100% натоварване на процесора след зараза с Sys32.svchost

2 декември 200718 г.

Здравейте.......от 1-2 дни CPU-to започна да ми се товари на 100% (незнайно защо). Започнах аз проверки с нод32 после с касперски и авж......но не откриха нищо.........прегледах тук няколко теми и реших да пробвам със скенера RemoveLT Prov4....и хоп ИЗНЕНАДА.........намира следното: Infected with Sys32.svchost.........но за съжаление не може да го премахне..........търсих някаква информация за този вирус и разбрах че от групата на: Trojan.SystemPoser - Hidden Process 2004. Незнам как да действам.......помагайте.....че положението изобщо не е розово.

2 декември 200718 г.

Ами първото, което ми идва на ум е HiJackThis:

1. Изтегли HijackThis 2.0.2 от http://www.trendsecure.com/portal/en-US/th.../HiJackThis.exe

1. Запиши го в негова собствена папка

2. Стартирай го

2. Избери Do a scan and save a log

3. Използвай Copy/Paste , постави този log файл в следващия ти отговор

2 декември 200718 г.

Автор

Ами ето: Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:11:31, on 02.12.2007 г.

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.20661)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE

C:\Program Files\Grisoft\AVG7\avgcc.exe

C:\Documents and Settings\Iliyan\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.a...&tbid=60207

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60207

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60207

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60207

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60207

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [DefragTaskBar] "C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe"

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [PrevxCSI] "C:\Program Files\PrevxCSI\prevxcsi.exe" -boot

O4 - HKLM\..\RunServices: [ActiveScript32] C:\WINDOWS\system32\nod.exe

O4 - HKLM\..\RunServices: [ispkey] \ispkey.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')

O4 - Global Startup: Bluetooth.lnk = ?

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\DOCUME~1\Iliyan\LOCALS~1\Temp\Rar$EX00.640\New Folder\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\DOCUME~1\Iliyan\LOCALS~1\Temp\Rar$EX00.640\New Folder\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\DOCUME~1\Iliyan\LOCALS~1\Temp\Rar$EX00.640\New Folder\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm

O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...html?p=ZCfox000

O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: Преведи - {60237576-b24c-4ba9-9740-c9f3ec9db557} - C:\PROGRA~1\SkyCode\WEBTRA~1\wt2ie.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1190264852593

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Panda Firewall Service (PAVFIRES) - Unknown owner - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe (file missing)

O23 - Service: Panda anti-virus service (PAVSRV) - Unknown owner - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe (file missing)

O23 - Service: ViruScape Guard Service ({00008375-0Ab24-0D93-DFC9-9DC83F7AD8BC}) - Unknown owner - C:\Program Files\Tera Innovations\ViruScape\VS32.exe (file missing)

--

End of file - 10711 bytes

2 декември 200718 г.

Влез в HijackThis, избери Do scan a system only или нещо от сорта и сложи отметки на следните неща:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.a...&tbid=60207
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60207
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60207
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60207
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60207
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKUS\S-1-5-18\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...html?p=ZCfox000
O23 - Service: ViruScape Guard Service ({00008375-0Ab24-0D93-DFC9-9DC83F7AD8BC}) - Unknown owner - C:\Program Files\Tera Innovations\ViruScape\VS32.exe (file missing)

И избери Fix Cheked, за да бъдат оправени.

Единствено не съм сигурен за ето това

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cab

Какво е. Общо взето доста гадости намерихме.

П.п.: Бая антивирусни си накъчил, затова ти препоръчвам деинсталация на всички и после да инсталираш една единствена, като гледам по-добре избери AVG.

Поздрави!

2 декември 200718 г.

1.За процеса SVCHOST направи следните стъпки (освен за SERVICES.MSC използвай и програмата Windows Worms Doors Cleaner v1.4.1)

http://www.kaldata.com/forums/index.php?s=...st&p=712261

2.Сканирай за вируса BLAST

http://securityresponse.symantec.com/avcenter/FixBlast.exe

3.Инсталирай всички кръпки за Windows (и тези до месец август ще свършат работа на първо време).

http://kal.data.bg/Programs/AutoPatcher/Au...aldata.com).exe

4.Спри автоматичния UPDATE на WINDOWS:

Десен Бутон на My Computer => Automatic Updates => Turn Off Automatic Updates

Редактирано 1 юли 200818 г. от B-boy[StyLe] (преглед на промените)

2 декември 200718 г.

Автор

Вече само с АВЖ :huh: Но ми е много интересно защо програми като касперски и нод32 не откриват този вид вирус а REMOVELT PROV4 го откри?!? Притеснявам се за защитата на pc-to ми

2 декември 200718 г.

