Facebook вирусът --> Enhаnced Protection Mode на антивирусната

26 юли 201115 г.

Здравейте,

преди известно време(1 седмица може би) и аз се натъкнах на вируса от фейсбук (Hi. How are you? .... , после ти праща уж весел клип) Уви , вързах се, отворих клипа(за целта дръпнах някакъв препоръчителен Flash Player) и вирусът започна да препраща същите съобщение и клип от моя профил многократно на много от приятелите ми. Смених си паролата и не знам това ли му повлия, но спря да изпраща споменатите неща от мое име. На следващия ден и профилът на сестра ми във ФБ се зарази със същото нещо, но промяната на паролата първоначално не промени нищо, от профила и продължиха да се препращат съобщението и клипа на приятелите и. След още един ден вече не можехме да влизаме в ФБ, излизаше ни съобщение, че ФБ има проблем и се опитва да го оправи (в същото време обаче от лаптопа на баща ни влизахме във ФБ). И така до вчера това беше картината.От вчера вече не ни излиза съобщението,че ФБ има проблем,сестра ми казва,че като си влезе в профила вече и при нея не се препращат от само себе си съобщението и клипа (явно по някакъв начин от само себе си се е оправил ФБ-профила и, или може би това е временно и може пак да се появи? ). Сега проблемът е друг. От вчера излезе на антивирусната (долу вдясно до часовника) познатият червен прозорец Enhanced Protection Mode.Помислих, че е от самата антивирусна (Avira) ,тъй като преди около седмица и изтече лицензът, с който я дръпнах от нета. Странно, в Control Panel, добавяне/премахвяне на програми нямаше Avira-файл, но рекох си , Avira се е деинсталнала сама, понеже е изтекъл лицензът. Дръпнах си Avast. Но след инсталацията и ристартиранито на компа, при което Аваст го сканира, се появи отново червеният прозорец с Enhanced Protection Mode. Към момента обаче Аваст все още не се е деинсталирала от само себе си, или по точно - виждам я все още в Contol Panel.

Знаех вече , че имам проблем, влязох в интернет и попаднах на вашия форум. Прочетох доста теми,в които се описваше същият или отчасти същият проблем като при мен. Прочетох още, че при всеки се действа отделно, и затова публикувам нова тема.

Компютърът ми е Windows XP,версия 2002,Service Pack 3 пише също.

А да, още нещо, и при мен се появи в Диспечера на задачите ufa.exe ,койта също товари много процесора. Не знам грешка ли е , но доста пъти му давах край на процеса, за да мога въобще да влизам в нета и да правя нещо на компа.

Мисля , че това е всичко, извинявайте, ако съм Ви отегчил с дългия разказ, но не знам кое може да се окаже важно,затова описах всичко, както го видях.

Предварително благодаря,че отделяте време и за мен!

DDS файла приключи работата си. Ето двата отчета, които се появиха:

.

DDS (Ver_2011-06-23.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_24

Run by Vlado Kurtev at 11:05:53 on 2011-07-26

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.767.473 [GMT 3:00]

.

AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}

AV: avast! antivirus 4.8.1368 [VPS 091127-1] *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Documents and Settings\Vlado Kurtev\Application Data\dwm.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Documents and Settings\Vlado Kurtev\Application Data\Microsoft\conhost.exe

C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe

C:\DOCUME~1\VLADOK~1\LOCALS~1\Temp\csrss.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\system32\rundll32.exe

"C:\WINDOWS\update.tray-7-0\svchost.exe"

C:\Program Files\IObit\Advanced SystemCare 4\PMonitor.exe

C:\WINDOWS\l1rezerv.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe

C:\WINDOWS\system32\drivers\CDAC11BA.EXE

C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\update.2\svchost.exe srv

C:\WINDOWS\sysdriver32.exe

svchost.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\WINDOWS\system32\UAService7.exe

C:\WINDOWS\update.1\svchost.exe srv

C:\Program Files\Canon\CAL\CALMAIN.exe

"C:\WINDOWS\update.2\svchost.exe" stand

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\WINDOWS\update.5.0\svchost.exe srv

"C:\WINDOWS\update.5.0\svchost.exe" stand

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://search.babylon.com/home?AF=18776

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyServer = http=127.0.0.1:54667

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

mSearchAssistant = hxxp://www.google.com/ie

uURLSearchHooks: IsoBuster Toolbar: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - c:\program files\isobuster\prxtbIso0.dll

uWinlogon: Shell=explorer.exe,c:\documents and settings\vlado kurtev\application data\dwm.exe

uWindows: Load=c:\docume~1\vladok~1\locals~1\temp\csrss.exe

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: IsoBuster Toolbar: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - c:\program files\isobuster\prxtbIso0.dll

BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: IsoBuster Toolbar: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - c:\program files\isobuster\prxtbIso0.dll

TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Advanced SystemCare 4] c:\program files\iobit\advanced systemcare 4\ASCTray.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

mRun: [soundMan] SOUNDMAN.EXE

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [wxpdrv] c:\windows\services32.exe

mRun: [tray_ico0] c:\windows\update.tray-7-0\svchost.exe

mRun: [sysdriver32.exe] "c:\windows\sysdriver32.exe" rezerv

mRun: [sysdriver32_.exe] "c:\windows\sysdriver32_.exe" rezerv

mRun: [l1rezerv.exe] "c:\windows\l1rezerv.exe"

mRun: [conhost] c:\documents and settings\vlado kurtev\application data\microsoft\conhost.exe

mRun: [84932378-loader2.exe] "c:\docume~1\vladok~1\locals~1\temp\84932378-loader2.exe"

mRun: [avast!] "c:\program files\alwil software\avast4\ashDisp.exe"

mRun: [tray_ico]

mRun: [tray_ico1]

mRun: [tray_ico2]

mRun: [tray_ico3]

mRun: [tray_ico4]

mRun: [7952985.exe] "c:\windows\temp\7952985.exe"

mRun: [1005973.exe] "c:\windows\temp\1005973.exe"

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\documents and settings\vlado kurtev\start menu\programs\startup\PowerReg Scheduler.exe

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableSecureUIAPaths = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

TCP: DhcpNameServer = 93.155.247.2 192.168.0.1

TCP: Interfaces\{DC13E36A-826C-45EE-9466-28CAB974A7DA} : DhcpNameServer = 93.155.247.2 192.168.0.1

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\vlado kurtev\application data\mozilla\firefox\profiles\rvbk65cl.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1700389&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/

FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=toolbar2&q=

FF - prefs.js: network.proxy.http - 127.0.0.1

FF - prefs.js: network.proxy.http_port - 54667

FF - prefs.js: network.proxy.type - 1

FF - component: c:\documents and settings\vlado kurtev\application

data\mozilla\firefox\profiles\rvbk65cl.default\extensions\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}\components\FFAlert.dll

FF - component: c:\documents and settings\vlado kurtev\application data\mozilla\firefox\profiles\rvbk65cl.default\extensions\[email protected]\components\FFHst.dll

FF - plugin: c:\documents and settings\vlado kurtev\application data\facebook\npfbplugin_1_0_3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - Ext: Babylon OCR: [email protected] - c:\program files\mozilla firefox\extensions\[email protected]

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

FF - Ext: United States English Spellchecker: [email protected] - %profile%\extensions\[email protected]

FF - Ext: Babylon: [email protected] - %profile%\extensions\[email protected]

FF - Ext: myBabylon Toolbar: {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - %profile%\extensions\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}

FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - Ext: Java Quick Starter: [email protected] - c:\program files\java\jre6\lib\deploy\jqs\ff

FF - Ext: Freemake Video Downloader: [email protected] - c:\program files\freemake\freemake video downloader\browserplugin\Firefox

.

---- FIREFOX POLICIES ----

FF - user.js: network.http.max-connections-per-server - 4

FF - user.js: content.max.tokenizing.time - 1500000

FF - user.js: nglayout.initialpaint.delay - 100

.

============= SERVICES / DRIVERS ===============

.

R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\iobit\advanced systemcare 4\ASCService.exe [2011-7-21 353168]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-5-26 56816]

R2 srvbtcclient;srvbtcclient;c:\windows\update.5.0\svchost.exe srv --> c:\windows\update.5.0\svchost.exe srv [?]

R2 srviecheck;srviecheck;c:\windows\update.2\svchost.exe srv --> c:\windows\update.2\svchost.exe srv [?]

R2 srvsysdriver32;srvsysdriver32;c:\windows\sysdriver32.exe srv --> c:\windows\sysdriver32.exe srv [?]

R2 wxpdrivers;wxpdrivers;c:\windows\update.1\svchost.exe srv --> c:\windows\update.1\svchost.exe srv [?]

S1 avgio;avgio;\??\c:\program files\avira\antivir desktop\avgio.sys --> c:\program files\avira\antivir desktop\avgio.sys [?]

S2 0234281243324666mcinstcleanup;McAfee Application Installer Cleanup (0234281243324666);c:\docume~1\vladok~1\locals~1\temp\0234281243324666mcinst.exe

c:\progra~1\common~1\mcafee\installer\cleanup.ini -cleanup -nolog -service --> c:\docume~1\vladok~1\locals~1\temp\0234281243324666mcinst.exe

c:\progra~1\common~1\mcafee\installer\cleanup.ini -cleanup -nolog -service [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\drivers\DLPORTIO.SYS [2000-6-29 3584]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\g:\test\everest 4.00 build 975 ultimate+crack\kerneld.wnt --> g:\test\everest 4.00 build 975 ultimate+crack\kerneld.wnt [?]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18

753504]

S3 ZSMC0305;A4 TECH PC Camera V;c:\windows\system32\drivers\usbVM305.sys [2008-7-3 391688]

S4 AntiVirSchedulerService;Avira AntiVir Scheduler;"c:\program files\avira\antivir desktop\sched.exe" --> c:\program files\avira\antivir desktop\sched.exe [?]

