Още едно "чудо"

19 декември 200916 г.

Още един случай на чудо, очаквам напътствия

19 декември 200916 г.

Изтеглете ComboFix от някой от следните линкове:

* ВАЖНО !!! Запазете ComboFix.exe на вашия десктоп

Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

Стартирайте KittyFix.exe и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

19 декември 200916 г.

Автор

ComboFix 09-12-18.03 - Administrator 12/19/2009 19:15:43.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.1917.1292 [GMT 2:00]

Running from: c:\documents and settings\Administrator\Desktop\KittyFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\autorun.inf

C:\girhkwbqa.bat

c:\program files\AskSearch\bin\DeFAultsearch.dll

C:\qwjdkajcqykrr.bat

C:\uyjbgubseku.bat

E:\Autorun.inf

E:\girhkwbqa.bat

E:\qwjdkajcqykrr.bat

E:\uyjbgubseku.bat

.

((((((((((((((((((((((((( Files Created from 2009-11-19 to 2009-12-19 )))))))))))))))))))))))))))))))

.

2009-12-19 11:51 . 2009-12-19 11:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\TeamViewer

2009-12-19 11:51 . 2009-12-19 11:51 -------- d-----w- c:\program files\TeamViewer

2009-12-19 11:50 . 2009-12-19 11:50 -------- d-----w- c:\documents and settings\Administrator\temp

2009-12-18 15:43 . 2009-12-18 15:43 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\ESET

2009-12-17 10:16 . 2009-12-17 10:16 -------- d-----w- C:\$AVG

2009-12-17 10:16 . 2009-12-17 10:16 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2009-12-17 10:16 . 2009-12-17 10:25 -------- d-----w- c:\windows\SxsCaPendDel

2009-12-16 17:35 . 2009-12-19 17:03 -------- d-----w- c:\program files\Spybot - Search & Destroy

2009-12-16 17:35 . 2009-12-19 15:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-12-16 14:50 . 2009-12-16 14:52 -------- d-----w- c:\windows\system32\NtmsData

2009-12-16 14:07 . 2009-12-16 14:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\ESET

2009-12-16 11:24 . 2009-12-16 11:24 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles

2009-12-16 11:22 . 2009-12-16 11:22 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET

2009-12-16 10:43 . 2009-12-16 10:43 -------- d-s---w- c:\documents and settings\Administrator\UserData

2009-12-16 07:48 . 2009-12-16 07:48 -------- d-----w- c:\program files\Skype

2009-12-16 07:20 . 2009-12-16 07:20 -------- d-----w- c:\program files\Common Files\Skype

2009-12-15 12:38 . 2009-12-15 12:38 -------- d-----w- c:\program files\Common Files\xing shared

2009-12-15 12:38 . 2009-12-15 12:38 -------- d-----w- c:\program files\Real

2009-12-15 05:58 . 2009-12-15 12:38 -------- d-----w- c:\program files\Common Files\Real

2009-12-14 22:53 . 2009-12-14 22:53 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\mat.soft

2009-12-14 20:20 . 2007-03-22 10:46 126976 ----a-w- c:\documents and settings\Administrator\Application Data\GRETECH\GomPlayer\GrLauncher.exe

2009-12-14 20:19 . 2009-12-14 22:15 -------- d-----w- c:\program files\The KMPlayer

2009-12-14 19:49 . 2009-12-14 19:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nero

2009-12-14 19:13 . 2009-12-14 19:13 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2009-12-14 19:13 . 2009-12-19 17:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM

2009-12-14 19:03 . 2009-12-14 19:03 10134 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe

2009-12-14 19:03 . 2009-12-14 19:03 10134 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe

2009-12-14 19:03 . 2009-12-14 19:03 10134 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe

2009-12-14 19:03 . 2007-02-03 08:32 41504 ----a-w- c:\windows\system32\drivers\LVUSBSta.sys

2009-12-14 19:03 . 2007-02-03 08:32 527136 ----a-w- c:\windows\system32\LVUI2RC.dll

2009-12-14 19:03 . 2007-02-03 08:32 215840 ----a-w- c:\windows\system32\LVUI2.dll

2009-12-14 19:03 . 2007-02-03 08:29 129824 ----a-w- c:\windows\system32\lvci1051.dll

2009-12-14 19:03 . 2007-02-03 08:29 264992 ----a-w- c:\windows\system32\lvcodec2.dll

2009-12-14 19:03 . 2007-02-03 08:26 154400 ----a-w- c:\windows\system\CamExL20.dll

2009-12-14 19:03 . 2007-02-03 08:25 1075360 ----a-w- c:\windows\system32\drivers\Camdrl.sys

2009-12-14 19:03 . 2007-02-03 07:01 13398 ----a-w- c:\windows\system32\Repository.reg

2009-12-14 19:03 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system\msvcr71.dll

2009-12-14 19:02 . 2009-12-14 19:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Logishrd

2009-12-14 19:02 . 2009-12-14 19:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Logitech

2009-12-14 19:02 . 2009-12-14 19:06 -------- d-----w- c:\program files\Common Files\LogiShrd

2009-12-14 19:01 . 2009-12-14 19:02 -------- d-----w- c:\program files\Logitech

2009-12-14 16:51 . 2009-12-14 19:22 -------- d-----w- c:\program files\Webteh

2009-12-14 16:27 . 1999-11-11 11:47 6416 ----a-w- c:\windows\system32\kbdinori.Dll

2009-12-14 16:27 . 2000-11-17 06:47 8992 ----a-w- c:\windows\system32\kbdbphz.dLL

2009-12-14 16:27 . 2000-11-14 23:52 6416 ----a-w- c:\windows\system32\kbdbds.Dll

2009-12-14 16:27 . 1999-12-07 07:00 6416 ----a-w- c:\windows\system32\kbdbp.Dll

2009-12-14 16:27 . 1999-11-18 03:04 7440 ----a-w- c:\windows\system32\Kbddll.dll

2009-12-14 16:27 . 1999-11-11 11:47 6416 ----a-w- c:\windows\system32\kbdinasa.Dll

2009-12-14 16:27 . 1999-11-11 11:47 6928 ----a-w- c:\windows\system32\kbdhebx.Dll

2009-12-14 16:27 . 1997-04-03 19:00 8992 ----a-w- c:\windows\system32\KBDBPH.dLL

2009-12-14 16:27 . 2002-04-22 22:17 45056 ----a-w- c:\windows\system32\newdll.dll

2009-12-14 16:27 . 2009-12-14 16:27 -------- d-----w- c:\program files\Datecs

2009-12-14 16:17 . 2009-12-14 16:17 -------- d-----w- c:\program files\KoralSoft

2009-12-14 16:01 . 2009-12-19 17:13 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype

2009-12-14 16:00 . 2009-12-16 07:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\Sammsoft

2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\program files\AskSearch

2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\program files\AskBarDis

2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\program files\Advanced Registry Optimizer

2009-12-14 15:39 . 2009-12-14 15:39 -------- d-----w- c:\windows\ShellNew

2009-12-14 15:39 . 2009-12-14 15:39 -------- d-----w- c:\program files\Common Files\L&H

2009-12-14 15:03 . 2001-08-17 11:48 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys

2009-12-14 15:03 . 2001-08-17 11:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys

2009-12-14 10:43 . 2009-12-14 10:50 -------- d-----w- c:\windows\NV116308.TMP

2009-12-14 10:42 . 2007-05-27 12:57 1732 ----a-r- c:\windows\system32\drivers\nvphy.bin

2009-12-14 10:42 . 2007-09-15 01:19 356352 ----a-w- c:\windows\system32\nvunrm.exe

2009-12-14 10:41 . 2007-07-05 07:01 356352 ----a-r- c:\windows\system32\nvusmb.exe

2009-12-14 10:32 . 2004-08-11 00:00 5810 ----a-r- c:\windows\system32\drivers\ASACPI.sys

2009-12-03 14:06 . 2008-09-11 11:21 282624 ----a-r- c:\windows\system32\CM106rm.exe

2009-12-03 14:06 . 2008-05-20 17:18 221184 ----a-r- c:\windows\system\cm106eye.exe

2009-12-03 14:06 . 2006-09-13 12:08 491520 ----a-r- c:\windows\system\cmau106.dll

2009-12-03 14:06 . 2008-10-13 19:21 1506304 ----a-r- c:\windows\system32\drivers\CM106.sys