Вече само с АВЖ Но ми е много интересно защо програми като касперски и нод32 не откриват този вид вирус а REMOVELT PROV4 го откри?!? Притеснявам се за защитата на pc-to ми

Няма програма, която да хваща всичко...Това, което си лепнал не е нито wild вирус, нито zoo такъв...А програмка като RemoveIt Pro е създадена да допълва антивирусните като открива по-специфични зарази...(не случайно има такава тема за събиране на подобни инструменти).RemoveIt " removes many viruses that other popular antivirus software cannot discover.". До преди известно време тази програма се е третирала от Spyware Warrior като "фалшиво" приложение, но от доста време вече е заслужила доверието на сайта.

Note on RemoveIt Pro: RemoveIt Pro was listed on this page because of concerns with false positives. Testing with the latest version of RemoveIt Pro indicates that the problems with earlier versions have been satisfactorily resolved. Thus, we can no longer consider RemoveIt Pro to be "rogue/suspect" anti-spyware.

Лично на мен не ми е правила проблеми при премахването на откритите зарази!

2 декември 200718 г.

B-boy[styLe], като начало се извинявам, трябваше да провера дали не си ме изпреварител, преди да добавя втория си коментара си по темата. goplay89, накачил си около 3-4 антивирусни продукта и не очаквай нещо да хванеш така, затова ти препоръчах да си оставиш само една. Как е сега положението при теб? Между другото можеш да направиш едно-две сканирвания с онлайн скенерите на ESET и Kaspersky, за всеки случай. Винаги ми е било интересно какво е да си с Symantec, Panda и AVG

Редактирано 17 март 200818 г. от Fixer (преглед на промените)

2 декември 200718 г.

Няма за какво да се извиняваш, кой е бил пръв и кой не - важното е проблема да се реши...(просто мразя да си откривам греши в постовете и като го редактирам или допълня отдолу да пише редактиран еди кога си, а и много потребители гледат само новите коментари а не редактираните) и затова делнах поста и го сложих наново (който отново редактирах в последствие...).Важното е да се реши проблема.А колкото до препоръките ми за програмите, говоря от опит (повечето не се нуждаят от инсталиране, а могат да се изтрият след отстраняването на проблема).А и Google говори....просто съм понасъбрал повече съвети в поста си:

http://www.daniweb.com/forums/thread1664.html

2 декември 200718 г.

Автор

Ами всичко за сега е ок (поне така изглежда) :wors: да ей сега ще пусна онлайн скенера на касперски.....ами сега съм само със авж-то.........от другите антивирусни просто са останали някакви остатъци защото не са деинсталирвани а директно преди са били изтривани......как мога да ги премахна?!?Какъв е начина?......проблеми колкото искаш

2 декември 200718 г.

Аз ти предлагам да си инсталираш програмката Your Uninstaller! 2006 PRO (платена е, но ще ти свърши работа през пробния период...две деинсталации на стартиране позволява).

За по-голяма степен на почистване избери:

Tools => Options => Match => Average (не препоръчвам Agressive тъй като могат да се затрият и необходими файлове за някое друго приложение)

Download:

Your Uninstaller! 2006

http://www.ursoftware.com/download/uruninst2006.exe

След като я стартираш избери опцията AutoFix

Ако бъдат открити некоректно премахнати програми ще те пита дали почисти регистрите.Съгласи се:

Както и други програми за почистване на регистрите ще ти свършат работа!

Wise Registry Cleaner 2.96 Build 101

http://www.kaldata.com/modules.php?modid=1...how&id=1159

TweakNow RegCleaner Standard 3.0.1

http://www.kaldata.com/modules.php?modid=1...show&id=826

CCleaner 2.03.532

http://www.kaldata.com/comments.php?id=275...hlight=CCleaner

Registry Cleaner Beta(Updated 2007-7-21)

http://www.iobit.com/files/beta/RegistryCleaner.exe

PS: КАТО ГОВОРИМ ЗА ОНЛАЙН СКЕНЕРИ ПУСНИ ЕДИН ТАКЪВ С ПАНДА (ВИЖ МИ ПОДПИСА).НЕ ПРЕМАХВА ВИРУСИТЕ, НО ПОНЕ ПОКАЗВА КЪДЕ СЕ НАМИРАТ ЗА ДА ГИ ИЗТРИЕШ РЪЧНО!

Редактирано 2 декември 200718 г. от B-boy[StyLe] (преглед на промените)

2 декември 200718 г.

