Анализ на логове от OTL.exe [РЕШЕН]

31 януари 201016 г.

Здравеите

Аз имам подобен проблем , но ми забранява да ползвам и таск манагер-а

ще сам мн благодарен ако ми помогнете

качвам това от което има нужда до колкото разбрах ако има още нещо

кажете само какво е то...

OTL.Txt

Extras.Txt

31 януари 201016 г.

СТЪПКА 1

Стартирайте OTL.exe и copy/paste под колонката "Custom Scans/Fixes" въведете това:

(Копирайте скрипта 1 към 1 като не забравяте двете точки преди OTL) !

:OTL
PRC - C:\Documents and Settings\a\Local Settings\Temp\nnsyfr.exe ()
PRC - C:\Documents and Settings\a\Local Settings\Temp\crlgcdvqmdbjsjmecroah.exe ()
DRV - (abp470n5) -- File not found
O4 - HKLM..\Run: [zdmwhxeozf] C:\WINDOWS\System32\pbskdbqibpkpvjjytf.exe ()
O4 - HKLM..\Run: [zjyofboevhadhtre] C:\Documents and Settings\a\Local Settings\Temp\grhyqnbskxrvanmau.exe ()
O4 - HKU\S-1-5-21-2025429265-796845957-1177238915-1003..\Run: [qxjwkdnaoxnno] C:\WINDOWS\System32\zjyofboevhadhtre.exe ()
O4 - HKU\S-1-5-21-2025429265-796845957-1177238915-1003..\Run: [zdmwhxeozf] C:\Documents and Settings\a\Local Settings\Temp\zjyofboevhadhtre.exe ()
O4 - HKLM..\RunOnce: [udrgwrdsitlnqby] C:\Documents and Settings\a\Local Settings\Temp\crlgcdvqmdbjsjmecroah.exe ()
O4 - HKLM..\RunOnce: [uzjugxfqcjx] C:\WINDOWS\System32\grhyqnbskxrvanmau.exe ()
O4 - HKU\S-1-5-21-2025429265-796845957-1177238915-1003..\RunOnce: [rzmapjuixhyzbl] C:\WINDOWS\System32\pbskdbqibpkpvjjytf.exe ()
O4 - HKU\S-1-5-21-2025429265-796845957-1177238915-1003..\RunOnce: [uzjugxfqcjx] C:\Documents and Settings\a\Local Settings\Temp\zjyofboevhadhtre.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: rxiuhziuhped = zjyofboevhadhtre.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: gjrakzfoy = C:\DOCUME~1\a\LOCALS~1\Temp\grhyqnbskxrvanmau.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\S-1-5-21-2025429265-796845957-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O32 - AutoRun File - [2010.01.28 15:30:19 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010.01.31 17:42:22 | 000,000,834 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2008.04.14 14:00:00 | 000,095,034 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010.01.31 17:42:38 | 000,000,843 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010.01.31 17:42:40 | 000,000,767 | RHS- | M] () - F:\autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{2abbff39-0c12-11df-8fe5-0001020651fd}\Shell\autoPLaY\CommanD - "" = H:\yybki.cmd -- File not found
O33 - MountPoints2\{2abbff39-0c12-11df-8fe5-0001020651fd}\Shell\AutoRun\command - "" = H:\yybki.cmd -- File not found
O33 - MountPoints2\{2abbff39-0c12-11df-8fe5-0001020651fd}\Shell\ExplOre\Command - "" = H:\yybki.cmd -- File not found
O33 - MountPoints2\{2abbff39-0c12-11df-8fe5-0001020651fd}\Shell\OpEN\Command - "" = H:\yybki.cmd -- File not found
[2010.01.31 18:39:03 | 000,002,408 | -H-- | M] () -- C:\WINDOWS\udrgwrdsitlnqbykclcijsmrafocrhcodtewy.mjv
[2010.01.31 18:39:03 | 000,002,408 | -H-- | M] () -- C:\WINDOWS\System32\udrgwrdsitlnqbykclcijsmrafocrhcodtewy.mjv
[2010.01.31 18:39:03 | 000,002,408 | -H-- | M] () -- C:\Program Files\udrgwrdsitlnqbykclcijsmrafocrhcodtewy.mjv
[2010.01.31 18:39:03 | 000,002,408 | -H-- | M] () -- C:\Documents and Settings\a\Local Settings\Application Data\udrgwrdsitlnqbykclcijsmrafocrhcodtewy.mjv
[2010.01.31 18:39:03 | 000,000,280 | -H-- | M] () -- C:\WINDOWS\cbfkqbdiopxpijwygfmizyidcxw.flw