2009-12-03 14:06 . 2004-04-14 10:28 315392 ----a-r- c:\windows\system\fltr106.dll

2009-12-03 14:05 . 2008-07-24 10:55 278528 ------r- c:\windows\Cmi106Uninstall.exe

2009-12-03 14:05 . 2009-12-03 14:05 -------- d-----w- c:\program files\USB Multi-Channel Audio Device

2009-12-03 14:03 . 2008-04-14 03:41 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll

2009-12-03 14:03 . 2008-04-14 03:41 21504 ----a-w- c:\windows\system32\hidserv.dll

2009-12-03 14:03 . 2008-04-13 22:15 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys

2009-12-03 14:03 . 2008-04-13 22:15 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys

2009-12-03 14:02 . 2008-04-13 22:15 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys

2009-12-03 14:02 . 2008-04-13 22:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys

2009-12-03 14:02 . 2008-04-13 22:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys

2009-12-03 14:02 . 2008-04-13 22:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2009-11-23 08:47 . 2009-11-23 08:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\GRETECH

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-19 17:14 . 2009-08-17 18:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent

2009-12-17 10:18 . 2009-12-15 22:32 463 ---h--w- c:\program files\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd

2009-12-17 10:18 . 2009-12-15 22:32 4528 ---h--w- c:\program files\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz

2009-12-16 07:53 . 2009-09-03 16:31 21496 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-12-16 07:52 . 2009-08-17 17:48 86627 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-12-15 12:38 . 2003-03-18 19:14 499712 ----a-w- c:\windows\system32\msvcp71.dll

2009-12-15 12:38 . 2003-02-21 03:42 348160 ----a-w- c:\windows\system32\msvcr71.dll

2009-12-14 22:07 . 2009-08-17 18:13 -------- d-----w- c:\documents and settings\Administrator\Application Data\AIMP

2009-12-14 19:28 . 2009-12-14 19:23 -------- d-----w- c:\documents and settings\Administrator\Application Data\BSplayer

2009-12-14 19:23 . 2009-12-14 19:23 -------- d-----w- c:\documents and settings\Administrator\Application Data\BSplayer Pro

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

2008-08-06 13:20 279944 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-06 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AROReminder"="c:\program files\Advanced Registry Optimizer\aro.exe" [2009-10-22 2132480]

"rymhpgqkzivdef"="cqlncarsoeynvdnjzroxg.exe" [2009-12-19 512000]

"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"ucrnwozukuirtvz"="pasrdymkdqhtydkdqf.exe ." [X]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"GEST"="=" [X]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]

"nwiz"="nwiz.exe" [2007-10-04 1626112]

"RTHDCPL"="RTHDCPL.EXE" [2008-12-09 18063872]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]

"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-07 488984]

"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-07 774168]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-12-15 198160]

"uyjbgubseku"="amffsodcwkcpvbjdrhc.exe" [2009-12-19 512000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"rwibhwewjqbh"="cqlncarsoeynvdnjzroxg.exe ." [X]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-11-27 15360]

"rymhpgqkzivdef"="nauvjgwwrgznubkfulhp.exe" [2009-12-19 512000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ucrnwozukuirtvz"="cqlncarsoeynvdnjzroxg.exe ." [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]

"qwjdkajcqykrr"="cqlncarsoeynvdnjzroxg.exe" [2009-12-19 512000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2009-12-14 95232]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableInstallerDetection"= 0 (0x0)

"EnableSecureUIAPaths"= 0 (0x0)

"EnableVirtualization"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

SafeBoot registry key needs repairs. This machine cannot enter Safe Mode.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]

@="Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

@="DiskDrive"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

@="Hdc"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

@="Keyboard"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

@="Mouse"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

@="System"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

@="Volume"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM106.sys [12/3/2009 4:06 PM 1506304]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://search.babylon.com/home

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ofbeko8g.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/firefox

FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13153&gct=&gc=1&q=

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

.

- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

HKCU-RunOnce-rwibhwewjqbh - c:\docume~1\ADMINI~1\LOCALS~1\Temp\ziyvfykgxixhknsj.exe

HKLM-Run-Cm106Sound - cm106.cpl

HKLM-RunOnce-ziyvfykgxixhknsj - c:\docume~1\ADMINI~1\LOCALS~1\Temp\ziyvfykgxixhknsj.exe

HKU-Default-RunOnce-rwibhwewjqbh - c:\docume~1\ADMINI~1\LOCALS~1\Temp\gqhfqkxumyozdhnfr.exe

**************************************************************************

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files:

**************************************************************************

.

Completion time: 2009-12-19 19:18:06

ComboFix-quarantined-files.txt 2009-12-19 17:18

Pre-Run: 37,470,109,696 bytes free

Post-Run: 37,564,637,184 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 8E9BAB6AFD8BD0813B253E006D044CD7

Ако може накрая кажи как да се възстанови AutoRun

P.S: Като пусна ComboFix и ме изхвърля от TeamViewer

Редактирано 19 декември 200916 г. от daniel1995 (преглед на промените)

19 декември 200916 г.

Като ти се дадат инструкции се четат по веднъж, два пъти, а ако се налага и три пъти.

ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.

Болдирано е и пак не му се обръща внимание!

Стъпка 1:

Изтеглете SafeBootKeyRepair от тук или тук. Запазете го на вашия десктоп.

1. Стартирайте програмата.

2. Изчакайте, докато тя извърши нужните процедури.

3. Когато завърши, инструментът ще генерира лог файл, намиращ се в C:\SafeBoot_Repair.txt.

Накрая публикувайте съдържанието на SafeBoot_Repair.txt

Стъпка 2:

Отворете Notepad и чрез комбинацията copy/paste поставете следния текст:



Killall::


Collect::

c:\program files\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd

c:\program files\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz


File::

c:\windows\NV116308.TMP


Registry::

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"rymhpgqkzivdef"=-


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"ucrnwozukuirtvz"=-


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"GEST"=-

"uyjbgubseku"=-


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"rwibhwewjqbh"=-


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"rymhpgqkzivdef"=-


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ucrnwozukuirtvz"=-


[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]

"qwjdkajcqykrr"=-

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След като, програмата приключи ще Ви изведе лог файла. Отново чрез комбинацията от Copy/Paste поставете информацията тук.

Стъпка 3:

Изтеглете OTL (от OldTimer) и го запазете на вашия десктоп.

Кликнете два пъти върху OTL.exe, за да стартирате програмата.

Сложете отметки преди следните неща:

Scan all users
Lop check
Purity check

Под секцията Extra Registry, изберете Use SafeList

Кликнете на Run Scan и изчакайте да завърши сканирането. (може да отнеме 10-15 минути)

Когато завърши, публикувайте следните два лог файла:

OTL.txt (намира се на вашия десктоп)
Extras.txt (ще Ви се отвори автоматично)

19 декември 200916 г.

Автор

SafeBoot

Reg export of SafeBoot key after repair:

========================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot]

"AlternateShell"="cmd.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\AppMgmt]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Base]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot Bus Extender]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot file system]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\CryptSvc]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\DcomLaunch]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmadmin]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmboot.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmio.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmload.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmserver]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\EventLog]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\File system]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Filter]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\HelpSvc]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Netlogon]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PCI Configuration]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PEVSystemStart]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PlugPlay]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PNP Filter]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Primary disk]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\procexp90.Sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\RpcSs]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SCSI Class]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sermouse.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sr.sys]

@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SRService]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\System Bus Extender]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vga.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vgasave.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\WinMgmt]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]

@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]

@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

@="DiskDrive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]

@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

@="Hdc"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

@="Keyboard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

@="Mouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]

@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

@="SCSIAdapter"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

@="System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]

@="Floppy disk drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

@="Volume"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

@="Human Interface Devices"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AFD]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AppMgmt]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Base]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot Bus Extender]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot file system]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Browser]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\CryptSvc]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DcomLaunch]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Dhcp]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmadmin]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmboot.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmio.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmload.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmserver]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DnsCache]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\EventLog]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\File system]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Filter]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\HelpSvc]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ip6fw.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ipnat.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanServer]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanWorkstation]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LmHosts]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Messenger]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS Wrapper]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Ndisuio]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOS]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOSGroup]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBT]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetDDEGroup]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Netlogon]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetMan]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Network]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetworkProvider]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NtLmSsp]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PCI Configuration]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PEVSystemStart]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PlugPlay]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP Filter]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP_TDI]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Primary disk]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\procexp90.Sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpcdd.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpdd.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpwd.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdsessmgr]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\RpcSs]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SCSI Class]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sermouse.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SharedAccess]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sr.sys]