Автор

Ами направих и това.......но направо взе да ми писва......цял ден с това се знимавам и взе да ми омръзва вече......ако има нещо ще пиша пак......благодарско на всички които се отзоваха.....най - вече на b-boy [style] :angry: да ще пусна ей сега и него и ще ви уведомя за резултата

PS: Не си теглете програмата TRAFFIC COMPRESSOR.......САМО ПРОБЛЕМИ ВИ ОЧАКВАТ СЛЕД ТОВА...........

2 декември 200718 г.

goplay89, колегата хубаво ти ги е дал тези програми ама внимавай, защото това баране по регистрите не е много хубаво. Препоръчвам ти CCleaner, има си и ръководство http://www.kaldata.com/articles.php?action...showarticle=128 чети и тогава деиствай https://www.kaldata.com/forums/uploads/emoticons/default_angry.gif' alt=':angry:'> Освен с Kaspersky, Panda, направи едно за всеки случай и с ESET Online Scanner http://www.eset.com/onlinescan/

2 декември 200718 г.

Автор

b-BOY [sTYLE]:

Ето резултата от онлайн скенера на панда: ;*******************************************************************************

*********************************************************************************

*******************

ANALYSIS: 2007-12-02 18:11:23

PROTECTIONS: 1

MALWARE: 4

SUSPECTS: 0

;*******************************************************************************

*********************************************************************************

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

=================================================================================

===================

AVG 7.5.503 7.5.503 Yes Yes

;===============================================================================

=================================================================================

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

=================================================================================

===================

00032731 application/mywebsearch HackTools No 0 Yes No c:\program files\mywebsearch

00032731 application/mywebsearch HackTools No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

00032731 application/mywebsearch HackTools No 0 Yes No hkey_current_user\software\mywebsearch

00032731 application/mywebsearch HackTools No 0 Yes No hkey_local_machine\software\focusinteractive

00032731 application/mywebsearch HackTools No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3}

00032731 application/mywebsearch HackTools No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239}

00032731 application/mywebsearch HackTools No 0 Yes No hkey_local_machine\software\mywebsearch

00032731 application/mywebsearch HackTools No 0 Yes No hkey_classes_root\clsid\{147a976f-eee1-4377-8ea7-4716e4cdd239}

00032731 application/mywebsearch HackTools No 0 Yes No hkey_classes_root\clsid\{9afb8248-617f-460d-9366-d71cdeda3179}

00032731 application/mywebsearch HackTools No 0 Yes No hkey_classes_root\clsid\{a4730ebe-43a6-443e-9776-36915d323ad3}

00032731 application/mywebsearch HackTools No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}

00032731 application/mywebsearch HackTools No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}

00032731 application/mywebsearch HackTools No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}

00032731 application/mywebsearch HackTools No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44cf-8957-5838F569A31D}

00096053 application/funweb HackTools No 0 Yes No hkey_local_machine\software\fun web products

00096053 application/funweb HackTools No 0 Yes No hkey_current_user\software\fun web products

00096053 application/funweb HackTools No 0 Yes No hkey_local_machine\software\funwebproducts

00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Documents and Settings\Iliyan\Cookies\iliyan@tradedoubler[1].txt

00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Iliyan\Cookies\iliyan@xiti[1].txt

;===============================================================================

=================================================================================

===================

SUSPECTS

Location

;===============================================================================

=================================================================================

===================

;===============================================================================

=================================================================================

===================

Имам CCleaner :angry: Върши ми добра работа :angry: ок ще пусна след малко и есета :clap:

2 декември 200718 г.

Автор

Нод-а нищо не открива

2 декември 200718 г.

b-BOY [sTYLE]:

Ето резултата от онлайн скенера на панда...

Май изобщо не си поправил нещата с HijackThis както ти казахме с FIXER!

Като имаш време направи една снимка (както ти казах по Л.С.)

или виж темата на DRAGOZOW

Как се прави скрийншот?

http://www.kaldata.com/forums/index.php?sh...c=59060&hl=

и я дай насам да видя по-добре лога че нещо малко неразбираемо ми го предоставяш...

Примерна снимка:

Редактирано 2 декември 200718 г. от B-boy[StyLe] (преглед на промените)

2 декември 200718 г.

HiJackThis е истината, не се мъчи с нищо друго..!!

7 юни 200917 г.

Аз имам същия проблем с процесора ето какво ми дава HijackThis моля помогнете ми и на мен че направо незнам какво да права вече компа толко много се бави че мн мн трудно се работи с него.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:58 ч., on 7.6.2009 г.