[2010.01.31 18:39:03 | 000,000,280 | -H-- | M] () -- C:\Program Files\cbfkqbdiopxpijwygfmizyidcxw.flw
[2010.01.31 18:39:03 | 000,000,280 | -H-- | M] () -- C:\Documents and Settings\a\Local Settings\Application Data\cbfkqbdiopxpijwygfmizyidcxw.flw
[2010.01.31 18:38:41 | 000,000,280 | -H-- | M] () -- C:\WINDOWS\System32\cbfkqbdiopxpijwygfmizyidcxw.flw
[2010.01.31 18:37:47 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\tjeaxzsoldclvnrkjzxksi.exe
[2010.01.31 18:37:47 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\crlgcdvqmdbjsjmecroah.exe
[2010.01.31 18:37:46 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\pbskdbqibpkpvjjytf.exe
[2010.01.31 18:37:46 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\nbuojjaupfcjrhjaxlhs.exe
[2010.01.31 18:37:46 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\anfysrhaujflshiyuhc.exe
[2010.01.31 18:37:45 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\zjyofboevhadhtre.exe
[2010.01.31 18:37:45 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\grhyqnbskxrvanmau.exe
[2010.01.31 17:40:46 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\System32\tjeaxzsoldclvnrkjzxksi.exe
[2010.01.31 17:40:46 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\System32\nbuojjaupfcjrhjaxlhs.exe
[2010.01.31 17:40:46 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\System32\crlgcdvqmdbjsjmecroah.exe
[2010.01.31 17:40:45 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\System32\zjyofboevhadhtre.exe
[2010.01.31 17:40:45 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\System32\pbskdbqibpkpvjjytf.exe
[2010.01.31 17:40:45 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\System32\grhyqnbskxrvanmau.exe
[2010.01.31 15:00:07 | 000,655,360 | RHS- | M] () -- C:\WINDOWS\System32\anfysrhaujflshiyuhc.exe
[2010.01.28 17:13:37 | 000,004,248 | -H-- | M] () -- C:\WINDOWS\zjyofboevhadhtrexhzgisntdjtiyplyofrknr.boh
[2010.01.28 17:13:37 | 000,004,248 | -H-- | M] () -- C:\WINDOWS\System32\zjyofboevhadhtrexhzgisntdjtiyplyofrknr.boh
[2010.01.28 17:13:37 | 000,004,248 | -H-- | M] () -- C:\Program Files\zjyofboevhadhtrexhzgisntdjtiyplyofrknr.boh
[2010.01.28 17:13:37 | 000,004,248 | -H-- | M] () -- C:\Documents and Settings\a\Local Settings\Application Data\zjyofboevhadhtrexhzgisntdjtiyplyofrknr.boh
:files
C:\Documents and Settings\a\Local Settings\Temp\nnsyfr.exe
C:\Documents and Settings\a\Local Settings\Temp\crlgcdvqmdbjsjmecroah.exe
C:\WINDOWS\*.tmp
C:\WINDOWS\System32\*.tmp
C:\RECYCLER
:reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"H:\yybki.cmd" =-
"G:\DRIVER\XP\8.62\setup.exe" =-
"C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\IKernel.exe" =-
"C:\DOCUME~1\a\LOCALS~1\Temp\crlgcdvqmdbjsjmecroah.exe" =-
"C:\WINDOWS\system32\zjyofboevhadhtre.exe" =-
"C:\DOCUME~1\a\LOCALS~1\Temp\grhyqnbskxrvanmau.exe" =-
"C:\DOCUME~1\a\LOCALS~1\Temp\rpovowkpceb.exe" =-
"C:\WINDOWS\system32\anfysrhaujflshiyuhc.exe" =-
"C:\DOCUME~1\a\LOCALS~1\Temp\nbuojjaupfcjrhjaxlhs.exe" =-
"C:\WINDOWS\system32\nbuojjaupfcjrhjaxlhs.exe" =-
"C:\DOCUME~1\a\LOCALS~1\Temp\pbskdbqibpkpvjjytf.exe" =-
"C:\WINDOWS\system32\crlgcdvqmdbjsjmecroah.exe" =-
"C:\DOCUME~1\a\LOCALS~1\Temp\nnsyfr.exe" =-
"C:\DOCUME~1\a\LOCALS~1\Temp\zjyofboevhadhtre.exe" =-
:Commands
[purity]
[emptytemp]
[resethosts]
[Reboot]

Натиснете бутона Run Fix

Ще се създаде лог файл. Копирайте го в следващия си пост.