S4 AntiVirService;Avira AntiVir Guard;"c:\program files\avira\antivir desktop\avguard.exe" --> c:\program files\avira\antivir desktop\avguard.exe [?]

S4 Ippieccsmp;Ippieccsmp; [x]

.

=============== File Associations ===============

.

regfile=regedit.exe "%1" %*

.

=============== Created Last 30 ================

.

2011-07-25 13:28:13 -------- d--h--w- c:\windows\system32\GroupPolicy

2011-07-25 13:17:23 -------- d--h--w- c:\windows\update.tray-7-0-lnk

2011-07-25 13:17:23 -------- d--h--w- c:\windows\update.tray-7-0

2011-07-21 12:41:26 -------- d-----w- c:\program files\IObit

2011-07-19 19:37:36 -------- d-----w- c:\windows\rpcminer

2011-07-19 19:37:36 -------- d-----w- c:\windows\phoenix

2011-07-19 19:29:44 246272 ----a-w- c:\windows\unrar.exe

2011-07-19 09:30:20 181248 ----a-w- c:\documents and settings\vlado kurtev\application data\dwm.exe

2011-07-19 09:29:54 169472 ----a-w- c:\documents and settings\vlado kurtev\application data\microsoft\conhost.exe

2011-07-18 18:28:12 -------- d-----w- c:\documents and settings\vlado kurtev\local settings\application data\Media Get LLC

2011-07-18 18:27:54 -------- d-----w- c:\documents and settings\vlado kurtev\local settings\application data\MediaGet2

2011-07-18 15:40:59 -------- d-----w- c:\documents and settings\vlado kurtev\application data\Ldoce

2011-07-18 15:40:44 -------- d-----w- c:\program files\common files\Macrovision Shared

2011-07-18 15:40:43 54784 ----a-w- c:\windows\system32\drivers\CDAC11BA.EXE

2011-07-18 15:40:40 12464 ----a-w- c:\windows\system32\drivers\CdaC15BA.SYS

2011-07-18 12:37:09 -------- d-----w- c:\windows\ufa

2011-07-18 11:37:20 232960 ----a-w- c:\windows\l1rezerv.exe

2011-07-18 10:31:17 -------- d-----w- c:\documents and settings\vlado kurtev\local settings\application data\Solid State Networks

2011-07-18 10:07:40 181760 ----a-w- c:\program files\windows nt\dwm.exe

2011-07-18 10:07:17 169472 ----a-w- c:\program files\internet explorer\conhost.exe

2011-07-18 10:07:17 -------- d-----w- C:\Microsoft

2011-07-18 10:07:07 169472 ----a-w- c:\windows\gbot111.exe

2011-07-18 10:07:00 -------- d--h--w- c:\windows\update.2

2011-07-18 10:06:47 -------- d--h--w- c:\windows\update.5.0

2011-07-18 10:06:41 256000 ----a-w- c:\windows\sysdriver32_.exe

2011-07-18 10:06:25 256000 ----a-w- c:\windows\sysdriver32.exe

2011-07-18 10:06:02 -------- d-----w- c:\windows\av_ico

2011-07-18 10:03:48 -------- d--h--w- c:\windows\update.1

2011-07-18 10:03:38 -------- d--h--w- c:\windows\update.tray-8-0-lnk

2011-07-18 10:03:38 -------- d--h--w- c:\windows\update.tray-8-0

2011-07-17 20:19:54 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-07-17 20:11:05 1170432 ----a-w- c:\windows\services32.exe

.

==================== Find3M ====================

.

2011-06-24 09:35:01 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll

2011-06-04 08:06:43 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2009-04-03 18:57:13 266240 ----a-w- c:\program files\Uninstall Pando Toolbar.dll

2008-05-07 15:42:45 409695 ----a-w- c:\program files\Uninstall Fun Web Products.dll

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: ST3120022A rev.8.01 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntoskrnl.exe >>UNKNOWN [0x82F8AC78]<<

_asm { MOV EAX, 0x82f8ab98; XCHG [ESP], EAX; PUSH EAX; PUSH 0x82fdba74; RET ; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL;

ADD [EAX], AL; ADD [EAX], AL; }

1 nt!IofCallDriver[0x804E37C5] -> \Device\Harddisk0\DR0[0x82F54AB8]

\Driver\Disk[0x82F04A08] -> IRP_MJ_CREATE -> 0x82F8AC78

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP

MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }

detected disk devices:

detected hooks:

\Driver\Disk -> 0x82f8ac78

user & kernel MBR OK

Warning: possible MBR rootkit infection !

.

============= FINISH: 11:06:29.76 ===============

Ето сега и Attach файла :

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-06-23.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 2/13/2008 15:57:52

System Uptime: 7/26/2011 10:00:00 (1 hours ago)

.

Motherboard: Gigabyte Technology Co., Ltd. | | GA-7VT600

Processor: AMD Athlon™ XP 2200+ | Socket A | 1808/133mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 20 GiB total, 4.712 GiB free.

D: is FIXED (NTFS) - 49 GiB total, 15.069 GiB free.

E: is FIXED (NTFS) - 43 GiB total, 1.545 GiB free.

F: is CDROM ()

H: is CDROM (CDFS)

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP360: 7/18/2011 14:38:06 - Контролна точка на системата

RP361: 7/19/2011 15:26:01 - Контролна точка на системата

RP362: 7/21/2011 16:05:14 - Контролна точка на системата

RP363: 7/22/2011 16:28:32 - Контролна точка на системата

RP364: 7/25/2011 18:05:28 - Контролна точка на системата

.

==== Installed Programs ======================

.

1503 A.D.

A4 Tech PC Camera V

Adobe Flash Player 10 ActiveX

Adobe Reader 8.3.0

Advanced SystemCare 4

Ashampoo Burning Studio 2007

Auto Gordian Knot 2.45

avast! Antivirus

AviSynth 2.5

BitLord 1.1

C-Media WDM Audio Driver

Canon Camera Access Library

Canon Camera Support Core Library

Canon Camera Window DC_DV 5 for ZoomBrowser EX

Canon Camera Window DC_DV 6 for ZoomBrowser EX

Canon Camera Window MC 6 for ZoomBrowser EX

Canon G.726 WMP-Decoder

Canon MovieEdit Task for ZoomBrowser EX

Canon RAW Image Task for ZoomBrowser EX

Canon RemoteCapture Task for ZoomBrowser EX

Canon Utilities EOS Utility

Canon Utilities PhotoStitch

Canon Utilities ZoomBrowser EX

Codec pack Base (DivX, Xvid, 3ivx)

Compatibility Pack for the 2007 Office system

Counter-Strike 1.0

Facebook Plug-In

ffdshow (remove only)

FlexType 2K

FormatFactory 2.40

Freemake Video Downloader version 2.0.3

GOM Player

Google Earth

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

HPCarePackProducts

hppMSRedist

hppusgP1000

HPSSupply

Icy Tower v1.3.1

InterVideo DeviceService

IsoBuster Toolbar

IZArc 3.81

Java Auto Updater

Java™ 6 Update 24

Java™ 6 Update 7

K-Lite Codec Pack 3.9.0 Full

Knights Of Honor

KoralSoft - EuroDictXP

L&H TTS3000 British English

LDOCE

MarketResearch

Medal of Honor Allied Assault

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft Office XP Professional with FrontPage

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Mozilla Firefox (3.5.6)

MrvlUsgTracking

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB954430)

MSXML 6 Service Pack 2 (KB954459)

NVIDIA Drivers

OpenOffice.org Installer 1.0

Platform

PonyProg v1.17h

Pro Evolution Soccer 6

Realtek AC'97 Audio

Revo Uninstaller 1.83

SA Dictionary 2005 T2

SafeCast Shared Components

Security Update for Windows Internet Explorer 8 (KB969897)

Security Update for Windows Internet Explorer 8 (KB972260)

Security Update for Windows Media Encoder (KB954156)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player 10 (KB936782)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB938464-v2)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950759)

Security Update for Windows XP (KB950760)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951376)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB953838)

Security Update for Windows XP (KB953839)

Security Update for Windows XP (KB954211)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956390)

Security Update for Windows XP (KB956391)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956841)

Security Update for Windows XP (KB957095)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958215)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960714)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961373)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969898)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB973346)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Skype™ 5.3

SmartSound Quicktracks Plugin

SMS version 3.0.2.8

Software Update for Web Folders

Spelling Dictionaries Support For Adobe Reader 8

SubDownloader2

The KMPlayer (remove only)

TuneUp Utilities 2008

Ulead VideoStudio 11

Update for Windows Internet Explorer 8 (KB968220)

Update for Windows Media Player 10 (KB926251)

Update for Windows XP (KB951072-v2)

Update for Windows XP (KB951978)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB973815)

VIA ї»ї

VideoLAN VLC media player 0.8.6c

VideoStudio

vloader-bg 1.59

VP-EYE

WebFldrs XP

Winamp (remove only)

Windows Bulgarian Interface Pack

Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray

Windows Media Encoder 9 Series

Windows XP Service Pack 3

Xilisoft Video Converter Ultimate

xplorerІ professional

съ»і°рсєё ёЅтµрфµ№с ·° TuneUp Utilities 2008

су ї°єµт ·° Ashampoo Burning Studio 2007

.