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\soundman.exe

C:\Program Files\ESET\nod32kui.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Datecs\FlexType 2K\FType2K.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bitcomet.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll

O1 - Hosts: ::1 localhost

O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [bitComet] "C:\Program Files\BitComet\BitComet.exe" /tray

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Policies\Explorer\Run: [Windows Security Tool] WinSecure.exe

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Global Startup: FlexType 2K.lnk = C:\Program Files\Datecs\FlexType 2K\FType2K.exe

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll (file missing)

O13 - Gopher Prefix:

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-09.sun.com/s/ESD7/JSCDL/jdk...ows-i586-jc.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{C98FC91A-8473-49BE-8D8D-6DC88CC21F35}: NameServer = 82.103.123.254

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: nvrsk

O21 - SSODL: vHdaxqUCGS - {CCCC5208-6666-F8A2-F0EF-5A90AFFC2BD6} - C:\Windows\system32\oimp.dll (file missing)

O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--

End of file - 4674 bytes

7 юни 200917 г.

1) Изтеглете ComboFix от: тук

2) Запазете го на работния си плот (десктоп).

3) Изключете Real-Time защитата на ESET NOD32 Antivirus.

4) Кликнете два пъти върху combofix.exe

5) ComboFix ще започне да сканира вашата система, докато трае сканирането не барайте нищо. Накрая ще се рестартира компютъра Ви.

6) След рестарта изчакайте да завърши сканирането на ComboFix и да генерира лог файл. Когато сканирането завърши ще Ви изскочи Notepad, копирайте съдържанието му и го публикувайте в следващия си пост тук. Ако не Ви изскочи, влезте в C:\ и намерете файл с името combofix.txt . Отворете го, копирайте съдържанието му и го публикувайте тук.

8 юни 200917 г.

Ето какво дава след сканране с ComboFix

ComboFix 09-06-07.05 - Krasi 06.2009 г. 13:19.2 - NTFSx86

Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1251.359.1033.18.1023.480 [GMT 3:00]

Running from: c:\users\Krasi\Desktop\ComboFix.exe

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\bitcometres.dll

c:\windows\system32\nvrsk.dll

.

---- Previous Run -------

.

c:\windows\system32\azton.mt

.

((((((((((((((((((((((((( Files Created from 2009-05-08 to 2009-06-08 )))))))))))))))))))))))))))))))

.

2009-06-08 10:23 . 2009-06-08 10:23 -------- d-----w- c:\users\Krasi\AppData\Local\temp

2009-06-08 10:18 . 2009-06-08 10:23 -------- d-s---w- \ComboFix

2009-06-08 08:13 . 2009-06-08 08:15 -------- d-----w- \Qoobox

2009-06-07 18:22 . 2009-06-07 18:22 -------- d-----w- c:\program files\Trend Micro

2009-06-06 14:34 . 2009-06-08 08:34 126976 ----a-w- c:\windows\system32\I00138F6874E6.dll

2009-06-06 14:34 . 2009-06-06 20:08 49152 ----a-w- c:\windows\DHTTPFIXER.dll

2009-06-06 14:34 . 2009-06-06 20:08 35840 ----a-w- c:\windows\FIMFILTER.dll

2009-06-06 14:34 . 2009-06-06 20:08 31232 ----a-w- c:\windows\EWEBFILTER.dll

2009-06-06 14:34 . 2009-06-06 20:08 245760 ----a-w- c:\windows\CINTERCEPTOR.dll

2009-06-06 14:34 . 2009-06-06 14:34 -------- d-----w- c:\windows\system32\coredb

2009-06-06 14:34 . 2009-06-06 20:08 98304 ----a-w- c:\windows\BCOREDB.dll

2009-06-06 14:34 . 2009-06-06 20:08 62976 ----a-w- c:\windows\AModCom.dll

2009-06-03 16:34 . 2009-06-03 16:34 -------- d-----w- c:\users\Krasi\AppData\Local\Winamp Toolbar

2009-05-20 13:05 . 2009-05-20 13:05 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-06-08 10:17 . 2009-04-17 19:29 1386831872 --sha-w- \pagefile.sys

2009-06-08 08:31 . 2009-04-17 12:13 -------- d-----w- c:\users\Krasi\AppData\Roaming\Skype

2009-06-08 08:31 . 2009-04-17 11:13 -------- d-----w- c:\program files\ESET

2009-06-08 08:30 . 2009-04-18 09:05 12 ----a-w- c:\windows\bthservsdp.dat

2009-06-07 13:25 . 2009-04-17 10:02 -------- d-----w- c:\program files\FlashGet

2009-06-07 12:44 . 2009-04-17 11:33 -------- d-----w- c:\program files\Spyware Doctor

