\AutoCAD LT 2009

2009-10-09 14:45 . 2009-10-09 14:45 -------- d-----w- c:\documents and settings\DUDU\Local Settings\Application Data\Autodesk

2009-10-09 14:45 . 2009-10-09 14:45 -------- d-----w- c:\documents and settings\DUDU\Application Data\Autodesk

2009-10-09 14:45 . 2009-10-09 14:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk

2009-10-09 14:44 . 2009-10-09 14:45 -------- d-----w- c:\program files\MSBuild

2009-10-09 14:44 . 2009-10-09 14:44 108552 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2009-10-09 14:42 . 2009-10-09 14:42 -------- d-----w- c:\windows\system32\XPSViewer

2009-10-09 14:41 . 2009-10-09 14:41 -------- d-----w- c:\program files\Reference Assemblies

2009-10-09 14:41 . 2006-06-29 10:07 14048 ------w- c:\windows\system32\spmsg2.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-23 16:50 . 2009-10-22 14:54 32 --sha-w- c:\windows\system32\drivers\fidbox2.idx

2009-10-23 16:50 . 2009-10-22 14:54 1444 --sha-w- c:\windows\system32\drivers\fidbox.idx

2009-10-23 16:50 . 2007-10-25 02:13 12 ----a-w- c:\windows\bthservsdp.dat

2009-10-22 15:18 . 2008-01-29 15:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys

2009-10-09 15:00 . 2007-10-18 18:20 72584 ----a-w- c:\documents and settings\DUDU\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-09-18 16:15 . 2009-09-18 16:15 -------- d-----w- c:\program files\BORLANDC

2009-08-06 16:24 . 2007-10-18 17:35 327896 ----a-w- c:\windows\system32\wucltui.dll

2009-08-06 16:24 . 2007-10-18 17:35 209632 ----a-w- c:\windows\system32\wuweb.dll

2009-08-06 16:24 . 2007-10-18 17:35 35552 ----a-w- c:\windows\system32\wups.dll

2009-08-06 16:24 . 2007-07-30 16:19 44768 ----a-w- c:\windows\system32\wups2.dll

2009-08-06 16:24 . 2007-10-18 17:35 53472 ----a-w- c:\windows\system32\wuauclt.exe

2009-08-06 16:24 . 2008-11-21 16:33 96480 ----a-w- c:\windows\system32\cdm.dll

2009-08-06 16:23 . 2007-10-18 17:35 575704 ----a-w- c:\windows\system32\wuapi.dll

2009-08-06 16:23 . 2007-10-18 17:35 1929952 ----a-w- c:\windows\system32\wuaueng.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-11-17 7700480]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 167936]

"DataLayer"="c:\program files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 1106944]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-11-17 86016]

"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-20 149280]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-10-22 208616]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-11-17 1622016]

"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-12-19 16062464]

"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\winmm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Avant Browser\\avant.exe"=

"c:\\Program Files\\FlashGet\\flashget.exe"=

"c:\\Program Files\\uTorrent\\utorrent.exe"=

"c:\\Program Files\\BlueSoleil\\BlueSoleil.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"8018:TCP"= 8018:TCP:WWW

R2 ytxyy;ytxyy;c:\windows\system32\svchost.exe [2004-08-03 14336]

R3 FXDrv32;FXDrv32;H:\FXDrv32.sys [x]

R3 GarenaPEngine;GarenaPEngine;c:\docume~1\DUDU\LOCALS~1\Temp\IJA3FE6.tmp [x]

S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-22 33808]

S0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\DRIVERS\xfilt.sys [2006-02-23 11264]

S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]

S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-03-25 24592]

.

Contents of the 'Scheduled Tasks' folder

.

------- Supplementary Scan -------

.

uStart Page = about:blank

IE: &Сваляне на всички с FlashGet - c:\program files\FlashGet\jc_all.htm

IE: &Сваляне с FlashGet - c:\program files\FlashGet\jc_link.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

TCP: {92A948B5-F3FB-4643-9AA9-1785A9243BCC} = 78.90.92.1,89.190.192.162

FF - ProfilePath - c:\documents and settings\DUDU\Application Data\Mozilla\Firefox\Profiles\1m1k4rbd.default\

FF - prefs.js: browser.startup.homepage - ######

.

- - - - ORPHANS REMOVED - - - -

Notify-avldr - avldr.dll

AddRemove-NSS - c:\program files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS\LicenseType\2.3.0.44\InstStub.exe

AddRemove-Counter Stike 1.6 Install - c:\games\Counter Strike\Uninstal.exe

AddRemove-{C8C8387B-A98B-44E8-807A-1A9B7F51FFDA} - c:\documents and settings\DUDU\Local Settings\Application Data\{737AEA7B-5AB3-4A1C-BC5A-EAAB803F2D97}\setup_blazemp.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-23 19:51

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]

"ImagePath"="\??\c:\docume~1\DUDU\LOCALS~1\Temp\IJA3FE6.tmp"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(4076)

c:\windows\system32\WPDShServiceObj.dll

c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll

c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\combofix\CF26973.exe

c:\program files\BlueSoleil\BTNtService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\rundll32.exe

c:\progra~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE

c:\combofix\PEV.cfxxe

.