СТЪПКА 2

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

Remove found threats
Scan archives
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth technology

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост тук.

31 януари 201016 г.

Автор

All processes killed

========== OTL ==========

Process nnsyfr.exe killed successfully!

No active process named crlgcdvqmdbjsjmecroah.exe was found!

Error: Unable to stop service abp470n5!

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\abp470n5 deleted successfully.

File File not found not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\zdmwhxeozf deleted successfully.

C:\WINDOWS\system32\pbskdbqibpkpvjjytf.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\zjyofboevhadhtre deleted successfully.

File C:\Documents and Settings\a\Local Settings\Temp\grhyqnbskxrvanmau.exe not found.

Registry value HKEY_USERS\S-1-5-21-2025429265-796845957-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Run\\qxjwkdnaoxnno deleted successfully.

C:\WINDOWS\system32\zjyofboevhadhtre.exe moved successfully.

Registry value HKEY_USERS\S-1-5-21-2025429265-796845957-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Run\\zdmwhxeozf deleted successfully.

File C:\Documents and Settings\a\Local Settings\Temp\zjyofboevhadhtre.exe not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\udrgwrdsitlnqby deleted successfully.

File C:\Documents and Settings\a\Local Settings\Temp\crlgcdvqmdbjsjmecroah.exe not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\uzjugxfqcjx deleted successfully.

C:\WINDOWS\system32\grhyqnbskxrvanmau.exe moved successfully.

Registry value HKEY_USERS\S-1-5-21-2025429265-796845957-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\rzmapjuixhyzbl deleted successfully.

File C:\WINDOWS\System32\pbskdbqibpkpvjjytf.exe not found.

Registry value HKEY_USERS\S-1-5-21-2025429265-796845957-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\uzjugxfqcjx deleted successfully.

File C:\Documents and Settings\a\Local Settings\Temp\zjyofboevhadhtre.exe not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\rxiuhziuhped deleted successfully.

C:\WINDOWS\zjyofboevhadhtre.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\gjrakzfoy deleted successfully.

File C:\DOCUME~1\a\LOCALS~1\Temp\grhyqnbskxrvanmau.exe not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2025429265-796845957-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.

File C:\AUTOEXEC.BAT not found.

C:\autorun.inf moved successfully.

D:\autorun.inf moved successfully.

E:\autorun.inf moved successfully.

F:\autorun.inf moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2abbff39-0c12-11df-8fe5-0001020651fd}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2abbff39-0c12-11df-8fe5-0001020651fd}\ not found.

File H:\yybki.cmd not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2abbff39-0c12-11df-8fe5-0001020651fd}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2abbff39-0c12-11df-8fe5-0001020651fd}\ not found.

File H:\yybki.cmd not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2abbff39-0c12-11df-8fe5-0001020651fd}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2abbff39-0c12-11df-8fe5-0001020651fd}\ not found.

File H:\yybki.cmd not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2abbff39-0c12-11df-8fe5-0001020651fd}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2abbff39-0c12-11df-8fe5-0001020651fd}\ not found.

File H:\yybki.cmd not found.

C:\WINDOWS\udrgwrdsitlnqbykclcijsmrafocrhcodtewy.mjv moved successfully.

C:\WINDOWS\system32\udrgwrdsitlnqbykclcijsmrafocrhcodtewy.mjv moved successfully.

C:\Program Files\udrgwrdsitlnqbykclcijsmrafocrhcodtewy.mjv moved successfully.

C:\Documents and Settings\a\Local Settings\Application Data\udrgwrdsitlnqbykclcijsmrafocrhcodtewy.mjv moved successfully.

C:\WINDOWS\cbfkqbdiopxpijwygfmizyidcxw.flw moved successfully.

C:\Program Files\cbfkqbdiopxpijwygfmizyidcxw.flw moved successfully.

C:\Documents and Settings\a\Local Settings\Application Data\cbfkqbdiopxpijwygfmizyidcxw.flw moved successfully.