2009-06-07 05:02 . 2009-04-17 14:14 -------- d-----w- c:\program files\HLSW

2009-06-06 17:31 . 2009-04-17 10:48 -------- d-----w- c:\users\Krasi\AppData\Roaming\uTorrent

2009-06-06 15:57 . 2009-04-17 10:49 -------- d-----w- c:\program files\uTorrent

2009-05-30 18:18 . 2009-05-09 09:36 -------- d-----w- c:\program files\BitComet

2009-05-25 17:43 . 2009-05-05 12:41 -------- d-----w- c:\program files\CSConfigurator

2009-05-23 12:11 . 2009-05-23 12:11 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf

2009-05-05 15:14 . 2009-04-17 09:39 50088 ----a-w- c:\users\Krasi\AppData\Local\GDIPFONTCACHEV1.DAT

2009-04-25 09:47 . 2009-04-22 15:16 -------- d-----w- c:\program files\DAEMON Tools

2009-04-23 13:54 . 2009-04-23 13:50 -------- d-----w- c:\program files\PhotoScape

2009-04-23 09:39 . 2009-04-17 11:10 -------- d-----w- c:\program files\Common Files\InstallShield

2009-04-23 09:39 . 2009-04-17 09:55 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-04-23 09:22 . 2009-04-23 09:22 -------- d-----w- c:\programdata\ATI

2009-04-23 09:20 . 2009-04-23 09:20 -------- d-----w- c:\program files\My Company Name

2009-04-23 09:19 . 2009-04-23 09:17 -------- d-----w- c:\program files\ATI Technologies

2009-04-23 09:19 . 2009-04-23 09:19 9158 ----a-r- c:\users\Krasi\AppData\Roaming\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe

2009-04-23 09:19 . 2009-04-23 09:19 -------- d-----w- c:\program files\Common Files\ATI Technologies

2009-04-23 09:18 . 2009-04-23 09:18 -------- d-----w- c:\program files\ATI

2009-04-23 09:10 . 2009-04-17 09:38 680 ----a-w- c:\users\Krasi\AppData\Local\d3d9caps.dat

2009-04-22 15:33 . 2009-04-22 15:23 -------- d-----w- c:\programdata\NFS Underground

2009-04-22 14:06 . 2009-04-22 14:05 -------- d-----w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab

2009-04-22 14:05 . 2009-04-17 11:49 -------- d-----w- c:\program files\SystemRequirementsLab

2009-04-22 14:05 . 2009-04-22 14:05 207872 ----a-w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4.dll

2009-04-22 14:05 . 2009-04-22 14:05 207872 ----a-w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_3.dll

2009-04-22 14:05 . 2009-04-22 14:05 207872 ----a-w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_2.dll

2009-04-22 14:05 . 2009-04-22 14:05 207872 ----a-w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_1.dll

2009-04-22 10:31 . 2009-04-22 10:31 -------- d-----w- c:\program files\K-Lite Codec Pack

2009-04-20 11:44 . 2009-04-20 11:44 -------- d-----w- c:\users\Krasi\AppData\Roaming\Media Player Classic

2009-04-17 16:33 . 2009-04-17 16:32 -------- d-----w- c:\program files\Skype

2009-04-17 16:33 . 2009-04-17 12:13 -------- d-----w- c:\programdata\Skype

2009-04-17 16:32 . 2009-04-17 16:32 -------- d-----w- c:\program files\Common Files\Skype

2009-04-17 16:23 . 2009-04-17 16:23 -------- d-----w- c:\program files\Ahead

2009-04-17 16:23 . 2009-04-17 16:23 -------- d-----w- c:\program files\Common Files\Ahead

2009-04-17 13:37 . 2009-04-17 12:23 -------- d-----w- c:\users\Krasi\AppData\Roaming\Winamp

2009-04-17 13:02 . 2009-04-17 12:14 -------- d-----w- c:\users\Krasi\AppData\Roaming\skypePM

2009-04-17 12:32 . 2009-04-17 12:23 -------- d-----w- c:\program files\Winamp

2009-04-17 12:29 . 2009-04-17 12:29 611064 ----a-w- c:\windows\system32\drivers\sptd.sys

2009-04-17 12:29 . 2009-04-17 12:29 142904 ----a-w- c:\windows\system32\drivers\sptddrv1.sys

2009-04-17 12:29 . 2009-04-17 12:29 -------- d-----w- c:\program files\Datecs

2009-04-17 12:26 . 2009-04-17 12:26 -------- d-----w- c:\programdata\DFX

2009-04-17 12:26 . 2009-04-17 12:26 -------- d-----w- c:\program files\DFX

2009-04-17 12:23 . 2009-04-17 12:23 -------- d-----w- c:\program files\Winamp Toolbar