==== Event Viewer Messages From Past Week ========

.

7/25/2011 16:17:22, error: DCOM [10005] - DCOM got error "%1084"

attempting to start the service EventSystem with arguments "" in order to run

the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

7/25/2011 16:13:11, error: W32Time [17] - Time Provider NtpClient: An error

occurred during DNS lookup of the manually configured peer

'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15

minutes. The error was: A socket operation was attempted to an unreachable

host. (0x80072751)

7/21/2011 10:52:50, error: Service Control Manager [7026] - The following

boot-start or system-start driver(s) failed to load: avgio

7/21/2011 10:52:48, error: Service Control Manager [7000] - The Avira

AntiVir Scheduler service failed to start due to the following error: The system

cannot find the path specified.

7/21/2011 10:52:48, error: Service Control Manager [7000] - The Avira

AntiVir Guard service failed to start due to the following error: The system

cannot find the path specified.

7/19/2011 22:28:28, error: Service Control Manager [7034] - The srvbtcclient

service terminated unexpectedly. It has done this 1 time(s).

.

==== End Of File ===========================

Това е. Нещо ,което пропуснах , е че съм почти сигурен , че нямам CD с Windows XP.

Редактирано 30 юли 201115 г. от kal (преглед на промените)

26 юли 201115 г.

Изтеглете OTL.exe и го запазете на десктопа.
Стартирайте файла с двукратен клик на мишката.
Сложете отметка пред Scan All Users
Под менюто File Age => изберете 90 days
Под менюто Standard Registry => променете на ALL
Сложете отметки пред LOP и Purity Check

Под с Copy/ Paste въведете следната текстова информация:

netsvcs
msconfig
%SYSTEMDRIVE%\*.*
%USERPROFILE%\*.*
%USERPROFILE%\Application Data\*.*
%USERPROFILE%\Local Settings\Application Data\*.*
%AllUsersProfile%\*.*
%AllUsersProfile%\Application Data\*.*
%USERPROFILE%\My Documents\*.*
%CommonProgramFiles%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
/md5start
hlp.dat
winlogon.exe
wininit.exe
userinit.exe
explorer.exe
volsnap.sys
/md5stop

Натиснете маркираният в синьо бутон: .
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt.
Публикувайте съдържанието на лог файловете в следващия си коментар.

26 юли 201115 г.

Автор

Здравей, благодаря за бързата реакция! Така, OTL също приключи работа. Прикачвам двата файла.

Extras.Txt

OTL.Txt

26 юли 201115 г.

Извинявам се забавянето...не сме ви забравили...просто имаме много случаи и при това не само в този форум...доста българи са засегнати от този вирус. След малко ще пиша като анализирам резултатите. Очите ми станаха на палачинки от взиране в това бялото.

26 юли 201115 г.

Деинсталирайте остатъците от AVIRA и avast! от Control Panel-a

Това приложение да ви е познато за да знам дали да затворя тези портове ?

"45000:UDP" = 45000:UDP:*:Enabled:msisvchost

"45001:UDP" = 45001:UDP:*:Enabled:msisvchost
"45003:UDP" = 45003:UDP:*:Enabled:msisvchost

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.





:Processes
killallprocesses
:OTL
SRV - File not found [Disabled | Stopped] --  -- (AntiVirService)
SRV - File not found [Disabled | Stopped] --  -- (AntiVirSchedulerService)
SRV - File not found [Auto | Stopped] --  -- (0234281243324666mcinstcleanup) McAfee Application Installer Cleanup (0234281243324666)
SRV - [2011/07/26 10:08:20 | 000,348,672 | ---- | M] () [Auto | Running] -- C:\WINDOWS\update.5.0\svchost.exe -- (srvbtcclient)
SRV - [2011/07/25 17:44:05 | 000,256,000 | ---- | M] () [Auto | Running] -- C:\WINDOWS\sysdriver32.exe -- (srvsysdriver32)
SRV - [2011/07/25 17:21:00 | 000,495,616 | ---- | M] () [Auto | Running] -- C:\WINDOWS\update.2\svchost.exe -- (srviecheck)
SRV - [2011/07/17 23:10:50 | 001,170,432 | -H-- | M] () [Auto | Running] -- C:\WINDOWS\update.1\svchost.exe -- (wxpdrivers)
DRV - [2009/12/07 20:36:38 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/11/25 01:48:57 | 000,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2009/06/11 11:28:57 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/05/26 17:07:52 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:61717
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:61717
IE - HKU\S-1-5-21-602162358-813497703-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-602162358-813497703-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:54667
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT1700389&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 54667
FF - prefs.js..network.proxy.type: 1
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
[2009/05/16 20:02:56 | 000,000,681 | ---- | M] () -- C:\Documents and Settings\Vlado Kurtev\Application Data\Mozilla\Firefox\Profiles\rvbk65cl.default\searchplugins\ask.xml
[2011/01/08 23:40:30 | 000,002,394 | ---- | M] () -- C:\Documents and Settings\Vlado Kurtev\Application Data\Mozilla\Firefox\Profiles\rvbk65cl.default\searchplugins\askcom.xml
[2010/09/22 14:47:46 | 000,000,909 | ---- | M] () -- C:\Documents and Settings\Vlado Kurtev\Application Data\Mozilla\Firefox\Profiles\rvbk65cl.default\searchplugins\conduit.xml
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O4 - HKLM..\Run: [1005973.exe] C:\WINDOWS\TEMP\1005973.exe ()
O4 - HKLM..\Run: [7952985.exe] C:\WINDOWS\TEMP\7952985.exe ()
O4 - HKLM..\Run: [84932378-loader2.exe] C:\Documents and Settings\Vlado Kurtev\Local Settings\Temp\84932378-loader2.exe ()
O4 - HKLM..\Run: [conhost] C:\Documents and Settings\Vlado Kurtev\Application Data\Microsoft\conhost.exe ()
O4 - HKLM..\Run: [l1rezerv.exe] C:\WINDOWS\l1rezerv.exe ()
O4 - HKLM..\Run: [sysdriver32.exe] C:\WINDOWS\sysdriver32.exe ()
O4 - HKLM..\Run: [sysdriver32_.exe] C:\WINDOWS\sysdriver32_.exe ()
O4 - HKLM..\Run: [tray_ico]  File not found
O4 - HKLM..\Run: [tray_ico0] C:\WINDOWS\update.tray-7-0\svchost.exe ()
O4 - HKLM..\Run: [tray_ico1]  File not found
O4 - HKLM..\Run: [tray_ico2]  File not found
O4 - HKLM..\Run: [tray_ico3]  File not found
O4 - HKLM..\Run: [tray_ico4]  File not found
O4 - HKLM..\Run: [wxpdrv] C:\WINDOWS\services32.exe ()
F3 - HKU\S-1-5-21-602162358-813497703-839522115-1003 WinNT: Load - (C:\DOCUME~1\VLADOK~1\LOCALS~1\Temp\csrss.exe) - C:\Documents and Settings\Vlado Kurtev\Local Settings\Temp\csrss.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O20 - HKU\.DEFAULT Winlogon: Shell - (C:\Program Files\Windows NT\dwm.exe) - C:\Program Files\Windows NT\dwm.exe ()
O20 - HKU\S-1-5-18 Winlogon: Shell - (C:\Program Files\Windows NT\dwm.exe) - C:\Program Files\Windows NT\dwm.exe ()
O20 - HKU\S-1-5-21-602162358-813497703-839522115-1003 Winlogon: Shell - (C:\Documents and Settings\Vlado Kurtev\Application Data\dwm.exe) - C:\Documents and Settings\Vlado Kurtev\Application Data\dwm.exe ()
O31 - SafeBoot: AlternateShell - services32.exe
O33 - MountPoints2\{aacdb56e-a1c6-11dd-875a-000d612d6c81}\Shell\AutoRun\command - "" = ysep1.exe
O33 - MountPoints2\{aacdb56e-a1c6-11dd-875a-000d612d6c81}\Shell\open\Command - "" = ysep1.exe
O33 - MountPoints2\{c7bff842-da40-11dc-b656-000d612d6c81}\Shell - "" = AutoRun
[2011/07/25 16:17:23 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0-lnk
[2011/07/25 16:17:23 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0
[2011/07/25 15:05:55 | 000,023,120 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/07/25 15:05:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Antivirus
[2011/07/25 15:05:54 | 000,048,560 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/07/25 15:05:54 | 000,027,408 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/07/25 15:05:52 | 000,114,768 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2011/07/25 15:05:52 | 000,097,480 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\AvastSS.scr
[2011/07/25 15:05:52 | 000,094,160 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/07/25 15:05:52 | 000,093,424 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2011/07/25 15:05:52 | 000,020,560 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/07/25 15:05:30 | 001,280,480 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
[2011/07/19 22:37:36 | 000,000,000 | ---D | C] -- C:\WINDOWS\rpcminer
[2011/07/19 22:37:36 | 000,000,000 | ---D | C] -- C:\WINDOWS\phoenix
[2011/07/18 15:37:09 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa
[2011/07/18 13:07:00 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.2
[2011/07/18 13:06:47 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.5.0
[2011/07/18 13:06:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
[2011/07/18 13:03:48 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.1
[2011/07/18 13:03:38 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-8-0-lnk
[2011/07/18 13:03:38 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-8-0
[2011/07/26 11:23:46 | 000,000,179 | ---- | M] () -- C:\WINDOWS\info1
[2011/07/26 10:00:30 | 000,001,694 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Antivirus.lnk
[2011/07/25 17:44:05 | 000,256,000 | ---- | M] () -- C:\WINDOWS\sysdriver32_.exe
[2011/07/25 17:44:05 | 000,256,000 | ---- | M] () -- C:\WINDOWS\sysdriver32.exe
[2011/07/25 17:26:41 | 000,232,960 | ---- | M] () -- C:\WINDOWS\l1rezerv.exe
[2011/07/21 12:39:56 | 000,181,248 | ---- | M] () -- C:\Documents and Settings\Vlado Kurtev\Application Data\dwm.exe
[2011/07/21 10:52:36 | 000,009,659 | ---- | M] () -- C:\Documents and Settings\Vlado Kurtev\Application Data\FDFA.A02
[2011/07/19 22:37:35 | 005,589,370 | ---- | M] () -- C:\WINDOWS\phoenix.rar
[2011/07/19 22:37:35 | 000,246,272 | ---- | M] () -- C:\WINDOWS\unrar.exe
[2011/07/19 22:37:35 | 000,182,617 | ---- | M] () -- C:\WINDOWS\ufa.rar
[2011/07/19 22:37:31 | 001,075,284 | ---- | M] () -- C:\WINDOWS\rpcminer.rar
[2011/07/19 22:29:44 | 000,904,792 | ---- | M] () -- C:\WINDOWS\geoiplist.rar
[2011/07/18 13:07:07 | 000,169,472 | ---- | M] () -- C:\WINDOWS\gbot111.exe
[2011/07/18 13:06:44 | 000,000,000 | ---- | M] () -- C:\WINDOWS\loader2.exe_ok
[2011/07/17 23:10:50 | 001,170,432 | ---- | M] () -- C:\WINDOWS\services32.exe
[2011/07/17 03:24:20 | 004,636,907 | ---- | M] () -- C:\WINDOWS\geoiplist
[2011/07/19 22:37:35 | 000,182,617 | ---- | C] () -- C:\WINDOWS\ufa.rar
[2011/07/19 22:37:34 | 005,589,370 | ---- | C] () -- C:\WINDOWS\phoenix.rar
[2011/07/19 22:37:31 | 001,075,284 | ---- | C] () -- C:\WINDOWS\rpcminer.rar
[2011/07/19 22:29:46 | 004,636,907 | ---- | C] () -- C:\WINDOWS\geoiplist
[2011/07/19 22:29:44 | 000,904,792 | ---- | C] () -- C:\WINDOWS\geoiplist.rar
[2011/07/19 22:29:44 | 000,246,272 | ---- | C] () -- C:\WINDOWS\unrar.exe
[2011/07/19 12:30:20 | 000,181,248 | ---- | C] () -- C:\Documents and Settings\Vlado Kurtev\Application Data\dwm.exe
[2011/07/19 12:29:55 | 000,009,659 | ---- | C] () -- C:\Documents and Settings\Vlado Kurtev\Application Data\FDFA.A02
[2011/07/18 14:37:20 | 000,232,960 | ---- | C] () -- C:\WINDOWS\l1rezerv.exe
[2011/07/18 13:07:07 | 000,169,472 | ---- | C] () -- C:\WINDOWS\gbot111.exe
[2011/07/18 13:06:47 | 000,000,179 | ---- | C] () -- C:\WINDOWS\info1
[2011/07/18 13:06:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\loader2.exe_ok
[2011/07/18 13:06:41 | 000,256,000 | ---- | C] () -- C:\WINDOWS\sysdriver32_.exe
[2011/07/18 13:06:25 | 000,256,000 | ---- | C] () -- C:\WINDOWS\sysdriver32.exe
[2011/07/17 23:11:05 | 001,170,432 | ---- | C] () -- C:\WINDOWS\services32.exe
@Alternate Data Stream - 191 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4BF2F6B5
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6152D44C
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1940DBE8
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:66B13F37
:files
C:\WINDOWS\update.5.0
C:\WINDOWS\sysdriver32.exe
C:\WINDOWS\l1rezerv.exe
C:\WINDOWS\update.2
C:\Documents and Settings\Vlado Kurtev\Local Settings\Temp\csrss.exe
C:\Documents and Settings\Vlado Kurtev\Application Data\dwm.exe
C:\Documents and Settings\Vlado Kurtev\Application Data\Microsoft\conhost.exe
C:\WINDOWS\update.tray-7-0
C:\WINDOWS\update.1
C:\WINDOWS\services32.exe
C:\WINDOWS\update.1\svchost.exe
C:\WINDOWS\update.tray-8-0\svchost.exe
C:\WINDOWS\update.2\svchost.exe
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000
"DisableThumbnailCache"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\services32.exe"=-
"C:\WINDOWS\update.1\svchost.exe"=-
"C:\WINDOWS\update.tray-8-0\svchost.exe"=-
"C:\WINDOWS\update.2\svchost.exe"=-
:commands
[resethosts]
[emptytemp]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Изтеглете SystemLook и запазете програмата на десктопа.