**************************************************************************

.

Completion time: 2009-10-23 19:53 - machine was rebooted

ComboFix-quarantined-files.txt 2009-10-23 16:53

Pre-Run: 9 729 507 328 bytes free

Post-Run: 10 232 856 576 bytes free

- - End Of File - - 18A73DF9572C63E77B7B07520ADAAE08

А и да допълня нещо, и в момента компютъра ми се пуска само на debugging mode, като видимо работи добре.

23 октомври 200916 г.

Здравейте отново:

*. Отворете notepad и въведете чрез copy/paste:

KILLALL::

Driver::

ytxyy

FXDrv32

Folder::

C:\FOUND.021

C:\FOUND.020

C:\FOUND.019

C:\FOUND.018

C:\FOUND.017

C:\FOUND.016

c:\program files\Common Files\Symantec Shared

c:\windows\system32\drivers\NSS

c:\documents and settings\All Users\Application Data\Symantec

c:\documents and settings\All Users\Application Data\Norton

c:\documents and settings\All Users\Application Data\NortonInstaller

c:\windows\BDOSCAN8

C:\$AVG

c:\documents and settings\All Users\Application Data\avg9

C:\FOUND.015

C:\FOUND.014

Registry::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"=-

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000000

*. Запазeте файла с име CFScript и го провлачете чрез drag/drop в Combofix.exe (както е на картинката)

*. По времето на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

*. Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

23 октомври 200916 г.

Автор

ComboFix 09-10-22.01 - DUDU 10.2009 г. 21:50.2.2 - FAT32x86

Running from: c:\documents and settings\DUDU\Desktop\tempo.exe

Command switches used :: c:\documents and settings\DUDU\Desktop\CFScript.txt

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\$AVG

c:\$avg\$VAULT\V_00000001.fil

c:\$avg\$VAULT\vvfolder.idx

c:\documents and settings\All Users\Application Data\avg9

c:\documents and settings\All Users\Application Data\avg9\Cfg\changecfgreg.cfg

c:\documents and settings\All Users\Application Data\avg9\Cfg\krnl.cfg

c:\documents and settings\All Users\Application Data\avg9\Cfg\mail.cfg

c:\documents and settings\All Users\Application Data\avg9\Cfg\malrep.cfg

c:\documents and settings\All Users\Application Data\avg9\Cfg\scan.cfg

c:\documents and settings\All Users\Application Data\avg9\Cfg\sched.cfg

c:\documents and settings\All Users\Application Data\avg9\Cfg\update.cfg

c:\documents and settings\All Users\Application Data\avg9\Cfg\user.cfg

c:\documents and settings\All Users\Application Data\avg9\CfgAll\krnlall.cfg

c:\documents and settings\All Users\Application Data\avg9\Log\avgcfg.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgcfg.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgchjw.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgchjw.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgchjwsrv.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgchjwsrv.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgcore.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgcore.log.1

c:\documents and settings\All Users\Application Data\avg9\Log\avgcore.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgfrw.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgfrw.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgldr.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgldr.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avglng.log

c:\documents and settings\All Users\Application Data\avg9\Log\avglng.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgns.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgns.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgrs.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgrs.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgscan.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgscan.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgsched.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgsched.log.1

c:\documents and settings\All Users\Application Data\avg9\Log\avgsched.log.2

c:\documents and settings\All Users\Application Data\avg9\Log\avgsched.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgsrm.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgsrm.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgtdi.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgtdi.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgui.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgui.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgupd.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgupd.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgwd.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgwd.log.1

c:\documents and settings\All Users\Application Data\avg9\Log\avgwd.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\avgwdsvc.log

c:\documents and settings\All Users\Application Data\avg9\Log\avgwdsvc.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\commonpriv.log

c:\documents and settings\All Users\Application Data\avg9\Log\commonpriv.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\fixcfg.log

c:\documents and settings\All Users\Application Data\avg9\Log\fixcfg.log.lock

c:\documents and settings\All Users\Application Data\avg9\Log\history.xml

c:\documents and settings\All Users\Application Data\avg9\Log\vault.log

c:\documents and settings\All Users\Application Data\avg9\Log\vault.log.lock

c:\documents and settings\All Users\Application Data\avg9\scanlogs\I_00000005.log

c:\documents and settings\All Users\Application Data\avg9\scanlogs\I_00000006.log