@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SRService]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Streams Drivers]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\System Bus Extender]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Tcpip]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\TDI]

@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdpipe.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdtcp.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\termservice]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vga.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vgasave.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WinMgmt]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WZCSVC]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{36FC9E60-C465-11CF-8056-444553540000}]

@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}]

@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]

@="DiskDrive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]

@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

@="Hdc"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

@="Keyboard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

@="Mouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}]

@="Net"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}]

@="NetClient"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}]

@="NetService"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}]

@="NetTrans"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}]

@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

@="SCSIAdapter"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

@="System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]

@="Floppy disk drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

@="Volume"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

@="Human Interface Devices"

========================

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\PEVSystemStart

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\procexp90.Sys

ComboFix

еComboFix 09-12-18.03 - Administrator 12/19/2009 19:55:25.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.1917.1344 [GMT 2:00]

Running from: c:\documents and settings\Administrator\Desktop\KittyFix.exe

Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

FILE ::

"c:\windows\NV116308.TMP"

file zipped: c:\program files\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd

file zipped: c:\program files\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\autorun.inf

C:\girhkwbqa.bat

c:\program files\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd

c:\program files\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz

C:\qwjdkajcqykrr.bat

C:\uyjbgubseku.bat

E:\Autorun.inf

E:\girhkwbqa.bat

E:\qwjdkajcqykrr.bat

E:\uyjbgubseku.bat

.

((((((((((((((((((((((((( Files Created from 2009-11-19 to 2009-12-19 )))))))))))))))))))))))))))))))

.

2009-12-19 17:13 . 2009-12-19 17:18 -------- d-----w- C:\KittyFix

2009-12-19 11:51 . 2009-12-19 11:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\TeamViewer

2009-12-19 11:51 . 2009-12-19 11:51 -------- d-----w- c:\program files\TeamViewer

2009-12-19 11:50 . 2009-12-19 11:50 -------- d-----w- c:\documents and settings\Administrator\temp

2009-12-18 15:43 . 2009-12-18 15:43 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\ESET

2009-12-17 10:16 . 2009-12-17 10:16 -------- d-----w- C:\$AVG

2009-12-17 10:16 . 2009-12-17 10:16 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2009-12-17 10:16 . 2009-12-17 10:25 -------- d-----w- c:\windows\SxsCaPendDel

2009-12-16 17:35 . 2009-12-19 17:03 -------- d-----w- c:\program files\Spybot - Search & Destroy

2009-12-16 17:35 . 2009-12-19 15:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-12-16 14:50 . 2009-12-16 14:52 -------- d-----w- c:\windows\system32\NtmsData

2009-12-16 14:07 . 2009-12-16 14:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\ESET

2009-12-16 11:24 . 2009-12-16 11:24 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles

2009-12-16 11:22 . 2009-12-16 11:22 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET

2009-12-16 10:43 . 2009-12-16 10:43 -------- d-s---w- c:\documents and settings\Administrator\UserData

2009-12-16 07:48 . 2009-12-16 07:48 -------- d-----w- c:\program files\Skype

2009-12-16 07:20 . 2009-12-16 07:20 -------- d-----w- c:\program files\Common Files\Skype

2009-12-15 12:38 . 2009-12-15 12:38 -------- d-----w- c:\program files\Common Files\xing shared

2009-12-15 12:38 . 2009-12-15 12:38 -------- d-----w- c:\program files\Real

2009-12-15 05:58 . 2009-12-15 12:38 -------- d-----w- c:\program files\Common Files\Real

2009-12-14 22:53 . 2009-12-14 22:53 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\mat.soft

2009-12-14 20:20 . 2007-03-22 10:46 126976 ----a-w- c:\documents and settings\Administrator\Application Data\GRETECH\GomPlayer\GrLauncher.exe

2009-12-14 20:19 . 2009-12-14 22:15 -------- d-----w- c:\program files\The KMPlayer

2009-12-14 19:49 . 2009-12-14 19:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nero

2009-12-14 19:13 . 2009-12-14 19:13 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2009-12-14 19:13 . 2009-12-19 17:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM

2009-12-14 19:03 . 2009-12-14 19:03 10134 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe

2009-12-14 19:03 . 2009-12-14 19:03 10134 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe

2009-12-14 19:03 . 2009-12-14 19:03 10134 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe

2009-12-14 19:03 . 2007-02-03 08:32 41504 ----a-w- c:\windows\system32\drivers\LVUSBSta.sys

2009-12-14 19:03 . 2007-02-03 08:32 527136 ----a-w- c:\windows\system32\LVUI2RC.dll

2009-12-14 19:03 . 2007-02-03 08:32 215840 ----a-w- c:\windows\system32\LVUI2.dll

2009-12-14 19:03 . 2007-02-03 08:29 129824 ----a-w- c:\windows\system32\lvci1051.dll

2009-12-14 19:03 . 2007-02-03 08:29 264992 ----a-w- c:\windows\system32\lvcodec2.dll

2009-12-14 19:03 . 2007-02-03 08:26 154400 ----a-w- c:\windows\system\CamExL20.dll

2009-12-14 19:03 . 2007-02-03 08:25 1075360 ----a-w- c:\windows\system32\drivers\Camdrl.sys

2009-12-14 19:03 . 2007-02-03 07:01 13398 ----a-w- c:\windows\system32\Repository.reg

2009-12-14 19:03 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system\msvcr71.dll

2009-12-14 19:02 . 2009-12-14 19:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Logishrd

2009-12-14 19:02 . 2009-12-14 19:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Logitech

2009-12-14 19:02 . 2009-12-14 19:06 -------- d-----w- c:\program files\Common Files\LogiShrd

2009-12-14 19:01 . 2009-12-14 19:02 -------- d-----w- c:\program files\Logitech

2009-12-14 16:51 . 2009-12-14 19:22 -------- d-----w- c:\program files\Webteh

2009-12-14 16:27 . 1999-11-11 11:47 6416 ----a-w- c:\windows\system32\kbdinori.Dll

2009-12-14 16:27 . 2000-11-17 06:47 8992 ----a-w- c:\windows\system32\kbdbphz.dLL

2009-12-14 16:27 . 2000-11-14 23:52 6416 ----a-w- c:\windows\system32\kbdbds.Dll

2009-12-14 16:27 . 1999-12-07 07:00 6416 ----a-w- c:\windows\system32\kbdbp.Dll

2009-12-14 16:27 . 1999-11-18 03:04 7440 ----a-w- c:\windows\system32\Kbddll.dll

2009-12-14 16:27 . 1999-11-11 11:47 6416 ----a-w- c:\windows\system32\kbdinasa.Dll

2009-12-14 16:27 . 1999-11-11 11:47 6928 ----a-w- c:\windows\system32\kbdhebx.Dll

2009-12-14 16:27 . 1997-04-03 19:00 8992 ----a-w- c:\windows\system32\KBDBPH.dLL

2009-12-14 16:27 . 2002-04-22 22:17 45056 ----a-w- c:\windows\system32\newdll.dll

2009-12-14 16:27 . 2009-12-14 16:27 -------- d-----w- c:\program files\Datecs

2009-12-14 16:17 . 2009-12-14 16:17 -------- d-----w- c:\program files\KoralSoft

2009-12-14 16:01 . 2009-12-19 17:54 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype

2009-12-14 16:00 . 2009-12-16 07:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\Sammsoft

2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\program files\AskSearch

2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\program files\AskBarDis

2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\program files\Advanced Registry Optimizer

2009-12-14 15:39 . 2009-12-14 15:39 -------- d-----w- c:\windows\ShellNew

2009-12-14 15:39 . 2009-12-14 15:39 -------- d-----w- c:\program files\Common Files\L&H

2009-12-14 15:03 . 2001-08-17 11:48 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys

2009-12-14 15:03 . 2001-08-17 11:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys

2009-12-14 10:43 . 2009-12-14 10:50 -------- d-----w- c:\windows\NV116308.TMP

2009-12-14 10:42 . 2007-05-27 12:57 1732 ----a-r- c:\windows\system32\drivers\nvphy.bin

2009-12-14 10:42 . 2007-09-15 01:19 356352 ----a-w- c:\windows\system32\nvunrm.exe