C:\WINDOWS\system32\cbfkqbdiopxpijwygfmizyidcxw.flw moved successfully.

C:\WINDOWS\tjeaxzsoldclvnrkjzxksi.exe moved successfully.

C:\WINDOWS\crlgcdvqmdbjsjmecroah.exe moved successfully.

C:\WINDOWS\pbskdbqibpkpvjjytf.exe moved successfully.

C:\WINDOWS\nbuojjaupfcjrhjaxlhs.exe moved successfully.

C:\WINDOWS\anfysrhaujflshiyuhc.exe moved successfully.

File C:\WINDOWS\zjyofboevhadhtre.exe not found.

C:\WINDOWS\grhyqnbskxrvanmau.exe moved successfully.

C:\WINDOWS\system32\tjeaxzsoldclvnrkjzxksi.exe moved successfully.

C:\WINDOWS\system32\nbuojjaupfcjrhjaxlhs.exe moved successfully.

C:\WINDOWS\system32\crlgcdvqmdbjsjmecroah.exe moved successfully.

File C:\WINDOWS\System32\zjyofboevhadhtre.exe not found.

File C:\WINDOWS\System32\pbskdbqibpkpvjjytf.exe not found.

File C:\WINDOWS\System32\grhyqnbskxrvanmau.exe not found.

C:\WINDOWS\system32\anfysrhaujflshiyuhc.exe moved successfully.

C:\WINDOWS\zjyofboevhadhtrexhzgisntdjtiyplyofrknr.boh moved successfully.

C:\WINDOWS\system32\zjyofboevhadhtrexhzgisntdjtiyplyofrknr.boh moved successfully.

C:\Program Files\zjyofboevhadhtrexhzgisntdjtiyplyofrknr.boh moved successfully.

C:\Documents and Settings\a\Local Settings\Application Data\zjyofboevhadhtrexhzgisntdjtiyplyofrknr.boh moved successfully.

========== FILES ==========

File\Folder C:\Documents and Settings\a\Local Settings\Temp\nnsyfr.exe not found.

File\Folder C:\Documents and Settings\a\Local Settings\Temp\crlgcdvqmdbjsjmecroah.exe not found.

File\Folder C:\WINDOWS\*.tmp not found.

File\Folder C:\WINDOWS\System32\*.tmp not found.

C:\RECYCLER\S-1-5-21-2025429265-796845957-1177238915-1003 folder moved successfully.

C:\RECYCLER folder moved successfully.

========== REGISTRY ==========

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\H:\yybki.cmd not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\G:\DRIVER\XP\8.62\setup.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\IKernel.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\DOCUME~1\a\LOCALS~1\Temp\crlgcdvqmdbjsjmecroah.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\zjyofboevhadhtre.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\DOCUME~1\a\LOCALS~1\Temp\grhyqnbskxrvanmau.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\DOCUME~1\a\LOCALS~1\Temp\rpovowkpceb.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\anfysrhaujflshiyuhc.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\DOCUME~1\a\LOCALS~1\Temp\nbuojjaupfcjrhjaxlhs.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\nbuojjaupfcjrhjaxlhs.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\DOCUME~1\a\LOCALS~1\Temp\pbskdbqibpkpvjjytf.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\crlgcdvqmdbjsjmecroah.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\DOCUME~1\a\LOCALS~1\Temp\nnsyfr.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\DOCUME~1\a\LOCALS~1\Temp\zjyofboevhadhtre.exe deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: a

->Temp folder emptied: 876540 bytes

->Temporary Internet Files folder emptied: 1995134 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 3,00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

OTL by OldTimer - Version 3.1.27.1 log created on 01312010_203149

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

31 януари 201016 г.

А сега направи и СТЪПКА 2

31 януари 201016 г.

Автор

А сега направи и СТЪПКА 2

ще я направя само да успея да изтегля есет... стига до 52% и до там

31 януари 201016 г.

Стартирайте файла с двукратен клик на мишката.

Направете следните настройки:

Под "Custom Scans/Fixes" с copy/paste въведете следната информация:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%SYSTEMDRIVE%\*.*

/md5start

d3d8thk.dll

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

sceclt.dll

ntelogon.dll

logevent.dll

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

nvrd32.sys

/md5stop

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%PROGRAMFILES%\*.

%userprofile%\Desktop\*.*

%userprofile%\Desktop\*.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

Натиснете Run Scan.