c:\documents and settings\All Users\Application Data\avg9\scanlogs\srm.idx

c:\documents and settings\All Users\Application Data\avg9\Temp\24b9b1d4-b5e4-49a2-bbc3-a442135273a6-b0-oopp.tmp

c:\documents and settings\All Users\Application Data\avg9\Temp\309eb055-0974-4c6e-bba8-903d38b5a0ad-7c4-oopp.tmp

c:\documents and settings\All Users\Application Data\avg9\Temp\b477a6e1-4979-441e-ac43-292697bcd329-654-oopp.tmp

c:\documents and settings\All Users\Application Data\avg9\Temp\be6c25a1-62ed-47ad-9de3-3d5bae2132b1-b4-oopp.tmp

c:\documents and settings\All Users\Application Data\avg9\Temp\c7e3260a-0607-47de-9480-c83ca9f29896-cc8-oopp.tmp

c:\documents and settings\All Users\Application Data\avg9\Temp\cff8d4e9-9fc8-4f96-b014-fe6b97eadcf9-7ec-oopp.tmp

c:\documents and settings\All Users\Application Data\avg9\Temp\file9514.tmp

c:\documents and settings\All Users\Application Data\Norton

c:\documents and settings\All Users\Application Data\Norton\{397E31AA-0D78-4649-A01C-339D73A2ED35}\isolate.ini

c:\documents and settings\All Users\Application Data\Norton\{397E31AA-0D78-4649-A01C-339D73A2ED35}\Module9000.txt

c:\documents and settings\All Users\Application Data\Norton\{397E31AA-0D78-4649-A01C-339D73A2ED35}\Norton\Connections\connections.dat

c:\documents and settings\All Users\Application Data\Norton\{397E31AA-0D78-4649-A01C-339D73A2ED35}\Norton\itbLUReg\{65190544-26C3-43a4-A78A-694964901607}.dat

c:\documents and settings\All Users\Application Data\Norton\{397E31AA-0D78-4649-A01C-339D73A2ED35}\Norton\itbLUReg\{6E3396BD-C6A6-4f0f-9254-267F9058FEC4}.dat

c:\documents and settings\All Users\Application Data\Norton\{397E31AA-0D78-4649-A01C-339D73A2ED35}\Norton\itbLUReg\{71B3DD3A-BC1F-40cc-A74F-C0C30DFCE7D5}.dat

c:\documents and settings\All Users\Application Data\Norton\{397E31AA-0D78-4649-A01C-339D73A2ED35}\Norton\itbLUReg\{D4F4CC32-7A41-4684-AE57-41E59E9B4503}.dat

c:\documents and settings\All Users\Application Data\Norton\symdata.xml

c:\documents and settings\All Users\Application Data\NortonInstaller

c:\documents and settings\All Users\Application Data\NortonInstaller\Logs\10-22-2009-12h41m18s\Install.1.mft.7z

c:\documents and settings\All Users\Application Data\NortonInstaller\Logs\10-22-2009-12h41m18s\NortonInstall-10-22-2009-12h41m18s.log