2009-12-14 10:41 . 2007-07-05 07:01 356352 ----a-r- c:\windows\system32\nvusmb.exe

2009-12-14 10:32 . 2004-08-11 00:00 5810 ----a-r- c:\windows\system32\drivers\ASACPI.sys

2009-12-03 14:06 . 2008-09-11 11:21 282624 ----a-r- c:\windows\system32\CM106rm.exe

2009-12-03 14:06 . 2008-05-20 17:18 221184 ----a-r- c:\windows\system\cm106eye.exe

2009-12-03 14:06 . 2006-09-13 12:08 491520 ----a-r- c:\windows\system\cmau106.dll

2009-12-03 14:06 . 2008-10-13 19:21 1506304 ----a-r- c:\windows\system32\drivers\CM106.sys

2009-12-03 14:06 . 2004-04-14 10:28 315392 ----a-r- c:\windows\system\fltr106.dll

2009-12-03 14:05 . 2008-07-24 10:55 278528 ------r- c:\windows\Cmi106Uninstall.exe

2009-12-03 14:05 . 2009-12-03 14:05 -------- d-----w- c:\program files\USB Multi-Channel Audio Device

2009-12-03 14:03 . 2008-04-14 03:41 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll

2009-12-03 14:03 . 2008-04-14 03:41 21504 ----a-w- c:\windows\system32\hidserv.dll

2009-12-03 14:03 . 2008-04-13 22:15 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys

2009-12-03 14:03 . 2008-04-13 22:15 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys

2009-12-03 14:02 . 2008-04-13 22:15 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys

2009-12-03 14:02 . 2008-04-13 22:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys

2009-12-03 14:02 . 2008-04-13 22:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys

2009-12-03 14:02 . 2008-04-13 22:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2009-11-23 08:47 . 2009-11-23 08:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\GRETECH

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-19 17:54 . 2009-08-17 18:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent

2009-12-19 17:54 . 2009-12-15 22:32 316 ---h--w- c:\program files\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo

2009-12-16 07:53 . 2009-09-03 16:31 21496 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-12-16 07:52 . 2009-08-17 17:48 86627 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-12-15 12:38 . 2003-03-18 19:14 499712 ----a-w- c:\windows\system32\msvcp71.dll

2009-12-15 12:38 . 2003-02-21 03:42 348160 ----a-w- c:\windows\system32\msvcr71.dll

2009-12-14 22:07 . 2009-08-17 18:13 -------- d-----w- c:\documents and settings\Administrator\Application Data\AIMP

2009-12-14 19:28 . 2009-12-14 19:23 -------- d-----w- c:\documents and settings\Administrator\Application Data\BSplayer

2009-12-14 19:23 . 2009-12-14 19:23 -------- d-----w- c:\documents and settings\Administrator\Application Data\BSplayer Pro

.

((((((((((((((((((((((((((((( SnapShot@2009-12-19_17.17.18 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\ziyvfykgxixhknsj.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\ziyvfykgxixhknsj.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\tiehxwoqnezpyhspgzxhrg.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\tiehxwoqnezpyhspgzxhrg.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\ziyvfykgxixhknsj.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\ziyvfykgxixhknsj.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\tiehxwoqnezpyhspgzxhrg.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\tiehxwoqnezpyhspgzxhrg.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\pasrdymkdqhtydkdqf.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\pasrdymkdqhtydkdqf.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\nauvjgwwrgznubkfulhp.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\nauvjgwwrgznubkfulhp.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\gqhfqkxumyozdhnfr.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\gqhfqkxumyozdhnfr.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\cqlncarsoeynvdnjzroxg.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\cqlncarsoeynvdnjzroxg.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\amffsodcwkcpvbjdrhc.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\amffsodcwkcpvbjdrhc.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\pasrdymkdqhtydkdqf.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\pasrdymkdqhtydkdqf.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\nauvjgwwrgznubkfulhp.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\nauvjgwwrgznubkfulhp.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\gqhfqkxumyozdhnfr.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\gqhfqkxumyozdhnfr.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\cqlncarsoeynvdnjzroxg.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\cqlncarsoeynvdnjzroxg.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\amffsodcwkcpvbjdrhc.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\amffsodcwkcpvbjdrhc.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

2008-08-06 13:20 279944 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-06 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AROReminder"="c:\program files\Advanced Registry Optimizer\aro.exe" [2009-10-22 2132480]

"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]

"nwiz"="nwiz.exe" [2007-10-04 1626112]

"RTHDCPL"="RTHDCPL.EXE" [2008-12-09 18063872]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]

"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-07 488984]

"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-07 774168]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-12-15 198160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-11-27 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2009-12-14 95232]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableInstallerDetection"= 0 (0x0)

"EnableSecureUIAPaths"= 0 (0x0)

"EnableVirtualization"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM106.sys [12/3/2009 4:06 PM 1506304]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://search.babylon.com/home

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ofbeko8g.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/firefox

FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13153&gct=&gc=1&q=

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-12-19 19:57

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(7784)

c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll

c:\windows\system32\newdll.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe

c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\windows\system32\nvsvc32.exe

c:\windows\RTHDCPL.EXE

c:\windows\system32\RUNDLL32.EXE

c:\program files\Skype\Phone\Skype.exe

c:\program files\Common Files\LogiShrd\LComMgr\LVComSX.exe

c:\windows\system32\wscntfy.exe

c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe

c:\program files\Skype\Plugin Manager\skypePM.exe

.

**************************************************************************

.

Completion time: 2009-12-19 19:59:13 - machine was rebooted

ComboFix-quarantined-files.txt 2009-12-19 17:59

ComboFix2.txt 2009-12-19 17:18

Pre-Run: 37,617,070,080 bytes free

Post-Run: 37,560,705,024 bytes free

- - End Of File - - 9A8D55B055D3C536EE8F66A7D2727949

OTL

http://rapidshare.de/files/48862960/OTL.Txt.html

Extras

http://rapidshare.de/files/48862970/Extras.Txt.html

Извинявам се за одеве. Просто гледах че скайпа работи и се обърках

19 декември 200916 г.

Явно ще ни трябва Recovery Console.

Изтеглете този файл и го запазете на вашия десктоп.

Затворете всички отворени прозорци и програми, след това вземете изтегления файл и го поставете върху ComboFix. Това ще стартира ComboFix, след което е необходимо да примете лицензното споразумение, за да продължите с инсталирането на Microsoft Recovery Console. Когато приключи ще бедете попитани дали желаете да продължите със сканирането на зловреден софтуер. Изберете Yes. Накрая, публикувайте в следващия Ви пост лога от ComboFix.

19 декември 200916 г.

Автор

Компютъра се рестартира повторно и затова влезнах в C: и видях че ComboFix.txt е с дата на модифициране преди 4 мин и затова копирах него

ComboFix 09-12-18.03 - Administrator 12/19/2009 20:24:01.3.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.1917.1507 [GMT 2:00]

Running from: c:\documents and settings\Administrator\Desktop\KittyFix.exe

Command switches used :: c:\documents and settings\Administrator\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

.

((((((((((((((((((((((((( Files Created from 2009-11-19 to 2009-12-19 )))))))))))))))))))))))))))))))

.