Кликнете два пъти върху SystemLook.exe, за да стартирате програмата.
Копирайте съдържанието от цитата по-долу в текстовото поле на програмата:

:reg
HKEY_USERS\S-1-5-21-602162358-813497703-839522115-1003\Software\Microsoft\Windows NT\CurrentVersion\Windows

Кликнете на бутона Look, за да започне сканирането.
Когато сканирането завърши ще се отвори Notepad с резултата от сканирането. После публикувайте лог файла в следващия си коментар.

26 юли 201115 г.

Автор

Здравей отново! Извинявяй за забавянето, имах работа извън къщи. Разбирам, че и ти си зает - просто още едно голямо благодаря от всички нас за вашата помощ!

Така, това приложиние msisvchost съм го виждал и преди в диспечъра на задачите, при процеси, но не знам каква му е функцията, нито дали е полезен или вреден за компютъра.Във всеки случай не е инсталирано (ако е програма) от мен или някой от семейството ми. Вредно ли е това приложение ?

Сега ще направя каквото си ми посочил и пак ще пиша .

Имам въпрос:

Премахнах от Control Pdnel всички файлове,свързани с двете Антивирусни. Сега ще направя това, което ми писа за OTL програмата. Въпросът е , трябва ли отново да настроя OTL, както при първото използване - File Age -> 90 Days,Standart Registry -> All и т.н.?

Редактирано 26 юли 201115 г. от vratarqt (преглед на промените)

26 юли 201115 г.

Не, просто копирайте скрипта в полето отдолу и натискате Run Fix. После ще проверим и този msisvchost.

26 юли 201115 г.

Автор

Здравей отново! Така, направих операцията с OTL, но след рестарта не излезе нищо, просто Windows си зареди.Следователно , откъде да взема Лог файла, за да ти го дам? Междувременно , докато чаках, забелязaх , че след като в диспечъра на задачите изключа процеса ufo.exe , процесът firefox.exe започва да натоварва процесорa много - 90% и нагоре. Не знам дали това ти говори нещо , просто споделям. Та откъде да взема лог файла?

Редактирано 26 юли 201115 г. от vratarqt (преглед на промените)

26 юли 201115 г.

Лог файла се намира в папката C:\_OTL\Movedfiles Копирайте го в следващия си пост...има опасност да не се е получила процедурата, защото процеса ufa.exe бе маркиран в скрипта ми за триене, но щом още стои ще се наложи да използваме алтернативен инструмент.

26 юли 201115 г.

Автор

В посочената папка има само една друга папка, наименувана с номера: 07262011_170155 . Тази папка пък от своя страна е празна.

26 юли 201115 г.

Значи лог файл йок....добре минаваме на тежката артилерия, после ще се върнем на OTL да доизчистим:

1. Изтеглете ComboFix от BleepingComputer

и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

Публикувано изображение

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

Публикувано изображение

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива. За целта може да прегледате информацията от този линк: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. ComboFix ще провери дали Windows Recovery Console e инсталиранa.

*Ако Windows Recovery Console не е инсталирана, ще е необходимо да използвате YES за инсталация на Windows Recovery Console

*Ако Windows Recovery Console е инсталирана, ComboFix ще продължи работата си.

Публикувано изображение

Забележка: Необходимо е да сте свързани към Интернет за да може Windows Recovery Console да се изтегли.

След инсталация на Windows Recovery Console потвърдете с YES, за да продължите напред. Снимка:

Публикувано изображение

5. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

Забележка: При проблеми с ComboFix копирайте с (Copy) и поставете с (Paste) съдържанието на C:\BUG.txt в следващия си коментар.

6. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Публикувано изображение

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

26 юли 201115 г.