c:\documents and settings\All Users\Application Data\Symantec

c:\documents and settings\All Users\Application Data\Symantec\symdata.xml

C:\FOUND.014

c:\found.014\FILE0000.CHK

c:\found.014\FILE0001.CHK

c:\found.014\FILE0002.CHK

c:\found.014\FILE0003.CHK

c:\found.014\FILE0004.CHK

c:\found.014\FILE0005.CHK

c:\found.014\FILE0006.CHK

c:\found.014\FILE0007.CHK

c:\found.014\FILE0008.CHK

c:\found.014\FILE0009.CHK

c:\found.014\FILE0010.CHK

c:\found.014\FILE0011.CHK

c:\found.014\FILE0012.CHK

c:\found.014\FILE0013.CHK

c:\found.014\FILE0014.CHK

C:\FOUND.015

c:\found.015\FILE0000.CHK

c:\found.015\FILE0001.CHK

C:\FOUND.016

c:\found.016\FILE0000.CHK

c:\found.016\FILE0001.CHK

c:\found.016\FILE0002.CHK

c:\found.016\FILE0003.CHK

c:\found.016\FILE0004.CHK

c:\found.016\FILE0005.CHK

c:\found.016\FILE0006.CHK

c:\found.016\FILE0007.CHK

c:\found.016\FILE0008.CHK

c:\found.016\FILE0009.CHK

c:\found.016\FILE0010.CHK

c:\found.016\FILE0011.CHK

c:\found.016\FILE0012.CHK

c:\found.016\FILE0013.CHK

c:\found.016\FILE0014.CHK

c:\found.016\FILE0015.CHK

c:\found.016\FILE0016.CHK

C:\FOUND.017

c:\found.017\FILE0000.CHK

c:\found.017\FILE0001.CHK

c:\found.017\FILE0002.CHK

c:\found.017\FILE0003.CHK

c:\found.017\FILE0004.CHK

c:\found.017\FILE0005.CHK

c:\found.017\FILE0006.CHK

c:\found.017\FILE0007.CHK

c:\found.017\FILE0008.CHK

c:\found.017\FILE0009.CHK

c:\found.017\FILE0010.CHK

c:\found.017\FILE0011.CHK

c:\found.017\FILE0012.CHK

c:\found.017\FILE0013.CHK

c:\found.017\FILE0014.CHK

c:\found.017\FILE0015.CHK

c:\found.017\FILE0016.CHK

c:\found.017\FILE0017.CHK

c:\found.017\FILE0018.CHK

c:\found.017\FILE0019.CHK

c:\found.017\FILE0020.CHK

c:\found.017\FILE0021.CHK

c:\found.017\FILE0022.CHK

c:\found.017\FILE0023.CHK

C:\FOUND.018

c:\found.018\FILE0000.CHK

c:\found.018\FILE0001.CHK

C:\FOUND.019

c:\found.019\FILE0000.CHK

c:\found.019\FILE0001.CHK

c:\found.019\FILE0002.CHK

c:\found.019\FILE0003.CHK

c:\found.019\FILE0004.CHK

c:\found.019\FILE0005.CHK

c:\found.019\FILE0006.CHK

c:\found.019\FILE0007.CHK

c:\found.019\FILE0008.CHK

c:\found.019\FILE0009.CHK

c:\found.019\FILE0010.CHK

c:\found.019\FILE0011.CHK

c:\found.019\FILE0012.CHK

C:\FOUND.020

c:\found.020\FILE0000.CHK

c:\found.020\FILE0001.CHK

C:\FOUND.021

c:\found.021\FILE0000.CHK

c:\found.021\FILE0001.CHK

c:\program files\Common Files\Symantec Shared

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\catalog.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\cceraser.dll

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\ecmsvr32.dll

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\eeCtrl.sys

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\ERASER.grd

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\ERASER.sig

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\ERASER.spm

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\ERASER.sys

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\ESRDEF.BIN

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\hh

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\naveng.sys

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\naveng32.dll

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\navex15.sys

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\navex32a.dll

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\ncsacert.txt

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\scrauth.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\symaveng.cat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\symaveng.inf

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\SymErase.cat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\SymErase.inf

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\TCDEFS.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\TCSCAN7.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\TCSCAN8.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\TCSCAN9.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\technote.txt

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\TINF.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\tinfidx.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\TINFL.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\TSCAN1.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\tscan1hd.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\V.GRD

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\V.SIG

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\virscan.inf

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\VIRSCAN1.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\VIRSCAN2.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\VIRSCAN3.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\VIRSCAN4.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\VIRSCAN5.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\VIRSCAN6.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\VIRSCAN7.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\VIRSCAN8.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\VIRSCAN9.DAT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\vscanmsx.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\WHATSNEW.TXT

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\20091021.002\zdone.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\catalog.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\cceraser.dll

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ecmsvr32.dll

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\eeCtrl.sys

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ERASER.grd

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ERASER.sig

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ERASER.spm

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ERASER.sys

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\esrdef.bin

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\hh

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\naveng.sys

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\naveng32.dll

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\navex15.sys

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\navex32a.dll

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\ncsacert.txt

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\scrauth.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\symaveng.cat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\symaveng.inf

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\SymErase.cat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\SymErase.inf

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tcdefs.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tcscan7.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tcscan8.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tcscan9.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\technote.txt

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tinf.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tinfidx.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tinfl.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tscan1.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\tscan1hd.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\v.grd

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\v.sig

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan.inf

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan1.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan2.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan3.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan4.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan5.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan6.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan7.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan8.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\virscan9.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\whatsnew.txt

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\BinHub\zdone.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\definfo.dat

c:\program files\Common Files\Symantec Shared\SymcData\virusdefs-2.5-e\usage.dat

c:\windows\BDOSCAN8

c:\windows\BDOSCAN8\bdcore.dll

c:\windows\BDOSCAN8\bdoscan.ini

c:\windows\BDOSCAN8\bdoscan.log

c:\windows\BDOSCAN8\ipsupd.dll

c:\windows\BDOSCAN8\lang.ini

c:\windows\BDOSCAN8\libfn.dll

c:\windows\BDOSCAN8\live.ini

c:\windows\BDOSCAN8\oscan82.ocx

c:\windows\BDOSCAN8\scanoptions.tsi

c:\windows\BDOSCAN8\scanoptions.tsk

c:\windows\system32\drivers\NSS

c:\windows\system32\drivers\NSS\0203000.02C\isolate.ini

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_FXDRV32

-------\Legacy_YTXYY

-------\Service_FXDrv32

-------\Service_ytxyy