2009-12-19 17:13 . 2009-12-19 17:18 -------- d-----w- C:\KittyFix

2009-12-19 11:51 . 2009-12-19 11:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\TeamViewer

2009-12-19 11:51 . 2009-12-19 11:51 -------- d-----w- c:\program files\TeamViewer

2009-12-19 11:50 . 2009-12-19 11:50 -------- d-----w- c:\documents and settings\Administrator\temp

2009-12-18 15:43 . 2009-12-18 15:43 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\ESET

2009-12-17 10:16 . 2009-12-17 10:16 -------- d-----w- C:\$AVG

2009-12-17 10:16 . 2009-12-17 10:16 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2009-12-17 10:16 . 2009-12-17 10:25 -------- d-----w- c:\windows\SxsCaPendDel

2009-12-16 17:35 . 2009-12-19 17:03 -------- d-----w- c:\program files\Spybot - Search & Destroy

2009-12-16 17:35 . 2009-12-19 15:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-12-16 14:50 . 2009-12-16 14:52 -------- d-----w- c:\windows\system32\NtmsData

2009-12-16 14:07 . 2009-12-16 14:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\ESET

2009-12-16 11:24 . 2009-12-16 11:24 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles

2009-12-16 11:22 . 2009-12-16 11:22 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET

2009-12-16 10:43 . 2009-12-16 10:43 -------- d-s---w- c:\documents and settings\Administrator\UserData

2009-12-16 07:48 . 2009-12-16 07:48 -------- d-----w- c:\program files\Skype

2009-12-16 07:20 . 2009-12-16 07:20 -------- d-----w- c:\program files\Common Files\Skype

2009-12-15 12:38 . 2009-12-15 12:38 -------- d-----w- c:\program files\Common Files\xing shared

2009-12-15 12:38 . 2009-12-15 12:38 -------- d-----w- c:\program files\Real

2009-12-15 05:58 . 2009-12-15 12:38 -------- d-----w- c:\program files\Common Files\Real

2009-12-14 22:53 . 2009-12-14 22:53 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\mat.soft

2009-12-14 20:20 . 2007-03-22 10:46 126976 ----a-w- c:\documents and settings\Administrator\Application Data\GRETECH\GomPlayer\GrLauncher.exe

2009-12-14 20:19 . 2009-12-14 22:15 -------- d-----w- c:\program files\The KMPlayer

2009-12-14 19:49 . 2009-12-14 19:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nero

2009-12-14 19:13 . 2009-12-14 19:13 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2009-12-14 19:13 . 2009-12-19 17:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM

2009-12-14 19:03 . 2009-12-14 19:03 10134 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe

2009-12-14 19:03 . 2009-12-14 19:03 10134 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe

2009-12-14 19:03 . 2009-12-14 19:03 10134 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe

2009-12-14 19:03 . 2007-02-03 08:32 41504 ----a-w- c:\windows\system32\drivers\LVUSBSta.sys

2009-12-14 19:03 . 2007-02-03 08:32 527136 ----a-w- c:\windows\system32\LVUI2RC.dll

2009-12-14 19:03 . 2007-02-03 08:32 215840 ----a-w- c:\windows\system32\LVUI2.dll

2009-12-14 19:03 . 2007-02-03 08:29 129824 ----a-w- c:\windows\system32\lvci1051.dll

2009-12-14 19:03 . 2007-02-03 08:29 264992 ----a-w- c:\windows\system32\lvcodec2.dll

2009-12-14 19:03 . 2007-02-03 08:26 154400 ----a-w- c:\windows\system\CamExL20.dll

2009-12-14 19:03 . 2007-02-03 08:25 1075360 ----a-w- c:\windows\system32\drivers\Camdrl.sys

2009-12-14 19:03 . 2007-02-03 07:01 13398 ----a-w- c:\windows\system32\Repository.reg

2009-12-14 19:03 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system\msvcr71.dll

2009-12-14 19:02 . 2009-12-14 19:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Logishrd

2009-12-14 19:02 . 2009-12-14 19:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Logitech

2009-12-14 19:02 . 2009-12-14 19:06 -------- d-----w- c:\program files\Common Files\LogiShrd

2009-12-14 19:01 . 2009-12-14 19:02 -------- d-----w- c:\program files\Logitech

2009-12-14 16:51 . 2009-12-14 19:22 -------- d-----w- c:\program files\Webteh

2009-12-14 16:27 . 1999-11-11 11:47 6416 ----a-w- c:\windows\system32\kbdinori.Dll

2009-12-14 16:27 . 2000-11-17 06:47 8992 ----a-w- c:\windows\system32\kbdbphz.dLL

2009-12-14 16:27 . 2000-11-14 23:52 6416 ----a-w- c:\windows\system32\kbdbds.Dll

2009-12-14 16:27 . 1999-12-07 07:00 6416 ----a-w- c:\windows\system32\kbdbp.Dll

2009-12-14 16:27 . 1999-11-18 03:04 7440 ----a-w- c:\windows\system32\Kbddll.dll

2009-12-14 16:27 . 1999-11-11 11:47 6416 ----a-w- c:\windows\system32\kbdinasa.Dll

2009-12-14 16:27 . 1999-11-11 11:47 6928 ----a-w- c:\windows\system32\kbdhebx.Dll

2009-12-14 16:27 . 1997-04-03 19:00 8992 ----a-w- c:\windows\system32\KBDBPH.dLL

2009-12-14 16:27 . 2002-04-22 22:17 45056 ----a-w- c:\windows\system32\newdll.dll

2009-12-14 16:27 . 2009-12-14 16:27 -------- d-----w- c:\program files\Datecs

2009-12-14 16:17 . 2009-12-14 16:17 -------- d-----w- c:\program files\KoralSoft

2009-12-14 16:01 . 2009-12-19 18:23 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype

2009-12-14 16:00 . 2009-12-16 07:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\Sammsoft

2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\program files\AskSearch

2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\program files\AskBarDis

2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\program files\Advanced Registry Optimizer

2009-12-14 15:39 . 2009-12-14 15:39 -------- d-----w- c:\windows\ShellNew

2009-12-14 15:39 . 2009-12-14 15:39 -------- d-----w- c:\program files\Common Files\L&H

2009-12-14 15:03 . 2001-08-17 11:48 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys

2009-12-14 15:03 . 2001-08-17 11:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys

2009-12-14 10:43 . 2009-12-14 10:50 -------- d-----w- c:\windows\NV116308.TMP

2009-12-14 10:42 . 2007-05-27 12:57 1732 ----a-r- c:\windows\system32\drivers\nvphy.bin

2009-12-14 10:42 . 2007-09-15 01:19 356352 ----a-w- c:\windows\system32\nvunrm.exe

2009-12-14 10:41 . 2007-07-05 07:01 356352 ----a-r- c:\windows\system32\nvusmb.exe

2009-12-14 10:32 . 2004-08-11 00:00 5810 ----a-r- c:\windows\system32\drivers\ASACPI.sys

2009-12-03 14:06 . 2008-09-11 11:21 282624 ----a-r- c:\windows\system32\CM106rm.exe

2009-12-03 14:06 . 2008-05-20 17:18 221184 ----a-r- c:\windows\system\cm106eye.exe

2009-12-03 14:06 . 2006-09-13 12:08 491520 ----a-r- c:\windows\system\cmau106.dll

2009-12-03 14:06 . 2008-10-13 19:21 1506304 ----a-r- c:\windows\system32\drivers\CM106.sys

2009-12-03 14:06 . 2004-04-14 10:28 315392 ----a-r- c:\windows\system\fltr106.dll

2009-12-03 14:05 . 2008-07-24 10:55 278528 ------r- c:\windows\Cmi106Uninstall.exe

2009-12-03 14:05 . 2009-12-03 14:05 -------- d-----w- c:\program files\USB Multi-Channel Audio Device

2009-12-03 14:03 . 2008-04-14 03:41 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll

2009-12-03 14:03 . 2008-04-14 03:41 21504 ----a-w- c:\windows\system32\hidserv.dll

2009-12-03 14:03 . 2008-04-13 22:15 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys

2009-12-03 14:03 . 2008-04-13 22:15 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys

2009-12-03 14:02 . 2008-04-13 22:15 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys

2009-12-03 14:02 . 2008-04-13 22:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys

2009-12-03 14:02 . 2008-04-13 22:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys

2009-12-03 14:02 . 2008-04-13 22:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2009-11-23 08:47 . 2009-11-23 08:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\GRETECH

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-19 17:54 . 2009-08-17 18:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent

2009-12-19 17:54 . 2009-12-15 22:32 316 ---h--w- c:\program files\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo

2009-12-16 07:53 . 2009-09-03 16:31 21496 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-12-16 07:52 . 2009-08-17 17:48 86627 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-12-15 12:38 . 2003-03-18 19:14 499712 ----a-w- c:\windows\system32\msvcp71.dll

2009-12-15 12:38 . 2003-02-21 03:42 348160 ----a-w- c:\windows\system32\msvcr71.dll

2009-12-14 22:07 . 2009-08-17 18:13 -------- d-----w- c:\documents and settings\Administrator\Application Data\AIMP

2009-12-14 19:28 . 2009-12-14 19:23 -------- d-----w- c:\documents and settings\Administrator\Application Data\BSplayer

2009-12-14 19:23 . 2009-12-14 19:23 -------- d-----w- c:\documents and settings\Administrator\Application Data\BSplayer Pro

.