Автор

Срещам трудност! След като дръпнах CamboFix файла, четох в линка How to temporally desable your Anti-virus. Но там пише, че за да изключа Аваст , трябва да кликна с десен бутон и да направя така и така. Но това е невъзможно, понеже Аваст-иконката до часовника долу вдясно е оранжева и с който и от бутоните на мишката да кликна излиза Enhanced Protection Mode. Затова директно включих Cambo Fix. Със самото кликване върху иконката и , Аваст иконата до часовника изчезна. Но в следващата секунда CamboFix ми показа съобщение , че : antivirus: AntiVir Dekstop antivirus: avast! antivirus 4.8.1368 [VPS 091127-1] The above real time scanner(s) are still active. и ме призовава да ги изключа. При което аз влязох в Control Panel,Security Center и направих така, че WindowsFirewall да е е изключена (пише Not Monitored) а срещу Automatic Updates, Virus Proteсtion има OFF. После натиснах ОК на CamboFix Съобщението. Ноизлезе второ ,което гласи почти същото : antivirus: AntiVir Dekstop antivirus: avast! antivirus 4.8.1368 [VPS 091127-1] The above real time scanner(s) are still active but CamboFix shall continue to run.Kindly note that this is at your own risk. При това съобщение реших да ти пиша. Какво да направя, да дам ОК и на второто Съобщение от CamboFix или пък как да ги изключа тези - antivirus: AntiVir Dekstop ,аntivirus: avast! antivirus 4.8.1368 [VPS 091127-1]

26 юли 201115 г.

Пробвайте направо да деинсталирате антивирусната и тогава да продължите...ако не се получи просто натиснете OK.

26 юли 201115 г.

Автор

Здравей отново!

Така CamboFix свърши работата си. Сега ще Paste лог файла.(Въпрос: Да пусна ли вече Windows Firewall?)

ComboFix 11-07-26.02 - Vlado Kurtev 07/26/2011 19:00:09.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.767.500 [GMT 3:00]

Running from: c:\documents and settings\Vlado Kurtev\Desktop\ComboFix.exe

AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}

AV: avast! antivirus 4.8.1368 [VPS 091127-1] *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Vlado Kurtev\Application Data\Desktopicon

c:\documents and settings\Vlado Kurtev\Application Data\dwm.exe

c:\documents and settings\Vlado Kurtev\Application Data\Microsoft\conhost.exe

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\1.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\a.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\b.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\c.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\d.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\e.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\f.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\g.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\h.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\i.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\J.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\k.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\l.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\m.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\n.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\o.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\p.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\q.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\r.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\s.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\t.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\u.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\v.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\w.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\x.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\y.xml

c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\z.xml

c:\documents and settings\Vlado Kurtev\WINDOWS

C:\Microsoft

c:\program files\Internet Explorer\conhost.exe

c:\program files\Mozilla Firefox\components\npclntax.xpt

c:\program files\Uninstall Fun Web Products.dll

c:\windows\btc_client_iplist.txt

c:\windows\ddh_iplist.txt

c:\windows\front_ip_list.txt

c:\windows\gbot111.exe

c:\windows\iecheck_iplist.txt

c:\windows\info1

c:\windows\iplist.txt

c:\windows\l1rezerv.exe

c:\windows\loader2.exe_ok

c:\windows\msvrc20.dll

c:\windows\phoenix.rar

c:\windows\proc_list1.log

c:\windows\rpcminer.rar

c:\windows\services32.exe

c:\windows\sysdriver32.exe

c:\windows\sysdriver32_.exe

c:\windows\system32\drivers\etc\hѕsts

c:\windows\TEMP\1005973.exe

c:\windows\ufa.rar

c:\windows\update.1

c:\windows\update.1\svchost.exe

c:\windows\update.2

c:\windows\update.2\svchost.exe

c:\windows\update.5.0

c:\windows\update.5.0\svchost.exe

c:\windows\update.tray-7-0\svchost.exe

c:\windows\VM305Cap.exe

c:\windows\winlog-dirs.txt

c:\windows\winlog-ids.txt

c:\windows\winsetupapi.log

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_SRVIECHECK

-------\Legacy_SRVSYSDRIVER32

-------\Legacy_WXPDRIVERS

-------\Service_srviecheck

-------\Service_srvsysdriver32

-------\Service_wxpdrivers

-------\Legacy_srvbtcclient

-------\Service_srvbtcclient

.

((((((((((((((((((((((((( Files Created from 2011-06-26 to 2011-07-26 )))))))))))))))))))))))))))))))

.

2011-07-26 14:01 . 2011-07-26 14:01 -------- d-----w- C:\_OTL

2011-07-25 13:28 . 2011-07-25 13:28 -------- d--h--w- c:\windows\system32\GroupPolicy

2011-07-25 13:17 . 2011-07-26 16:04 -------- d--h--w- c:\windows\update.tray-7-0

2011-07-25 13:17 . 2011-07-25 13:17 -------- d--h--w- c:\windows\update.tray-7-0-lnk

2011-07-25 12:05 . 2009-11-24 22:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-07-25 12:05 . 2009-11-24 22:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-07-25 12:05 . 2009-11-24 22:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2011-07-25 12:05 . 2009-11-24 22:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys

2011-07-25 12:05 . 2009-11-24 22:50 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2011-07-25 12:05 . 2009-11-24 22:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-07-25 12:05 . 2009-11-24 22:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2011-07-25 12:05 . 2009-11-24 22:47 97480 ----a-w- c:\windows\system32\AvastSS.scr

2011-07-25 12:05 . 2009-11-24 22:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe

2011-07-25 12:05 . 2004-01-09 08:13 380928 ----a-w- c:\windows\system32\actskin4.ocx

2011-07-21 12:41 . 2011-07-21 12:41 -------- d-----w- c:\program files\IObit

2011-07-19 19:37 . 2011-07-19 19:37 -------- d-----w- c:\windows\rpcminer

2011-07-19 19:37 . 2011-07-19 19:37 -------- d-----w- c:\windows\phoenix

2011-07-19 19:29 . 2011-07-19 19:37 246272 ----a-w- c:\windows\unrar.exe

2011-07-18 18:28 . 2011-07-18 18:28 -------- d-----w- c:\documents and settings\Vlado Kurtev\Local Settings\Application Data\Media Get LLC

2011-07-18 18:27 . 2011-07-18 18:29 -------- d-----w- c:\documents and settings\Vlado Kurtev\Local Settings\Application Data\MediaGet2

2011-07-18 15:40 . 2011-07-18 15:41 -------- d-----w- c:\documents and settings\Vlado Kurtev\Application Data\Ldoce

2011-07-18 15:40 . 2011-07-18 15:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Macrovision

2011-07-18 15:40 . 2011-07-18 15:40 -------- d-----w- c:\program files\Common Files\Macrovision Shared

2011-07-18 15:40 . 2011-07-18 15:40 54784 ----a-w- c:\windows\system32\drivers\CDAC11BA.EXE

2011-07-18 15:40 . 2011-07-18 15:40 12464 ----a-w- c:\windows\system32\drivers\CdaC15BA.SYS

2011-07-18 12:37 . 2011-07-19 19:37 -------- d-----w- c:\windows\ufa

2011-07-18 10:31 . 2011-07-18 10:31 -------- d-----w- c:\documents and settings\Vlado Kurtev\Local Settings\Application Data\Solid State Networks

2011-07-18 10:07 . 2011-07-18 10:07 181760 ----a-w- c:\program files\Windows NT\dwm.exe

2011-07-18 10:06 . 2011-07-25 13:19 -------- d-----w- c:\windows\av_ico

2011-07-18 10:03 . 2011-07-18 10:03 -------- d--h--w- c:\windows\update.tray-8-0

2011-07-18 10:03 . 2011-07-18 10:03 -------- d--h--w- c:\windows\update.tray-8-0-lnk

2011-07-17 20:19 . 2011-07-18 10:54 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-24 09:35 . 2010-06-23 09:09 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll

2011-06-04 08:06 . 2011-01-23 15:24 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2009-04-03 18:57 . 2009-04-03 19:10 266240 ----a-w- c:\program files\Uninstall Pando Toolbar.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}"= "c:\program files\IsoBuster\prxtbIso0.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}]

2011-01-17 14:54 175912 ----a-w- c:\program files\IsoBuster\prxtbIso0.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2011-01-17 14:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}"= "c:\program files\IsoBuster\prxtbIso0.dll" [2011-01-17 175912]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6}"= "c:\program files\IsoBuster\prxtbIso0.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Advanced SystemCare 4"="c:\program files\IObit\Advanced SystemCare 4\ASCTray.exe" [2011-06-16 413072]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

"nwiz"="nwiz.exe" [2006-10-22 1622016]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-05-27 40368]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-29 937920]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

c:\documents and settings\Vlado Kurtev\Start Menu\Programs\Startup\

PowerReg Scheduler.exe [2008-6-21 256000]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableSecureUIAPaths"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk /p \??\G:\0autocheck autochk *

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced WindowsCare V2 Personal

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ctfmon.exe"=c:\windows\system32\ctfmon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd

"BigDog305"=c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)

"HPUsageTracking"=c:\program files\HP\HP UT\bin\hppusg.exe "c:\program files\HP\HP UT\"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"FirewallOverride"=dword:00000001

"DisableThumbnailCache"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\BitLord\\BitLord.exe"=

"e:\\Games to Nicki\\cs\\Counter-Strike\\hl.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\WINDOWS\\update.tray-8-0\\svchost.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015

"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016

"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

"57967:TCP"= 57967:TCP:Pando P2P TCP Listening Port

"57967:UDP"= 57967:UDP:Pando P2P UDP Listening Port

"58943:TCP"= 58943:TCP:Pando P2P TCP Listening Port

"58943:UDP"= 58943:UDP:Pando P2P UDP Listening Port

"58894:TCP"= 58894:TCP:Pando P2P TCP Listening Port

"58894:UDP"= 58894:UDP:Pando P2P UDP Listening Port

"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

"45000:UDP"= 45000:UDP:msisvchost

"45001:UDP"= 45001:UDP:msisvchost

"45003:UDP"= 45003:UDP:msisvchost

.