Като приключи проверката публикувайте двата лог файла - OTL.Txt и Extras.Txt.

31 януари 201016 г.

Автор

това са

а за това че писах в предната тема се извинявам просто не ми позволява да видя подтемата

като отворя на нея страница и ми затваря експлорера ..

Extras.Txt

OTL.Txt

31 януари 201016 г.

СТЪПКА 1

Стартирайте OTL.exe и copy/paste под колонката "Custom Scans/Fixes" въведете това:

(Копирайте скрипта 1 към 1 като не забравяте двете точки преди OTL) !

:OTL
PRC - C:\WINDOWS\svchost.exe ()
SRV - (PowerManager) -- C:\WINDOWS\svchost.exe ()
DRV - (abp470n5) -- File not found
O7 - HKU\S-1-5-21-2025429265-796845957-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\S-1-5-21-2025429265-796845957-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O32 - AutoRun File - [2008.04.14 14:00:00 | 000,095,034 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2008.04.14 12:00:00 | 000,000,263 | RHS- | M] () - I:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{20ac693b-0c1f-11df-b16f-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{20ac693b-0c1f-11df-b16f-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2abbff39-0c12-11df-8fe5-0001020651fd}\Shell\autoPLaY\CommanD - "" = I:\yybki.cmd -- [2010.01.28 13:57:30 | 000,171,519 | RHS- | M] (Microsoft Corporation)
O33 - MountPoints2\{2abbff39-0c12-11df-8fe5-0001020651fd}\Shell\AutoRun\command - "" = I:\yybki.cmd -- [2010.01.28 13:57:30 | 000,171,519 | RHS- | M] (Microsoft Corporation)
O33 - MountPoints2\{2abbff39-0c12-11df-8fe5-0001020651fd}\Shell\ExplOre\Command - "" = I:\yybki.cmd -- [2010.01.28 13:57:30 | 000,171,519 | RHS- | M] (Microsoft Corporation)
O33 - MountPoints2\{2abbff39-0c12-11df-8fe5-0001020651fd}\Shell\OpEN\Command - "" = I:\yybki.cmd -- [2010.01.28 13:57:30 | 000,171,519 | RHS- | M] (Microsoft Corporation)
[2010.01.31 20:24:23 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\System32\pbskdbqibpkpvjjytfzimyvdpxjasljyqjxsxdrr.bnh
[2010.01.31 20:24:23 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\pbskdbqibpkpvjjytfzimyvdpxjasljyqjxsxdrr.bnh
[2010.01.31 20:24:23 | 000,000,316 | -H-- | M] () -- C:\Program Files\pbskdbqibpkpvjjytfzimyvdpxjasljyqjxsxdrr.bnh
[2010.01.31 20:24:23 | 000,000,316 | -H-- | M] () -- C:\Documents and Settings\a\Local Settings\Application Data\pbskdbqibpkpvjjytfzimyvdpxjasljyqjxsxdrr.bnh
[2010.01.31 20:08:23 | 000,000,073 | -H-- | M] () -- C:\WINDOWS\System32\anfysrhaujflshiyuhcmreclyhumfzyohbqmszopf.ojt
[2010.01.31 20:08:23 | 000,000,073 | -H-- | M] () -- C:\WINDOWS\anfysrhaujflshiyuhcmreclyhumfzyohbqmszopf.ojt
[2010.01.31 20:08:23 | 000,000,073 | -H-- | M] () -- C:\Program Files\anfysrhaujflshiyuhcmreclyhumfzyohbqmszopf.ojt
[2010.01.31 20:08:23 | 000,000,073 | -H-- | M] () -- C:\Documents and Settings\a\Local Settings\Application Data\anfysrhaujflshiyuhcmreclyhumfzyohbqmszopf.ojt
:services
PowerManager
abp470n5
:files
C:\WINDOWS\svchost.exe
C:\prygpdiq.bat
C:\rxiuhziuhped.bat
C:\zdmwhxeozf.bat
C:\RECYCLER
:commands
[purity]
[emptytemp]
[ClearAllRestorePoints]
[Reboot]

Натиснете бутона Run Fix

Ще се създаде лог файл. Копирайте го в следващия си пост.

Моля архивирайте папката C:\_OTL и я качете на този адрес:

http://rapidshare.de/

Поставете download линк в следващия си пост за да я изтеглим.