((((((((((((((((((((((((((((( SnapShot@2009-12-19_17.17.18 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\ziyvfykgxixhknsj.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\ziyvfykgxixhknsj.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\tiehxwoqnezpyhspgzxhrg.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\tiehxwoqnezpyhspgzxhrg.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\ziyvfykgxixhknsj.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\ziyvfykgxixhknsj.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\tiehxwoqnezpyhspgzxhrg.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\tiehxwoqnezpyhspgzxhrg.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\pasrdymkdqhtydkdqf.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\pasrdymkdqhtydkdqf.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\nauvjgwwrgznubkfulhp.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\nauvjgwwrgznubkfulhp.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\gqhfqkxumyozdhnfr.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\gqhfqkxumyozdhnfr.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\cqlncarsoeynvdnjzroxg.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\cqlncarsoeynvdnjzroxg.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 512000 c:\windows\system32\amffsodcwkcpvbjdrhc.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 512000 c:\windows\system32\amffsodcwkcpvbjdrhc.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\pasrdymkdqhtydkdqf.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\pasrdymkdqhtydkdqf.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\nauvjgwwrgznubkfulhp.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\nauvjgwwrgznubkfulhp.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\gqhfqkxumyozdhnfr.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\gqhfqkxumyozdhnfr.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\cqlncarsoeynvdnjzroxg.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\cqlncarsoeynvdnjzroxg.exe

+ 2009-12-15 22:32 . 2009-12-19 17:55 569344 c:\windows\amffsodcwkcpvbjdrhc.exe

- 2009-12-15 22:32 . 2009-12-19 17:15 569344 c:\windows\amffsodcwkcpvbjdrhc.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

2008-08-06 13:20 279944 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-06 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AROReminder"="c:\program files\Advanced Registry Optimizer\aro.exe" [2009-10-22 2132480]

"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]

"nwiz"="nwiz.exe" [2007-10-04 1626112]

"RTHDCPL"="RTHDCPL.EXE" [2008-12-09 18063872]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]

"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-07 488984]

"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-07 774168]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-12-15 198160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-11-27 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2009-12-14 95232]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableInstallerDetection"= 0 (0x0)

"EnableSecureUIAPaths"= 0 (0x0)

"EnableVirtualization"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM106.sys [12/3/2009 4:06 PM 1506304]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://search.babylon.com/home

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ofbeko8g.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/firefox

FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13153&gct=&gc=1&q=

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-12-19 20:25

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2009-12-19 20:26:17

ComboFix-quarantined-files.txt 2009-12-19 18:26

ComboFix2.txt 2009-12-19 17:59

ComboFix3.txt 2009-12-19 17:18

Pre-Run: 37,560,168,448 bytes free

Post-Run: 37,543,849,984 bytes free

- - End Of File - - 3BF6034013B70C4FD2E4961AF42936ED

19 декември 200916 г.

Стъпка 1:

Отворете Notepad и чрез комбинацията copy/paste поставете следния текст:

http://www.kaldata.com/forums/index.php?showtopic=144953


Killall::


Collect::

C:\WINDOWS\ziyvfykgxixhknsj.exe

C:\WINDOWS\tiehxwoqnezpyhspgzxhrg.exe

C:\WINDOWS\pasrdymkdqhtydkdqf.exe

C:\WINDOWS\nauvjgwwrgznubkfulhp.exe

C:\WINDOWS\gqhfqkxumyozdhnfr.exe

C:\WINDOWS\cqlncarsoeynvdnjzroxg.exe

C:\WINDOWS\amffsodcwkcpvbjdrhc.exe

C:\WINDOWS\System32\ziyvfykgxixhknsj.exe

C:\WINDOWS\System32\tiehxwoqnezpyhspgzxhrg.exe

C:\WINDOWS\System32\pasrdymkdqhtydkdqf.exe

C:\WINDOWS\System32\nauvjgwwrgznubkfulhp.exe

C:\WINDOWS\System32\gqhfqkxumyozdhnfr.exe

C:\WINDOWS\System32\cqlncarsoeynvdnjzroxg.exe

C:\WINDOWS\System32\amffsodcwkcpvbjdrhc.exe

C:\WINDOWS\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep

C:\WINDOWS\System32\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep

C:\Program Files\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep

C:\Documents and Settings\Administrator\Local Settings\Application Data\dwwdxawcdyxrerghczbpdw.dxa

C:\WINDOWS\System32\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo

C:\WINDOWS\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo

C:\Program Files\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo

C:\WINDOWS\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz

C:\WINDOWS\System32\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz

C:\Documents and Settings\Administrator\Local Settings\Application Data\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz

C:\WINDOWS\System32\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd

C:\WINDOWS\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd

C:\WINDOWS\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep

C:\WINDOWS\System32\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep

C:\Program Files\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep

C:\Documents and Settings\Administrator\Local Settings\Application Data\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep

C:\WINDOWS\System32\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd

C:\WINDOWS\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd

C:\Documents and Settings\Administrator\Local Settings\Application Data\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd

C:\WINDOWS\System32\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo

C:\WINDOWS\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo

C:\Documents and Settings\Administrator\Local Settings\Application Data\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo

C:\WINDOWS\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz

C:\WINDOWS\System32\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz

C:\Documents and Settings\Administrator\Local Settings\Application Data\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz

C:\WINDOWS\System32\dwwdxawcdyxrerghczbpdw.dxa

C:\WINDOWS\dwwdxawcdyxrerghczbpdw.dxa

C:\Program Files\dwwdxawcdyxrerghczbpdw.dxa

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След като, програмата приключи ще Ви изведе лог файла. Отново чрез комбинацията от Copy/Paste поставете информацията тук.

19 декември 200916 г.

Автор

ComboFix 09-12-18.03 - Administrator 12/19/2009 20:58:54.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.1917.1430 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Desktop\KittyFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

file zipped: c:\documents and settings\Administrator\Local Settings\Application Data\dwwdxawcdyxrerghczbpdw.dxa
file zipped: c:\documents and settings\Administrator\Local Settings\Application Data\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo
file zipped: c:\documents and settings\Administrator\Local Settings\Application Data\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd
file zipped: c:\documents and settings\Administrator\Local Settings\Application Data\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz
file zipped: c:\documents and settings\Administrator\Local Settings\Application Data\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep
file zipped: c:\program files\dwwdxawcdyxrerghczbpdw.dxa
file zipped: c:\program files\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo
file zipped: c:\program files\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep
file zipped: c:\windows\amffsodcwkcpvbjdrhc.exe
file zipped: c:\windows\cqlncarsoeynvdnjzroxg.exe
file zipped: c:\windows\dwwdxawcdyxrerghczbpdw.dxa
file zipped: c:\windows\gqhfqkxumyozdhnfr.exe
file zipped: c:\windows\nauvjgwwrgznubkfulhp.exe
file zipped: c:\windows\pasrdymkdqhtydkdqf.exe
file zipped: c:\windows\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo
file zipped: c:\windows\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd
file zipped: c:\windows\System32\amffsodcwkcpvbjdrhc.exe
file zipped: c:\windows\System32\cqlncarsoeynvdnjzroxg.exe
file zipped: c:\windows\System32\dwwdxawcdyxrerghczbpdw.dxa
file zipped: c:\windows\System32\gqhfqkxumyozdhnfr.exe
file zipped: c:\windows\System32\nauvjgwwrgznubkfulhp.exe
file zipped: c:\windows\System32\pasrdymkdqhtydkdqf.exe
file zipped: c:\windows\System32\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo
file zipped: c:\windows\System32\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd
file zipped: c:\windows\System32\tiehxwoqnezpyhspgzxhrg.exe
file zipped: c:\windows\System32\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz
file zipped: c:\windows\System32\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep
file zipped: c:\windows\System32\ziyvfykgxixhknsj.exe
file zipped: c:\windows\tiehxwoqnezpyhspgzxhrg.exe
file zipped: c:\windows\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz
file zipped: c:\windows\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep
file zipped: c:\windows\ziyvfykgxixhknsj.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Local Settings\Application Data\dwwdxawcdyxrerghczbpdw.dxa
c:\documents and settings\Administrator\Local Settings\Application Data\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo
c:\documents and settings\Administrator\Local Settings\Application Data\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd
c:\documents and settings\Administrator\Local Settings\Application Data\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz
c:\documents and settings\Administrator\Local Settings\Application Data\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep
c:\program files\dwwdxawcdyxrerghczbpdw.dxa
c:\program files\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo
c:\program files\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep
c:\windows\amffsodcwkcpvbjdrhc.exe
c:\windows\cqlncarsoeynvdnjzroxg.exe
c:\windows\dwwdxawcdyxrerghczbpdw.dxa
c:\windows\gqhfqkxumyozdhnfr.exe
c:\windows\nauvjgwwrgznubkfulhp.exe
c:\windows\pasrdymkdqhtydkdqf.exe
c:\windows\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo
c:\windows\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd
c:\windows\System32\amffsodcwkcpvbjdrhc.exe
c:\windows\System32\cqlncarsoeynvdnjzroxg.exe
c:\windows\System32\dwwdxawcdyxrerghczbpdw.dxa
c:\windows\System32\gqhfqkxumyozdhnfr.exe
c:\windows\System32\nauvjgwwrgznubkfulhp.exe
c:\windows\System32\pasrdymkdqhtydkdqf.exe
c:\windows\System32\qwjdkajcqykrrrthpzopqwjdkajcqykrrrt.pzo
c:\windows\System32\rymhpgqkzivdefixgrhjlsgbjaketcpxyzcr.lbd
c:\windows\System32\tiehxwoqnezpyhspgzxhrg.exe
c:\windows\System32\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz
c:\windows\System32\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep
c:\windows\System32\ziyvfykgxixhknsj.exe
c:\windows\tiehxwoqnezpyhspgzxhrg.exe
c:\windows\uyjbgubsekuzxvvhnvihgkvnsgneqwglj.htz
c:\windows\zcmdhuaqbgptqnmxcjvtruevzmsityhl.fep
c:\windows\ziyvfykgxixhknsj.exe