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2/13/2008 17:33 643072]

R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\IObit\Advanced SystemCare 4\ASCService.exe [7/21/2011 15:41 353168]

S2 0234281243324666mcinstcleanup;McAfee Application Installer Cleanup (0234281243324666);c:\docume~1\VLADOK~1\LOCALS~1\Temp\0234281243324666mcinst.exe c:\progra~1\COMMON~1\McAfee\Installer\cleanup.ini -cleanup -nolog -service --> c:\docume~1\VLADOK~1\LOCALS~1\Temp\0234281243324666mcinst.exe c:\progra~1\COMMON~1\McAfee\Installer\cleanup.ini -cleanup -nolog -service [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 13:16 130384]

S3 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\drivers\DLPORTIO.SYS [6/29/2000 17:24 3584]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\g:\test\EVEREST 4.00 Build 975 Ultimate+Crack\kerneld.wnt --> g:\test\EVEREST 4.00 Build 975 Ultimate+Crack\kerneld.wnt [?]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 13:16 753504]

S3 ZSMC0305;A4 TECH PC Camera V;c:\windows\system32\drivers\usbVM305.sys [7/3/2008 12:32 391688]

S4 AntiVirSchedulerService;Avira AntiVir Scheduler;"c:\program files\Avira\AntiVir Desktop\sched.exe" --> c:\program files\Avira\AntiVir Desktop\sched.exe [?]

S4 Ippieccsmp;Ippieccsmp; [x]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Contents of the 'Scheduled Tasks' folder

.

2011-07-26 c:\windows\Tasks\1-Click Maintenance.job

- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 06:09]

.

2011-07-22 c:\windows\Tasks\ASC4_AutoCare.job

- c:\program files\IObit\Advanced SystemCare 4\AutoCare.exe [2011-07-21 11:29]

.

2011-07-26 c:\windows\Tasks\ASC4_AutoSweep.job

- c:\program files\IObit\Advanced SystemCare 4\AutoSweep.exe [2011-07-21 11:29]

.

2011-07-26 c:\windows\Tasks\ASC4_AutoUpdate.job

- c:\program files\IObit\Advanced SystemCare 4\AutoUpdate.exe [2011-07-21 11:29]

.

2011-07-26 c:\windows\Tasks\ASC4_PerformanceMonitor.job

- c:\program files\IObit\Advanced SystemCare 4\PMonitor.exe [2011-07-21 11:29]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://search.babylon.com/home?AF=18776

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyServer = http=127.0.0.1:54667

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000

TCP: DhcpNameServer = 93.155.247.2 192.168.0.1

FF - ProfilePath - c:\documents and settings\Vlado Kurtev\Application Data\Mozilla\Firefox\Profiles\rvbk65cl.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1700389&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/

FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=toolbar2&q=

FF - prefs.js: network.proxy.http - 127.0.0.1

FF - prefs.js: network.proxy.http_port - 54667

FF - prefs.js: network.proxy.type - 1

FF - Ext: Babylon OCR: [email protected] - c:\program files\Mozilla Firefox\extensions\[email protected]

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

FF - Ext: United States English Spellchecker: [email protected] - %profile%\extensions\[email protected]

FF - Ext: Babylon: [email protected] - %profile%\extensions\[email protected]

FF - Ext: myBabylon Toolbar: {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - %profile%\extensions\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}

FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - Ext: Java Quick Starter: [email protected] - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Freemake Video Downloader: [email protected] - c:\program files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox

FF - user.js: network.http.max-connections-per-server - 4

FF - user.js: content.max.tokenizing.time - 1500000

FF - user.js: nglayout.initialpaint.delay - 100

.

- - - - ORPHANS REMOVED - - - -

.

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKLM-Run-Cmaudio - cmicnfg.cpl

HKLM-Run-wxpdrv - c:\windows\services32.exe

HKLM-Run-tray_ico0 - c:\windows\update.tray-7-0\svchost.exe

HKLM-Run-l1rezerv.exe - c:\windows\l1rezerv.exe

HKLM-Run-tray_ico - (no file)

HKLM-Run-tray_ico1 - (no file)

HKLM-Run-tray_ico2 - (no file)

HKLM-Run-tray_ico3 - (no file)

HKLM-Run-tray_ico4 - (no file)

AddRemove-Codec pack Base (DivX, Xvid, 3ivx) - c:\windows\system32\uninst Codec pack Base (DivX

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-07-26 19:07

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]

"ImagePath"="\??\g:\test\EVEREST 4.00 Build 975 Ultimate+Crack\kerneld.wnt"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(3556)

c:\windows\system32\WININET.dll

c:\windows\system32\nview.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\nvwddi.dll

c:\windows\system32\webcheck.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\drivers\CDAC11BA.EXE

c:\program files\Common Files\InterVideo\DeviceService\DevSvc.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\windows\system32\nvsvc32.exe

c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

c:\windows\system32\UAService7.exe

c:\windows\SOUNDMAN.EXE

c:\windows\system32\rundll32.exe

c:\program files\Canon\CAL\CALMAIN.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2011-07-26 19:11:50 - machine was rebooted

ComboFix-quarantined-files.txt 2011-07-26 16:11

.

Pre-Run: 4,959,739,904 bytes free

Post-Run: 4,835,659,776 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=AlwaysOff /fastdetect

.

- - End Of File - - EFB16EBAAE34E91D8C8F6A8AC8DF663D

26 юли 201115 г.

Деинсталирайте ли от Control Panel => ADD or Remove Programs => следните програми:

Avira

avast

(накрая ще инсталираме антивирусна, но само една)

*. Отворете notepad.exe и с copy/paste въведете следната информация:

KILLALL::
Driver::
0234281243324666mcinstcleanup
Ippieccsmp
AntiVirSchedulerService
File::
c:\windows\unrar.exe
c:\windows\system32\ConduitEngine.tmp
Folder::
c:\windows\update.tray-7-0
c:\windows\update.tray-7-0-lnk
c:\windows\rpcminer
c:\windows\phoenix
c:\windows\ufa
c:\windows\av_ico
c:\windows\update.tray-8-0
c:\windows\update.tray-8-0-lnk
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"=-
[-HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
"BootExecute"=hex(7):61,75,74,6f,63,68,65,63,6b,20,61,75,74,6f,63,68,6b,20,2a,00,00
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000000
"DisableThumbnailCache"=dword:00000000
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\update.tray-8-0\\svchost.exe"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"45000:UDP"=-
"45001:UDP"=-
"45003:UDP"=-
DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:54667
Firefox::
FF - ProfilePath - c:\documents and settings\Vlado Kurtev\Application Data\Mozilla\Firefox\Profiles\rvbk65cl.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 54667
FF - prefs.js: network.proxy.type - 1

Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).

Публикувано изображение

*. По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

*. Когато Combofix приключи ще създаде лог файла. Моля, публикувайте този файл в следващия си пост.

26 юли 201115 г.

Автор

Относно Антивирусните (Avira , Avast) - в Контрол панела, Добавяне/премахване на програми , не виждам нито едната, нито другата, което би трябвало да значе, че са деинсталирани?Не знам. Не знам също дали това е важно, но в момента Mozilla Firefox не ми е активна - в момента съм в нета чрез Интернет Експлолера на Уиндълс. За Мозилата ми пише, че Прокси сърварът отказва свързване. Така, сега ще направя следващата стъпка с CamboFix.

26 юли 201115 г.

Просто се виждат остатъци от антивирусните и затова ви питах...нищо това е поправимо...колкото до активния браузър - Combofix прави Internet Explorer браузър по-подразбиране (и това се оправя). Прокситата също ще бъдат оправени...включени са в скрипта ми...Действайте. :mistaken:

26 юли 201115 г.