2009-04-17 12:23 . 2009-04-17 12:23 -------- d-----w- c:\programdata\Winamp Toolbar

2009-04-17 12:14 . 2009-04-17 12:14 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2009-04-17 12:08 . 2009-04-17 12:08 7680 ----a-w- c:\users\Krasi\AppData\Roaming\Thinstall\SkypePortable\400000150a00002i\Skype.exe

2009-04-17 12:07 . 2009-04-17 12:07 -------- d-----w- c:\users\Krasi\AppData\Roaming\Thinstall

2009-04-17 12:00 . 2009-04-17 12:00 0 ----a-w- c:\windows\nsreg.dat

2009-04-17 11:48 . 2009-04-17 11:48 410984 ----a-w- c:\windows\system32\deploytk.dll

2009-04-17 11:48 . 2009-04-17 11:48 -------- d-----w- c:\program files\Java

2009-04-17 11:38 . 2009-04-17 11:18 37888 ----a-w- c:\windows\system32\rar.exe

2009-04-17 11:33 . 2009-04-17 11:33 -------- d-----w- c:\users\Krasi\AppData\Roaming\PC Tools

2009-04-17 11:29 . 2009-04-17 11:29 -------- d-----w- c:\users\Krasi\AppData\Roaming\GetRightToGo

2009-04-17 11:11 . 2009-04-17 11:11 -------- d-----w- c:\program files\Realtek Sound Manager

2009-04-17 11:11 . 2009-04-17 11:11 -------- d-----w- c:\program files\AvRack

2009-04-17 11:03 . 2009-04-17 11:03 -------- d-----w- c:\users\Krasi\AppData\Roaming\ATI

2009-04-17 11:02 . 2009-04-17 11:02 0 ----a-w- c:\windows\ativpsrm.bin

2009-04-17 10:44 . 2009-04-17 10:44 147456 ----a-w- c:\windows\system32\nvtpm32.dll

2009-04-17 10:10 . 2009-04-17 10:10 -------- d-----w- c:\program files\1PC Drivers HeadQuarters

2009-04-17 10:02 . 2009-04-17 10:02 -------- d-----w- c:\users\Krasi\AppData\Roaming\FlashGet

2009-04-17 09:54 . 2009-04-17 09:54 -------- d-----w- c:\programdata\PC Drivers HeadQuarters

2009-04-17 09:54 . 2009-04-17 09:54 -------- d-----w- c:\program files\PC Drivers HeadQuarters

2009-03-16 11:18 . 2009-06-06 17:39 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll

2009-03-16 11:18 . 2009-06-06 17:39 517448 ----a-w- c:\windows\system32\XAudio2_4.dll

2009-03-16 11:18 . 2009-06-06 17:39 235352 ----a-w- c:\windows\system32\xactengine3_4.dll

2009-03-16 11:18 . 2009-06-06 17:39 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-05-28 23458344]

"BitComet"="c:\program files\BitComet\BitComet.exe" [2007-11-07 1881400]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-17 148888]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-09-14 157592]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]

"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2005-05-17 77824]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2009-4-17 95232]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3950373857-1089411189-3887508328-1000]

"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"TCP Query User{8168822E-00E0-4400-8206-41B4DFEBBC8E}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet

"UDP Query User{3DBCFF37-09B8-464B-9F74-EE752D8BD8F9}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet

"TCP Query User{34C8599D-8DA7-4FF0-B2E7-00BEE8448E6F}c:\\users\\krasi\\desktop\\crack_driver.detective.6.3.3.0.exe"= UDP:c:\users\krasi\desktop\crack_driver.detective.6.3.3.0.exe:crack_driver.detective.6.3.3.0.exe

"UDP Query User{8D190404-EA00-4C83-B054-6BA37E104D93}c:\\users\\krasi\\desktop\\crack_driver.detective.6.3.3.0.exe"= TCP:c:\users\krasi\desktop\crack_driver.detective.6.3.3.0.exe:crack_driver.detective.6.3.3.0.exe

"{7F1DB835-81B2-47CC-8E9C-ED0691D8488D}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)

"{4758E54C-7833-4BC0-AB50-48DE367A091C}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)

"{4998E113-6844-4D71-B252-C49ACE28E9D5}"= c:\users\Krasi\Desktop\SkypePortable\App\Skype\Phone\Skype.exe:Skype