.
((((((((((((((((((((((((( Files Created from 2009-11-19 to 2009-12-19 )))))))))))))))))))))))))))))))
.

2009-12-19 17:13 . 2009-12-19 17:18 -------- d-----w- C:\KittyFix
2009-12-19 11:51 . 2009-12-19 11:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\TeamViewer
2009-12-19 11:51 . 2009-12-19 11:51 -------- d-----w- c:\program files\TeamViewer
2009-12-19 11:50 . 2009-12-19 11:50 -------- d-----w- c:\documents and settings\Administrator\temp
2009-12-18 15:43 . 2009-12-18 15:43 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\ESET
2009-12-17 10:16 . 2009-12-17 10:16 -------- d-----w- C:\$AVG
2009-12-17 10:16 . 2009-12-17 10:16 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-12-17 10:16 . 2009-12-17 10:25 -------- d-----w- c:\windows\SxsCaPendDel
2009-12-16 17:35 . 2009-12-19 17:03 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-12-16 17:35 . 2009-12-19 15:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-16 14:50 . 2009-12-16 14:52 -------- d-----w- c:\windows\system32\NtmsData
2009-12-16 14:07 . 2009-12-16 14:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\ESET
2009-12-16 11:24 . 2009-12-16 11:24 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles
2009-12-16 11:22 . 2009-12-16 11:22 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-12-16 10:43 . 2009-12-16 10:43 -------- d-s---w- c:\documents and settings\Administrator\UserData
2009-12-16 07:48 . 2009-12-16 07:48 -------- d-----w- c:\program files\Skype
2009-12-16 07:20 . 2009-12-16 07:20 -------- d-----w- c:\program files\Common Files\Skype
2009-12-15 12:38 . 2009-12-15 12:38 -------- d-----w- c:\program files\Common Files\xing shared
2009-12-15 12:38 . 2009-12-15 12:38 -------- d-----w- c:\program files\Real
2009-12-15 05:58 . 2009-12-15 12:38 -------- d-----w- c:\program files\Common Files\Real
2009-12-14 22:53 . 2009-12-14 22:53 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\mat.soft
2009-12-14 20:20 . 2007-03-22 10:46 126976 ----a-w- c:\documents and settings\Administrator\Application Data\GRETECH\GomPlayer\GrLauncher.exe
2009-12-14 20:19 . 2009-12-14 22:15 -------- d-----w- c:\program files\The KMPlayer
2009-12-14 19:49 . 2009-12-14 19:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nero
2009-12-14 19:13 . 2009-12-14 19:13 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-12-14 19:13 . 2009-12-19 17:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM
2009-12-14 19:03 . 2009-12-14 19:03 10134 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe
2009-12-14 19:03 . 2009-12-14 19:03 10134 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe
2009-12-14 19:03 . 2009-12-14 19:03 10134 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe
2009-12-14 19:03 . 2007-02-03 08:32 41504 ----a-w- c:\windows\system32\drivers\LVUSBSta.sys
2009-12-14 19:03 . 2007-02-03 08:32 527136 ----a-w- c:\windows\system32\LVUI2RC.dll
2009-12-14 19:03 . 2007-02-03 08:32 215840 ----a-w- c:\windows\system32\LVUI2.dll
2009-12-14 19:03 . 2007-02-03 08:29 129824 ----a-w- c:\windows\system32\lvci1051.dll
2009-12-14 19:03 . 2007-02-03 08:29 264992 ----a-w- c:\windows\system32\lvcodec2.dll
2009-12-14 19:03 . 2007-02-03 08:26 154400 ----a-w- c:\windows\system\CamExL20.dll
2009-12-14 19:03 . 2007-02-03 08:25 1075360 ----a-w- c:\windows\system32\drivers\Camdrl.sys
2009-12-14 19:03 . 2007-02-03 07:01 13398 ----a-w- c:\windows\system32\Repository.reg
2009-12-14 19:03 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system\msvcr71.dll
2009-12-14 19:02 . 2009-12-14 19:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Logishrd
2009-12-14 19:02 . 2009-12-14 19:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Logitech
2009-12-14 19:02 . 2009-12-14 19:06 -------- d-----w- c:\program files\Common Files\LogiShrd
2009-12-14 19:01 . 2009-12-14 19:02 -------- d-----w- c:\program files\Logitech
2009-12-14 16:51 . 2009-12-14 19:22 -------- d-----w- c:\program files\Webteh
2009-12-14 16:27 . 1999-11-11 11:47 6416 ----a-w- c:\windows\system32\kbdinori.Dll
2009-12-14 16:27 . 2000-11-17 06:47 8992 ----a-w- c:\windows\system32\kbdbphz.dLL
2009-12-14 16:27 . 2000-11-14 23:52 6416 ----a-w- c:\windows\system32\kbdbds.Dll
2009-12-14 16:27 . 1999-12-07 07:00 6416 ----a-w- c:\windows\system32\kbdbp.Dll
2009-12-14 16:27 . 1999-11-18 03:04 7440 ----a-w- c:\windows\system32\Kbddll.dll
2009-12-14 16:27 . 1999-11-11 11:47 6416 ----a-w- c:\windows\system32\kbdinasa.Dll
2009-12-14 16:27 . 1999-11-11 11:47 6928 ----a-w- c:\windows\system32\kbdhebx.Dll
2009-12-14 16:27 . 1997-04-03 19:00 8992 ----a-w- c:\windows\system32\KBDBPH.dLL
2009-12-14 16:27 . 2002-04-22 22:17 45056 ----a-w- c:\windows\system32\newdll.dll
2009-12-14 16:27 . 2009-12-14 16:27 -------- d-----w- c:\program files\Datecs
2009-12-14 16:17 . 2009-12-14 16:17 -------- d-----w- c:\program files\KoralSoft
2009-12-14 16:01 . 2009-12-19 18:57 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype
2009-12-14 16:00 . 2009-12-16 07:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\Sammsoft
2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\program files\AskSearch
2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\program files\AskBarDis
2009-12-14 15:47 . 2009-12-14 15:47 -------- d-----w- c:\program files\Advanced Registry Optimizer
2009-12-14 15:39 . 2009-12-14 15:39 -------- d-----w- c:\windows\ShellNew
2009-12-14 15:39 . 2009-12-14 15:39 -------- d-----w- c:\program files\Common Files\L&H
2009-12-14 15:03 . 2001-08-17 11:48 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2009-12-14 15:03 . 2001-08-17 11:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-12-14 10:43 . 2009-12-14 10:50 -------- d-----w- c:\windows\NV116308.TMP
2009-12-14 10:42 . 2007-05-27 12:57 1732 ----a-r- c:\windows\system32\drivers\nvphy.bin
2009-12-14 10:42 . 2007-09-15 01:19 356352 ----a-w- c:\windows\system32\nvunrm.exe
2009-12-14 10:41 . 2007-07-05 07:01 356352 ----a-r- c:\windows\system32\nvusmb.exe
2009-12-14 10:32 . 2004-08-11 00:00 5810 ----a-r- c:\windows\system32\drivers\ASACPI.sys
2009-12-03 14:06 . 2008-09-11 11:21 282624 ----a-r- c:\windows\system32\CM106rm.exe
2009-12-03 14:06 . 2008-05-20 17:18 221184 ----a-r- c:\windows\system\cm106eye.exe
2009-12-03 14:06 . 2006-09-13 12:08 491520 ----a-r- c:\windows\system\cmau106.dll
2009-12-03 14:06 . 2008-10-13 19:21 1506304 ----a-r- c:\windows\system32\drivers\CM106.sys
2009-12-03 14:06 . 2004-04-14 10:28 315392 ----a-r- c:\windows\system\fltr106.dll
2009-12-03 14:05 . 2008-07-24 10:55 278528 ------r- c:\windows\Cmi106Uninstall.exe
2009-12-03 14:05 . 2009-12-03 14:05 -------- d-----w- c:\program files\USB Multi-Channel Audio Device
2009-12-03 14:03 . 2008-04-14 03:41 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2009-12-03 14:03 . 2008-04-14 03:41 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-12-03 14:03 . 2008-04-13 22:15 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2009-12-03 14:03 . 2008-04-13 22:15 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-12-03 14:02 . 2008-04-13 22:15 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys
2009-12-03 14:02 . 2008-04-13 22:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2009-12-03 14:02 . 2008-04-13 22:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-12-03 14:02 . 2008-04-13 22:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-11-23 08:47 . 2009-11-23 08:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\GRETECH