Автор

Здравей отново! Така, и ComcoFix свърши работата ,ето лог файла: (Мозилата се оправи, в момента чрез нея съм в нета :mistaken: ) ComboFix 11-07-26.02 - Vlado Kurtev 07/26/2011 19:58:00.2.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.767.378 [GMT 3:00] Running from: c:\documents and settings\Vlado Kurtev\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Vlado Kurtev\Desktop\CFScript.txt AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7} AV: avast! antivirus 4.8.1368 [VPS 091127-1] *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . FILE :: "c:\windows\system32\ConduitEngine.tmp" "c:\windows\unrar.exe" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\Vlado Kurtev\Application Data\PriceGong c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\1.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\a.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\b.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\c.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\d.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\e.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\f.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\g.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\h.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\i.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\J.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\k.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\l.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\m.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\mru.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\n.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\o.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\p.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\q.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\r.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\s.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\t.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\u.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\v.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\w.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\x.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\y.xml c:\documents and settings\Vlado Kurtev\Application Data\PriceGong\Data\z.xml c:\windows\av_ico c:\windows\av_ico\ico_avast_desktop.ico c:\windows\av_ico\ico_avast_start.ico c:\windows\av_ico\ico_avira_start.ico c:\windows\phoenix c:\windows\phoenix\kernels\phatk\__init__.py c:\windows\phoenix\kernels\phatk\__init__.pyc c:\windows\phoenix\kernels\phatk\BFIPatcher.py c:\windows\phoenix\kernels\phatk\kernel.cl c:\windows\phoenix\kernels\poclbm\__init__.py c:\windows\phoenix\kernels\poclbm\__init__.pyc c:\windows\phoenix\kernels\poclbm\BFIPatcher.py c:\windows\phoenix\kernels\poclbm\kernel.cl c:\windows\phoenix\phoenix.exe c:\windows\rpcminer c:\windows\rpcminer\bitcoinminercuda_10.cubin c:\windows\rpcminer\bitcoinminercuda_11.cubin c:\windows\rpcminer\bitcoinminercuda_20.cubin c:\windows\rpcminer\bitcoinmineropencl.cl c:\windows\rpcminer\cudart32_32_16.dll c:\windows\rpcminer\curllib.dll c:\windows\rpcminer\libeay32.dll c:\windows\rpcminer\libsasl.dll c:\windows\rpcminer\openldap.dll c:\windows\rpcminer\rpcminer-4way.exe c:\windows\rpcminer\rpcminer-cpu.exe c:\windows\rpcminer\rpcminer-cuda.exe c:\windows\rpcminer\rpcminer-opencl.exe c:\windows\rpcminer\ssleay32.dll c:\windows\system32\ConduitEngine.tmp c:\windows\system32\drivers\etc\hѕsts c:\windows\ufa c:\windows\ufa\ufa.exe c:\windows\unrar.exe c:\windows\update.tray-7-0-lnk c:\windows\update.tray-7-0-lnk\svchost.exe c:\windows\update.tray-7-0 c:\windows\update.tray-8-0-lnk c:\windows\update.tray-8-0-lnk\svchost.exe c:\windows\update.tray-8-0 c:\windows\update.tray-8-0\svchost.exe . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_0234281243324666MCINSTCLEANUP -------\Legacy_ANTIVIRSCHEDULERSERVICE -------\Service_0234281243324666mcinstcleanup -------\Service_AntiVirSchedulerService -------\Service_Ippieccsmp . . ((((((((((((((((((((((((( Files Created from 2011-06-26 to 2011-07-26 ))))))))))))))))))))))))))))))) . . 2011-07-26 14:01 . 2011-07-26 14:01 -------- d-----w- C:\_OTL 2011-07-25 13:28 . 2011-07-25 13:28 -------- d--h--w- c:\windows\system32\GroupPolicy 2011-07-25 12:05 . 2009-11-24 22:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2011-07-25 12:05 . 2009-11-24 22:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2011-07-25 12:05 . 2009-11-24 22:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2011-07-25 12:05 . 2009-11-24 22:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys 2011-07-25 12:05 . 2009-11-24 22:50 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2011-07-25 12:05 . 2009-11-24 22:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys 2011-07-25 12:05 . 2009-11-24 22:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2011-07-25 12:05 . 2009-11-24 22:47 97480 ----a-w- c:\windows\system32\AvastSS.scr 2011-07-25 12:05 . 2009-11-24 22:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe 2011-07-25 12:05 . 2004-01-09 08:13 380928 ----a-w- c:\windows\system32\actskin4.ocx 2011-07-21 12:41 . 2011-07-21 12:41 -------- d-----w- c:\program files\IObit 2011-07-18 18:28 . 2011-07-18 18:28 -------- d-----w- c:\documents and settings\Vlado Kurtev\Local Settings\Application Data\Media Get LLC 2011-07-18 18:27 . 2011-07-18 18:29 -------- d-----w- c:\documents and settings\Vlado Kurtev\Local Settings\Application Data\MediaGet2 2011-07-18 15:40 . 2011-07-18 15:41 -------- d-----w- c:\documents and settings\Vlado Kurtev\Application Data\Ldoce 2011-07-18 15:40 . 2011-07-18 15:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Macrovision 2011-07-18 15:40 . 2011-07-18 15:40 -------- d-----w- c:\program files\Common Files\Macrovision Shared 2011-07-18 15:40 . 2011-07-18 15:40 54784 ----a-w- c:\windows\system32\drivers\CDAC11BA.EXE 2011-07-18 15:40 . 2011-07-18 15:40 12464 ----a-w- c:\windows\system32\drivers\CdaC15BA.SYS 2011-07-18 10:31 . 2011-07-18 10:31 -------- d-----w- c:\documents and settings\Vlado Kurtev\Local Settings\Application Data\Solid State Networks 2011-07-18 10:07 . 2011-07-18 10:07 181760 ----a-w- c:\program files\Windows NT\dwm.exe 2011-07-17 20:19 . 2011-07-18 10:54 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-06-24 09:35 . 2010-06-23 09:09 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll 2009-04-03 18:57 . 2009-04-03 19:10 266240 ----a-w- c:\program files\Uninstall Pando Toolbar.dll . . ((((((((((((((((((((((((((((( SnapShot@2011-07-26_16.07.45 ))))))))))))))))))))))))))))))))))))))))) . + 2011-07-26 17:05 . 2011-07-26 17:05 16384 c:\windows\temp\Perflib_Perfdata_254.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}"= "c:\program files\IsoBuster\prxtbIso0.dll" [2011-01-17 175912] . [HKEY_CLASSES_ROOT\clsid\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}] . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}] 2011-01-17 14:54 175912 ----a-w- c:\program files\IsoBuster\prxtbIso0.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}"= "c:\program files\IsoBuster\prxtbIso0.dll" [2011-01-17 175912] . [HKEY_CLASSES_ROOT\clsid\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6}"= "c:\program files\IsoBuster\prxtbIso0.dll" [2011-01-17 175912] . [HKEY_CLASSES_ROOT\clsid\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "nwiz"="nwiz.exe" [2006-10-22 1622016] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-05-27 40368] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-29 937920] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] . c:\documents and settings\Vlado Kurtev\Start Menu\Programs\Startup\ PowerReg Scheduler.exe [2008-6-21 256000] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableSecureUIAPaths"= 0 (0x0) . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] backup=c:\windows\pss\Microsoft Office.lnkCommon Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"=c:\windows\system32\ctfmon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd "BigDog305"=c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305) "HPUsageTracking"=c:\program files\HP\HP UT\bin\hppusg.exe "c:\program files\HP\HP UT\" . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\BitLord\\BitLord.exe"= "e:\\Games to Nicki\\cs\\Counter-Strike\\hl.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 "57967:TCP"= 57967:TCP:Pando P2P TCP Listening Port "57967:UDP"= 57967:UDP:Pando P2P UDP Listening Port "58943:TCP"= 58943:TCP:Pando P2P TCP Listening Port "58943:UDP"= 58943:UDP:Pando P2P UDP Listening Port "58894:TCP"= 58894:TCP:Pando P2P TCP Listening Port "58894:UDP"= 58894:UDP:Pando P2P UDP Listening Port "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 . R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2/13/2008 17:33 643072] R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\IObit\Advanced SystemCare 4\ASCService.exe [7/21/2011 15:41 353168] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 13:16 130384] S3 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\drivers\DLPORTIO.SYS [6/29/2000 17:24 3584] S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\g:\test\EVEREST 4.00 Build 975 Ultimate+Crack\kerneld.wnt --> g:\test\EVEREST 4.00 Build 975 Ultimate+Crack\kerneld.wnt [?] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 13:16 753504] S3 ZSMC0305;A4 TECH PC Camera V;c:\windows\system32\drivers\usbVM305.sys [7/3/2008 12:32 391688] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contents of the 'Scheduled Tasks' folder . 2011-07-26 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 06:09] . 2011-07-22 c:\windows\Tasks\ASC4_AutoCare.job - c:\program files\IObit\Advanced SystemCare 4\AutoCare.exe [2011-07-21 11:29] . 2011-07-26 c:\windows\Tasks\ASC4_AutoSweep.job - c:\program files\IObit\Advanced SystemCare 4\AutoSweep.exe [2011-07-21 11:29] . 2011-07-26 c:\windows\Tasks\ASC4_AutoUpdate.job - c:\program files\IObit\Advanced SystemCare 4\AutoUpdate.exe [2011-07-21 11:29] . 2011-07-26 c:\windows\Tasks\ASC4_PerformanceMonitor.job - c:\program files\IObit\Advanced SystemCare 4\PMonitor.exe [2011-07-21 11:29] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.bg/ uDefault_Search_URL = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = iexplore uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000 TCP: DhcpNameServer = 93.155.247.2 192.168.0.1 FF - ProfilePath - c:\documents and settings\Vlado Kurtev\Application Data\Mozilla\Firefox\Profiles\rvbk65cl.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1700389&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/ FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=toolbar2&q= FF - Ext: Babylon OCR: [email protected] - c:\program files\Mozilla Firefox\extensions\[email protected] FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} FF - Ext: United States English Spellchecker: [email protected] - %profile%\extensions\[email protected] FF - Ext: Babylon: [email protected] - %profile%\extensions\[email protected] FF - Ext: myBabylon Toolbar: {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - %profile%\extensions\{34ea1c70-42cc-42c5-aa29-ec58b95a343e} FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} FF - Ext: Java Quick Starter: [email protected] - c:\program files\Java\jre6\lib\deploy\jqs\ff FF - Ext: Freemake Video Downloader: [email protected] - c:\program files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox FF - user.js: network.http.max-connections-per-server - 4 FF - user.js: content.max.tokenizing.time - 1500000 FF - user.js: nglayout.initialpaint.delay - 100 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-07-26 20:05 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver] "ImagePath"="\??\g:\test\EVEREST 4.00 Build 975 Ultimate+Crack\kerneld.wnt" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'explorer.exe'(1876) c:\windows\system32\WININET.dll c:\windows\system32\nview.dll c:\windows\system32\ieframe.dll c:\windows\system32\nvwddi.dll c:\windows\system32\webcheck.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\drivers\CDAC11BA.EXE c:\program files\Common Files\InterVideo\DeviceService\DevSvc.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\windows\system32\nvsvc32.exe c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe c:\windows\system32\UAService7.exe c:\windows\SOUNDMAN.EXE c:\windows\system32\rundll32.exe c:\program files\Canon\CAL\CALMAIN.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2011-07-26 20:09:01 - machine was rebooted ComboFix-quarantined-files.txt 2011-07-26 17:08 ComboFix2.txt 2011-07-26 16:11 . Pre-Run: 4,826,783,744 bytes free Post-Run: 4,808,097,792 bytes free . - - End Of File - - EF5D67D1C6F97E86B6339CB855089F12

26 юли 201115 г.