След това изтрийте C:\_OTL папката + архива който сте направили. Изтрийте ги и от Recycle Bin-a !!!

СТЪПКА 2

Пробвайте да проверите с ESET Online Scanner още веднъж.

31 януари 201016 г.

Автор

пробвах два пъти но щом натисна fix ми изписва ...DCOM server process launcher service terminated unexpectedly...

отброява ми 1 минута и се рестартира а след рестарт OTL.exe не се отваря повече

трябва да се изтегли на ново и чак тогава си работи

а за есет-а стига до 51% и няма никакво развитие

Редактирано 31 януари 201016 г. от mag1c (преглед на промените)

31 януари 201016 г.

пробвах два пъти но щом натисна fix ми изписва ...DCOM server process launcher service terminated unexpectedly...
отброява ми 1 минута и се рестартира а след рестарт OTL.exe не се отваря повече
трябва да се изтегли на ново и чак тогава си работи

а за есет-а стига до 51% и няма никакво развитие

Нормално е да няма развитие, защото една нова гадинка си стои.

Добре ще използваме тежката артилерия:

*. Временно спрете защитата на антивирусната си програма!.

*. Изтеглете Combofix.

*. Запазете го на на декстопа.

*. Стартирайте инструмента с двукратен клик на мишката.

*. По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

*. Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

31 януари 201016 г.

Автор

http://rapidshare.de/files/49083590/_OTL.rar.html линк от arhiwa C:\_OTL do tuk

и почна да ми изписва Low Disk Space за C

31 януари 201016 г.

http://rapidshare.de/files/49083590/_OTL.rar.html линк от arhiwa C:\_OTL do tuk

и почна да ми изписва Low Disk Space за C

Изтрийте вече папката C:\_OTL и архива C:\_OTL.rar

Изпразнете Recycle Bin-a.

Продължете с Combofix с инструкциите ми от предишния пост.

И пишете на кирилица.

31 януари 201016 г.

Автор

ComboFix 10-01-31.01 - a 01.2010 г. 22:27:32.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1023.784 [GMT 2:00]

Running from: c:\documents and settings\a\Desktop\ComboFix.exe

AV: Kaspersky Anti-Virus Personal *On-access scanning enabled* (Outdated) {816CD617-99F4-4B18-828E-80582E4B044D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\BDARemote.lnk

C:\prygpdiq.bat

C:\rxiuhziuhped.bat

c:\windows\svchost.exe

C:\zdmwhxeozf.bat

D:\agsalservi.bat

D:\Autorun.inf

D:\blthswgtb.bat

D:\nflxptfyipbd.bat

D:\nhpdxdrmyhvzan.bat

D:\pblbougvfjm.bat

D:\prygpdiq.bat

D:\quektyit.bat

D:\rxiuhziuhped.bat

D:\saoyluixdsgt.bat

D:\vdjvego.bat

D:\vlpzprbsaf.bat

D:\zdmwhxeozf.bat

E:\agsalservi.bat

E:\blthswgtb.bat

E:\nflxptfyipbd.bat

E:\nhpdxdrmyhvzan.bat

E:\pblbougvfjm.bat

E:\prygpdiq.bat

E:\quektyit.bat

E:\rxiuhziuhped.bat

E:\saoyluixdsgt.bat

E:\vdjvego.bat

E:\vlpzprbsaf.bat

E:\zdmwhxeozf.bat

F:\agsalservi.bat

F:\blthswgtb.bat

F:\nflxptfyipbd.bat

F:\nhpdxdrmyhvzan.bat

F:\pblbougvfjm.bat

F:\prygpdiq.bat

F:\quektyit.bat

F:\rxiuhziuhped.bat

F:\saoyluixdsgt.bat

F:\vdjvego.bat

F:\vlpzprbsaf.bat

F:\zdmwhxeozf.bat

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_POWERMANAGER

-------\Service_PowerManager

((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-31 )))))))))))))))))))))))))))))))

.