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-19 17:54 . 2009-08-17 18:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2009-12-16 07:53 . 2009-09-03 16:31 21496 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-16 07:52 . 2009-08-17 17:48 86627 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-15 12:38 . 2003-03-18 19:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-12-15 12:38 . 2003-02-21 03:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-12-14 22:07 . 2009-08-17 18:13 -------- d-----w- c:\documents and settings\Administrator\Application Data\AIMP
2009-12-14 19:28 . 2009-12-14 19:23 -------- d-----w- c:\documents and settings\Administrator\Application Data\BSplayer
2009-12-14 19:23 . 2009-12-14 19:23 -------- d-----w- c:\documents and settings\Administrator\Application Data\BSplayer Pro
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-08-06 13:20 279944 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-06 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AROReminder"="c:\program files\Advanced Registry Optimizer\aro.exe" [2009-10-22 2132480]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"nwiz"="nwiz.exe" [2007-10-04 1626112]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-09 18063872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-07 488984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-07 774168]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-12-15 198160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-11-27 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2009-12-14 95232]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 0 (0x0)
"EnableInstallerDetection"= 0 (0x0)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableVirtualization"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM106.sys [12/3/2009 4:06 PM 1506304]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.babylon.com/home
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ofbeko8g.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/firefox
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13153&gct=&gc=1&q=
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-19 21:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(6852)
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\windows\system32\newdll.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Skype\Phone\Skype.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\LogiShrd\LComMgr\LVComSX.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-12-19 21:02:52 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-19 19:02
ComboFix2.txt 2009-12-19 18:26
ComboFix3.txt 2009-12-19 17:59
ComboFix4.txt 2009-12-19 17:18

Pre-Run: 37,553,307,648 bytes free
Post-Run: 37,504,172,032 bytes free

- - End Of File - - 5E85507E607B81EFEDE53226117A6863

19 декември 200916 г.

Стъпка 1:

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

Remove found threats
Scan archives
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth technology

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост тук.

Стъпка 2:

Отворете C:\KittyFix\KittyFix\Add or Remove Programs.txt и публикувайте съдържанието му в следващия Ви пост.

19 декември 200916 г.

Автор

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=ca53de6535b5ef4dae4ce0ba6dd94328

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2009-12-19 07:35:35

# local_time=2009-12-19 09:35:35 (+0200, FLE Standard Time)

# country="Bulgaria"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=1024 16777215 100 0 0 0 0 0

# compatibility_mode=8192 67108863 100 0 3710 3710 0 0

# scanned=20456

# found=15

# cleaned=15

# scan_time=735

C:\Qoobox\Quarantine\[4]-Submit_2009-12-19_20.58.32.zip a variant of Win32/AutoRun.Agent.TV worm (deleted - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\C\girhkwbqa.bat.vir a variant of Win32/AutoRun.Agent.TV worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\C\qwjdkajcqykrr.bat.vir a variant of Win32/AutoRun.Agent.TV worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\C\uyjbgubseku.bat.vir a variant of Win32/AutoRun.Agent.TV worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\E\av1.zip a variant of Win32/AutoRun.Agent.TV worm (deleted - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\E\girhkwbqa.bat.vir a variant of Win32/AutoRun.Agent.TV worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\E\qwjdkajcqykrr.bat.vir a variant of Win32/AutoRun.Agent.TV worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\E\uyjbgubseku.bat.vir a variant of Win32/AutoRun.Agent.TV worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{A49B60FA-E1DF-46B6-AEA2-E0D84F04EED0}\RP14\A0002852.exe a variant of Win32/AutoRun.Agent.TV worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{A49B60FA-E1DF-46B6-AEA2-E0D84F04EED0}\RP14\A0002853.exe a variant of Win32/AutoRun.Agent.TV worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{A49B60FA-E1DF-46B6-AEA2-E0D84F04EED0}\RP14\A0002854.exe a variant of Win32/AutoRun.Agent.TV worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{A49B60FA-E1DF-46B6-AEA2-E0D84F04EED0}\RP14\A0002855.exe a variant of Win32/AutoRun.Agent.TV worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{A49B60FA-E1DF-46B6-AEA2-E0D84F04EED0}\RP14\A0002856.exe a variant of Win32/AutoRun.Agent.TV worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{A49B60FA-E1DF-46B6-AEA2-E0D84F04EED0}\RP14\A0002857.exe a variant of Win32/AutoRun.Agent.TV worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{A49B60FA-E1DF-46B6-AEA2-E0D84F04EED0}\RP14\A0002858.exe a variant of Win32/AutoRun.Agent.TV worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Другото го няма

19 декември 200916 г.

Изтеглете Security Check от screen317 от тук или тук и го запаметете на вашия десктоп.

Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия Ви коментар в тази тема.

19 декември 200916 г.

Автор

Results of screen317's Security Check version 0.99.1
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
ESET Online Scanner v3
WMIC entry does not exist for antivirus; attempting automatic update.
``````````````````````````````
Anti-malware/Other Utilities Check:
Adobe Flash Player 10
``````````````````````````````
Process Check:
objlist.exe by Laurent
``````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

`````````End of Log```````````

Редактирано 19 декември 200916 г. от daniel1995 (преглед на промените)

19 декември 200916 г.

Моля, отидете на Start --> Settings --> Control Panel --> Add or Remove Programs, и деинсталирайте следните програми (Ако присъстват в списъка):

Ask Toolbar

Как е положението сега?

19 декември 200916 г.

Автор

Освен това със забраната за инсталиране на антивирусен софтуер (моля препоръчай каква антивирусна да инсталирам)

А иначе не е имала големи проблеми с вируса.

19 декември 200916 г.

Аз ти препоръчвам NOD32 или Norton от платените варианти, а от безплатните MSE или Avira AntiVir.

19 декември 200916 г.

Автор

А иначе с другото приключихме ли?

19 декември 200916 г.

Да, само е необходимо да се деинсталира ComboFix. За целта, отвори Start -> Run... и напиши:

KittyFix.exe /uninstall

19 декември 200916 г.

Автор

А иначе кои логове и разни такива да трия ?

19 декември 200916 г.

Опитай с:

KittyFix /uninstall[/code или [code]KittyFix /u

19 декември 200916 г.

Автор

Нестава

19 декември 200916 г.

Изтрий го ръчно тогава и останалите програми, които използвахме.

19 декември 200916 г.

Автор

Добре. Мерси. А другото което е каза ми че има и вирус на флашката. Може ли да я сканираме :cool:

19 декември 200916 г.

Той беше изчистен още с първото стартиране на KittyFix.

19 декември 200916 г.

Автор

Ма тя не беше вкарана в компютъра тогава. :cool:

Добре дошли!

Още едно "чудо"

Featured Replies

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)