"TCP Query User{EB485B82-144E-4C93-80E7-84AB21DC85A8}c:\\users\\krasi\\appdata\\roaming\\thinstall\\skypeportable\\400000150a00002i\\skype.exe"= UDP:c:\users\krasi\appdata\roaming\thinstall\skypeportable\400000150a00002i\skype.exe:skype.exe

"UDP Query User{43331614-0A1F-402B-8EE7-B9A01011F4E9}c:\\users\\krasi\\appdata\\roaming\\thinstall\\skypeportable\\400000150a00002i\\skype.exe"= TCP:c:\users\krasi\appdata\roaming\thinstall\skypeportable\400000150a00002i\skype.exe:skype.exe

"TCP Query User{A896B0B1-DA09-4AB8-A829-A926D5D28F56}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype

"TCP Query User{01A71FFB-0207-4DC8-B39F-B406F4653336}c:\\program files\\hlsw\\hlsw.exe"= UDP:c:\program files\hlsw\hlsw.exe:HLSW

"UDP Query User{25C7B4C9-827B-4A5A-9A4D-7212D77B2F7A}c:\\program files\\hlsw\\hlsw.exe"= TCP:c:\program files\hlsw\hlsw.exe:HLSW

"TCP Query User{0F6D0A44-7F91-4EB2-863E-4B0BA1E0FE03}d:\\games\\sierra\\half-life\\hl.exe"= UDP:d:\games\sierra\half-life\hl.exe:Half-Life Launcher

"UDP Query User{8322EB21-46FD-463F-B6DF-71CE9AAC9BDF}d:\\games\\sierra\\half-life\\hl.exe"= TCP:d:\games\sierra\half-life\hl.exe:Half-Life Launcher

"TCP Query User{305C6423-DF31-482F-9ACB-423AD4F1CFB6}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet

"UDP Query User{862B7C93-1A9E-487D-BB1F-1A15B96325F5}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet

"TCP Query User{49B60488-1893-4306-8F0A-819B5ABE8EE2}d:\\games\\diablo ii\\game.exe"= UDP:d:\games\diablo ii\game.exe:Diablo II

"UDP Query User{2F6B8650-0720-44B1-AA2C-7ECD37CBC1AC}d:\\games\\diablo ii\\game.exe"= TCP:d:\games\diablo ii\game.exe:Diablo II

"TCP Query User{F3308F5A-520D-4621-9BCF-16F823F4D936}d:\\games\\sierra\\sierra\\half-life\\hl.exe"= UDP:d:\games\sierra\sierra\half-life\hl.exe:Half-Life Launcher

"UDP Query User{FBA9B6A2-C4AF-40B7-AF9F-AB0CC632B0FA}d:\\games\\sierra\\sierra\\half-life\\hl.exe"= TCP:d:\games\sierra\sierra\half-life\hl.exe:Half-Life Launcher

"{560B5F64-6370-4CB9-AA70-F34E90853884}"= UDP:9886:BitComet 9886 TCP

"{404FB38A-19FE-4048-9941-CC5D05D8CBEF}"= TCP:9886:BitComet 9886 UDP

"TCP Query User{D2A63A50-8FE4-4045-8FA9-9CDECD079E1D}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client

"UDP Query User{48E62777-366A-4B41-88D0-C56709742CF6}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client

"{F2BEC1A5-DC5B-4EEC-A877-8BDEB50D7812}"= UDP:9886:BitComet 9886 TCP

"{519146DE-04F1-438D-ADA7-E06F72281A93}"= TCP:9886:BitComet 9886 UDP

"{59C822BE-4D4D-4506-86E3-A0DD0973BA10}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.8.9506-to-3.0.9.9551-enUS-downloader.exe:Blizzard Downloader

"{844275EC-E985-4C94-BA2D-DEEC88BB3B14}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.8.9506-to-3.0.9.9551-enUS-downloader.exe:Blizzard Downloader

"{4E3E976E-5F0D-4BAE-8C1E-CE82C7C3BE80}"= UDP:3724:Blizzard Downloader: 3724

"TCP Query User{6B059089-BA4D-4D04-84D3-B453DA714D5F}d:\\downloads\\world of warcraft wrath of the lich king\\launcher.exe"= UDP:d:\downloads\world of warcraft wrath of the lich king\launcher.exe:Blizzard Launcher

"UDP Query User{5D3C5F8F-45C6-4BA7-8590-0DFD26717A17}d:\\downloads\\world of warcraft wrath of the lich king\\launcher.exe"= TCP:d:\downloads\world of warcraft wrath of the lich king\launcher.exe:Blizzard Launcher

"{B206F6D8-5A8E-411A-AA68-43719BB2589D}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe:Blizzard Downloader

"{7936A227-77C0-4282-B1F8-EEBAD7E6FFF0}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe:Blizzard Downloader

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [4/17/2009 2:33 PM 356920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs REG_MULTI_SZ BthServ

.