Добра работа...повторете сканирането с OTL с настройките от началния ми пост и публикувайте логовете. Ще продължим късно вечерта или утре, защото имам лични ангажименти.

26 юли 201115 г.

Автор

Здравей отново! Благодаря ти за отделеното от теб време дотук ! Благодаря не само за точните инструкции, но и за коректното и любезно отношение. Мисля единствено да включа отново Windows Firewall, като все пак някаква защита ,докато компютъра работи. Очаквам следващата ни среща.До скоро! Така, OTL даде следния отчет,прикачвам.

OTL.Txt

26 юли 201115 г.

Здравейте отново...имаме още доста работа...

Тъй като си имаме работа с unicode characters с които форумната система не може да работи ще се наложи да използваме алтернативен метод.

Архивирам скрипт файла към поста си. Изтеглете го и го разархивирайте.

Стартирайте файла OTL.TXT и копирайте цялото съдържание с бутона Ctrl + A (за да го маркирате), след това Ctrl + C (за да го копирате) и след това Ctrl + V (за да го поставите в OTL под колонката Custom Scans/Fixes като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта).

След като въведете скрипта натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Лог файла би трябвало да се съхранява в C:\_OTL\MovedFiles.

Изтеглете SystemLook и запазете програмата на десктопа.

Кликнете два пъти върху SystemLook.exe, за да стартирате програмата.
Копирайте съдържанието от цитата по-долу в текстовото поле на програмата:

:reg
HKEY_USERS\S-1-5-21-602162358-813497703-839522115-1003\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections /sub

Кликнете на бутона Look, за да започне сканирането.
Когато сканирането завърши ще се отвори Notepad с резултата от сканирането. После публикувайте лог файла в следващия си коментар.

OTL.zip

27 юли 201115 г.

Автор

Добро утро! Така, OTL свърши с работата си, сега ще копирам резултата.Да изчакам ли с SystemLook докато анализираш OTL резултата? All processes killed ========== OTL ========== Service HidServ stopped successfully! Service HidServ deleted successfully! Service AntiVirService stopped successfully! Service AntiVirService deleted successfully! Service catchme stopped successfully! Service catchme deleted successfully! Error: Unable to stop service avgntflt! Unable to delete service\driver key avgntflt. File move failed. C:\WINDOWS\system32\drivers\avgntflt.sys scheduled to be moved on reboot. Service aswRdr stopped successfully! Service aswRdr deleted successfully! C:\WINDOWS\system32\drivers\aswRdr.sys moved successfully. Service ssmdrv stopped successfully! Service ssmdrv deleted successfully! C:\WINDOWS\system32\drivers\ssmdrv.sys moved successfully. Service avipbb stopped successfully! Service avipbb deleted successfully! C:\WINDOWS\system32\drivers\avipbb.sys moved successfully. HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! Prefs.js: "Ask.com" removed from browser.search.defaultengine Prefs.js: "Ask.com" removed from browser.search.defaultenginename Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT1700389&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl Prefs.js: "Ask.com" removed from browser.search.order.1 C:\Documents and Settings\Vlado Kurtev\Application Data\Mozilla\Firefox\Profiles\rvbk65cl.default\searchplugins\ask.xml moved successfully. C:\Documents and Settings\Vlado Kurtev\Application Data\Mozilla\Firefox\Profiles\rvbk65cl.default\searchplugins\askcom.xml moved successfully. C:\Documents and Settings\Vlado Kurtev\Application Data\Mozilla\Firefox\Profiles\rvbk65cl.default\searchplugins\conduit.xml moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully. Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found. Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found. Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found. Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found. Registry key HKEY_USERS\S-1-5-21-602162358-813497703-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully. Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Program Files\Windows NT\dwm.exe deleted successfully. C:\Program Files\Windows NT\dwm.exe moved successfully. Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Program Files\Windows NT\dwm.exe deleted successfully. File C:\Program Files\Windows NT\dwm.exe not found. File C:\WINDOWS\System32\drivers\aswRdr.sys not found. C:\WINDOWS\system32\drivers\aswTdi.sys moved successfully. C:\WINDOWS\system32\drivers\aavmker4.sys moved successfully. C:\WINDOWS\system32\drivers\aswSP.sys moved successfully. C:\WINDOWS\system32\AvastSS.scr moved successfully. C:\WINDOWS\system32\drivers\aswmon2.sys moved successfully. C:\WINDOWS\system32\drivers\aswmon.sys moved successfully. C:\WINDOWS\system32\drivers\aswFsBlk.sys moved successfully. C:\WINDOWS\system32\aswBoot.exe moved successfully. C:\Documents and Settings\All Users\Desktop\avast! Antivirus.lnk moved successfully. C:\Documents and Settings\Vlado Kurtev\Application Data\FDFA.A02 moved successfully. C:\WINDOWS\geoiplist moved successfully. C:\WINDOWS\geoiplist.rar moved successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:4BF2F6B5 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:6152D44C deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:1940DBE8 deleted successfully. Unable to delete ADS C:\WINDOWS: . ADS C:\Documents and Settings\All Users\Application Data\TEMP:66B13F37 deleted successfully. ========== COMMANDS ========== C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 49219 bytes User: Vlado Kurtev ->Temp folder emptied: 3141 bytes ->Temporary Internet Files folder emptied: 335766 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 64965348 bytes ->Google Chrome cache emptied: 103147259 bytes ->Flash cache emptied: 456 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 53768 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 483 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 161.00 mb OTL by OldTimer - Version 3.2.26.1 log created on 07272011_094654 Files\Folders moved on Reboot... C:\WINDOWS\system32\drivers\avgntflt.sys moved successfully. Registry entries deleted on Reboot...

27 юли 201115 г.

Преди да продължим трябва да премахнем още един ред...(явно не съм запазил документа като UNICODE, а като ANSI). Да опитаме отново...пак изтеглете прикачения файл и повторете инструкциите ми от предишния ми пост. След това продължете със SystemLook.

OTL.Txt

27 юли 201115 г.

Автор

Така, направих операцията с OTL, а после и тази с SystemLook. Ето резуртата от SystemLook : SystemLook 04.09.10 by jpshortstuff Log created at 10:45 on 27/07/2011 by Vlado Kurtev Administrator - Elevation successful ========== reg ========== [HKEY_USERS\S-1-5-21-602162358-813497703-839522115-1003\Software\Microsoft\Windows NT\CurrentVersion\Windows] "DebugOptions"="2048" "Documents"="" "DosPrint"="no" "NetMessage"="no" "NullPort"="None" "Programs"="com exe bat pif cmd" "Device"="Microsoft XPS Document Writer,winspool,Ne00:" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections] "DefaultConnectionSettings"=46 00 00 00 99 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 38 d9 73 4a 6e c8 01 01 00 00 00 57 e3 cb 99 00 00 00 00 00 00 00 00 00 00 00 00 (REG_BINARY) "SavedLegacySettings"=46 00 00 00 c8 48 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 38 d9 73 4a 6e c8 01 01 00 00 00 57 e3 cb 99 00 00 00 00 00 00 00 00 00 00 00 00 (REG_BINARY) -= EOF =- IСега виждам , че в папката : C:\_OTL\MovedFiles има нов Notepad файл от OTL.Ето какво пише в него: ========== OTL ========== Unable to delete ADS C:\WINDOWS: . ========== COMMANDS ========== OTL by OldTimer - Version 3.2.26.1 log created on 07272011_104004

Редактирано 27 юли 201115 г. от vratarqt (преглед на промените)

27 юли 201115 г.

Аххх как мразя Unicode...

Отворете прикачение файл от вашия пост тук:

Под секцията:

========== Alternate Data Streams ==========

ще видите един ред с името @Alternate Data Stream - 108 bytes -> C:\WINDOWS (с един ченгел отзад)...

копирайте този ред в OTL....

Над него сложете следния ред:

:OTL

тук сложете реда @Alternate Data Stream - 108 bytes -> C:\WINDOWS с ченгела отзад и натиснете Run Fix.

Публикувайте лог файла,

Дано да се получи.

Добре дошли!

Facebook вирусът --> Enhаnced Protection Mode на антивирусната

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)