2010-01-31 19:15 . 2010-01-31 19:35 -------- d-----w- c:\program files\FlashGet

2010-01-31 14:09 . 2010-01-31 14:09 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2010-01-31 14:09 . 2010-01-31 14:09 -------- d-----w- c:\documents and settings\a\Application Data\skypePM

2010-01-31 14:07 . 2010-01-31 19:55 -------- d-----w- c:\documents and settings\a\Application Data\Skype

2010-01-31 14:07 . 2010-01-31 14:07 -------- d-----w- c:\program files\Common Files\Skype

2010-01-31 14:07 . 2010-01-31 14:07 -------- d-----r- c:\program files\Skype

2010-01-31 14:07 . 2010-01-31 14:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2010-01-31 12:58 . 2010-01-31 12:58 -------- d-----w- c:\program files\DAEMON Tools Toolbar

2010-01-31 12:58 . 2010-01-31 12:58 691696 ----a-w- c:\windows\system32\drivers\sptd.sys

2010-01-31 12:58 . 2010-01-31 12:58 -------- d-----w- c:\program files\DAEMON Tools Lite

2010-01-31 12:57 . 2010-01-31 13:03 -------- d-----w- c:\documents and settings\a\Application Data\DAEMON Tools Lite

2010-01-31 12:57 . 2010-01-31 12:57 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-31 18:24 . 2010-01-31 18:08 316 ---h--w- c:\program files\pbskdbqibpkpvjjytfzimyvdpxjasljyqjxsxdrr.bnh

2010-01-31 18:08 . 2010-01-31 18:08 73 ---h--w- c:\program files\anfysrhaujflshiyuhcmreclyhumfzyohbqmszopf.ojt

2010-01-28 15:19 . 2010-01-28 15:19 -------- d-----w- c:\program files\Google

2010-01-28 15:08 . 2010-01-28 15:08 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI

2010-01-28 15:08 . 2010-01-28 15:08 -------- d-----w- c:\documents and settings\a\Application Data\ATI

2010-01-28 15:08 . 2010-01-28 15:08 0 ----a-w- c:\windows\ativpsrm.bin

2010-01-28 15:04 . 2010-01-28 14:53 -------- d-----w- c:\program files\ATI Technologies

2010-01-28 15:02 . 2010-01-28 14:47 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-01-28 15:01 . 2010-01-28 14:47 -------- d-----w- c:\program files\Common Files\InstallShield

2010-01-28 15:01 . 2010-01-28 15:01 9158 ----a-r- c:\documents and settings\a\Application Data\Microsoft\Installer\{985F0C69-F2B9-4D74-8932-D78CAE01FFF8}\ARPPRODUCTICON.exe

2010-01-28 15:01 . 2010-01-28 15:01 -------- d-----w- c:\program files\Common Files\ATI Technologies

2010-01-28 14:55 . 2010-01-28 14:55 -------- d-----w- c:\program files\DIFX

2010-01-28 14:55 . 2010-01-28 14:55 -------- d-----w- c:\program files\USB TV

2010-01-28 14:55 . 2010-01-28 14:55 -------- d-----w- c:\documents and settings\a\Application Data\InstallShield

2010-01-28 14:47 . 2010-01-28 14:47 -------- d-----w- c:\program files\Realtek Sound Manager

2010-01-28 14:47 . 2010-01-28 14:47 -------- d-----w- c:\program files\AvRack

2010-01-28 14:47 . 2010-01-28 14:47 139264 ------w- c:\windows\alcrmv.exe

2010-01-28 14:47 . 2010-01-28 14:47 208896 ------w- c:\windows\alcupd.exe

2010-01-28 13:48 . 2010-01-28 13:29 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2010-01-28 13:37 . 2010-01-28 13:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal

2010-01-28 13:37 . 2010-01-28 13:37 -------- d-----w- c:\program files\Kaspersky Lab

2010-01-28 13:37 . 2010-01-28 13:37 12328 ----a-w- c:\documents and settings\a\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-01-28 13:30 . 2010-01-28 13:30 -------- d-----w- c:\program files\microsoft frontpage

2010-01-28 13:26 . 2010-01-28 13:26 21640 ----a-w- c:\windows\system32\emptyregdb.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-28 39408]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 447024]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-16 24264488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"KAVPersonal50"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" [2005-08-30 175719]

"SoundMan"="SOUNDMAN.EXE" [2004-02-26 146944]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-04-23 237056]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableInstallerDetection"= 0 (0x0)

"EnableSecureUIAPaths"= 0 (0x0)

"EnableVirtualization"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableTaskMgr"= 1 (0x1)

"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"FirewallOverride"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\Ati2mdxx.exe"=

"c:\\WINDOWS\\system32\\dxdllreg.exe"=

"c:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\MOM.exe"=

"c:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\CLIStart.exe"=

"c:\\WINDOWS\\notepad.exe"=

"c:\\WINDOWS\\system32\\wuauclt.exe"=

"c:\\WINDOWS\\SOUNDMAN.EXE"=

"c:\\Program Files\\FlashGet\\flashget.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [1/31/2010 2:58 PM 691696]

R1 Klmc;Klmc;c:\windows\system32\drivers\klmc.sys [8/30/2005 2:52 PM 10995]

R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\hkpenj.sys --> c:\windows\system32\drivers\hkpenj.sys [?]