- - - - ORPHANS REMOVED - - - -

SSODL-vHdaxqUCGS-{CCCC5208-6666-F8A2-F0EF-5A90AFFC2BD6} - c:\windows\system32\oimp.dll

SafeBoot-procexp90.Sys

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.bitcomet.com/

IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

TCP: {C98FC91A-8473-49BE-8D8D-6DC88CC21F35} = 82.103.123.254

FF - ProfilePath - c:\users\Krasi\AppData\Roaming\Mozilla\Firefox\Profiles\w6y80hb7.default\

FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=

FF - prefs.js: browser.search.selectedEngine - Winamp Search

FF - prefs.js: browser.startup.homepage - hxxp://google.bg

FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-06-08 13:23

Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Completion time: 2009-06-08 13:25

ComboFix-quarantined-files.txt 2009-06-08 10:25

Pre-Run: 14 634 479 616 bytes free

Post-Run: 14 674 964 480 bytes free

212

8 юни 200917 г.

Сега, изтеглете ATF Cleaner

Запазете го на вашия десктоп.

Кликнете два пъти върху ATF-Cleaner.exe , за да стартирате програмата.
Кликнете на Select All, който се намира в най-долната част на списъка.
Кликнете на бутона Empty Selected.

Ако използвате браузъра Mozilla Firefox, направете следното:

Кликнете върху Firefox, който се намира в началото и изберете Select All от списъка.
Кликнете на бутона Empty Selected.
Бележка: Ако искате да съхраните запазените пароли, моля кликнете на No от новопоявилия се прозорец.

Ако използвате браузъра Opera, направете следното:

Кликнете върху Opera който се намира в началото и изберете Select All от списъка.
Кликнете на бутона Empty Selected.
Бележка: Ако искате да съхраните запазените пароли, моля кликнете на No от новопоявилия се прозорец.

Кликнете на бутона Exit, който се намира в главното меню, за да затворите програмата.

Отворете Notepad и чрез copy/paste поставете следното:

KillAll::


File::

c:\windows\system32\rar.exe

c:\windows\system32\nvtpm32.dll


Registry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

@=-

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"TCP Query User{34C8599D-8DA7-4FF0-B2E7-00BEE8448E6F}c:\\users\\krasi\\desktop\\crack_driver.detective.6.3.3.0.exe"=-

"UDP Query User{8D190404-EA00-4C83-B054-6BA37E104D93}c:\\users\\krasi\\desktop\\crack_driver.detective.6.3.3.0.exe"=-

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След, като програмата приключи ще Ви изведе лог файла. Чрез Copy/Paste поставете информацията тук.

Изтеглете Malwarebytes' Anti-Malware от тук

Кликнете два пъти върху mbam-setup.exe за да инсталирате програмата.

* Уверете се, че има отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware, след това кликнете на Finish.
* Ако има намерени по-нови обновления, тя ще ги изтегли и инсталира.
* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
* Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
* Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
* Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Бележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемите вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Накрая очаквам лог файлове от ComboFix и MalwareBytes' Anti-Malware.

8 юни 200917 г.

Ето от ComboFix

ComboFix 09-06-07.05 - Krasi 06.2009 г. 16:30.1 - NTFSx86

Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1251.359.1033.18.1023.507 [GMT 3:00]

Running from: c:\users\Krasi\Desktop\ComboFix.exe

Command switches used :: c:\users\Krasi\Desktop\CFScript.txt

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::

"c:\windows\system32\nvtpm32.dll"

"c:\windows\system32\rar.exe"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\nvtpm32.dll

c:\windows\system32\rar.exe

.

((((((((((((((((((((((((( Files Created from 2009-05-08 to 2009-06-08 )))))))))))))))))))))))))))))))

.

2009-06-08 13:34 . 2009-06-08 13:34 2560 ----a-w- c:\windows\system32\bitcometres.dll

2009-06-08 13:33 . 2009-06-08 13:34 -------- d-----w- c:\users\Krasi\AppData\Local\temp

2009-06-08 13:33 . 2009-06-08 13:33 -------- d-----w- C:\temp

2009-06-08 13:33 . 2009-06-08 13:33 -------- d-----w- \temp

2009-06-08 13:28 . 2009-06-08 13:34 -------- d-s---w- \ComboFix

2009-06-08 08:13 . 2009-06-08 13:29 -------- d-----w- \Qoobox