.

------- Supplementary Scan -------

.

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm

IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-31 22:34

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spdc.sys >>UNKNOWN [0x8678D938]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

\Driver\Disk -> CLASSPNP.SYS @ 0xf7892f28

\Driver\ACPI -> ACPI.sys @ 0xf76dacb8

\Driver\atapi -> atapi.sys @ 0xf766fb40

IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598

ParseProcedure -> ntoskrnl.exe @ 0x8056c1d6

\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598

ParseProcedure -> ntoskrnl.exe @ 0x8056c1d6

user & kernel MBR OK

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(596)

c:\windows\system32\Ati2evxx.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\windows\SOUNDMAN.EXE

c:\program files\Skype\Plugin Manager\skypePM.exe

c:\windows\svchost.exe

.

**************************************************************************

.

Completion time: 2010-01-31 22:36:38 - machine was rebooted

ComboFix-quarantined-files.txt 2010-01-31 20:36

Pre-Run: 89 174 016 bytes free

Post-Run: 6 348 107 776 bytes free

- - End Of File - - 64610AF7B06376D6971698AEB280FC08

31 януари 201016 г.

Отворете notepad.exe.

Сега отидете на Format и сложете отметка (ако няма) пред Word Wrap.

Вече с copy/paste въведете това:


KILLALL::

Driver::

abp470n5

File::

C:\WINDOWS\system32\grhyqnbskxrvanmau.exe

c:\windows\svchost.exe

c:\program files\pbskdbqibpkpvjjytfzimyvdpxjasljyqjxsxdrr.bnh

c:\program files\anfysrhaujflshiyuhcmreclyhumfzyohbqmszopf.ojt

c:\windows\system32\drivers\hkpenj.sys

Rootkit::

c:\windows\svchost.exe

Registry::

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableTaskMgr"=-

"DisableRegistryTools"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\WINDOWS\system32\grhyqnbskxrvanmau.exe"=-

Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както на картинката отдолу).

По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

31 януари 201016 г.

Автор

ComboFix 10-01-31.01 - a 01.2010 г. 23:02:31.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1023.785 [GMT 2:00]

Running from: c:\documents and settings\a\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\a\Desktop\CFScript.txt

AV: Kaspersky Anti-Virus Personal *On-access scanning enabled* (Outdated) {816CD617-99F4-4B18-828E-80582E4B044D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

"c:\program files\anfysrhaujflshiyuhcmreclyhumfzyohbqmszopf.ojt"

"c:\program files\pbskdbqibpkpvjjytfzimyvdpxjasljyqjxsxdrr.bnh"

"c:\windows\svchost.exe"

"c:\windows\system32\drivers\hkpenj.sys"

"c:\windows\system32\grhyqnbskxrvanmau.exe"

.

ADS - svchost.exe: deleted 68 bytes in 1 streams.

ADS - ntoskrnl.exe: deleted 68 bytes in 1 streams.

ADS - explorer.exe: deleted 100 bytes in 1 streams.

ADS - win32k.sys: deleted 68 bytes in 1 streams.

ADS - netcfgx.dll: deleted 68 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\anfysrhaujflshiyuhcmreclyhumfzyohbqmszopf.ojt

c:\program files\pbskdbqibpkpvjjytfzimyvdpxjasljyqjxsxdrr.bnh

c:\windows\svchost.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_ABP470N5

-------\Service_abp470n5

((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-31 )))))))))))))))))))))))))))))))

.

2010-01-31 19:15 . 2010-01-31 19:35 -------- d-----w- c:\program files\FlashGet

2010-01-31 14:09 . 2010-01-31 14:09 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2010-01-31 14:09 . 2010-01-31 14:09 -------- d-----w- c:\documents and settings\a\Application Data\skypePM

2010-01-31 14:07 . 2010-01-31 20:54 -------- d-----w- c:\documents and settings\a\Application Data\Skype