going-on-earth вирус [решен]

13 май 201115 г.

Това е някакъв вирус, който при търсене с гугъл и съответно цъкане на някой резултат ме препраща в разни сайтове различни от целта.

Не мога да прикача лог от dds защото винаги тръгва да се отваря с аутокад(който имам инсталиран). Как точно да го стартирам? http://www.kaldata.com/forums/public/style_emoticons/<#EMO_DIR#>/sad.gif

Редактирано 14 май 201115 г. от nologo (преглед на промените)

1

13 май 201115 г.

Може да се стартира, например dds.com, ето линк: тук

Ако и това няма резултат, следвайте инструкцията за работа с OTL:

Изтеглете OTL.exe и го запазете на десктопа.
Стартирайте файла с двукратен клик на мишката.
Направете следните настройки:

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles

Натиснете маркираният в синьо бутон: .
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

Редактирано 13 май 201115 г. от nologo (преглед на промените)

3

14 май 201115 г.

Автор

. DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by Lubo at 10:20:39,11 on бкЎ 14.05.2011 Ј. Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_24 Microsoft Windows 7 Ultimate 6.1.7600.0.1251.359.1033.18.2043.1105 [GMT 3:00] . SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\atieclxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\taskeng.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\XSrvSetup.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files (x86)\uTorrent\uTorrent.exe C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\servicing\TrustedInstaller.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Users\Lubo\Desktop\dds.com C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uURLSearchHooks: SearchHook Class: {bc86e1ab-eda5-4059-938f-ce307b0c6f0a} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" mRun: [bCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe mRun: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\TOTALM~1.LNK - C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: {84E61C5B-C149-43A4-AA61-A35CAA6B78F2} = 78.90.22.1,89.190.192.162 Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL BHO-X64: URLRedirectionBHO - No File TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s mRun-x64: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Lubo\AppData\Roaming\Mozilla\Firefox\Profiles\ox6fbowx.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.gol.bg/ FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p= FF - component: C:\Users\Lubo\AppData\Roaming\Mozilla\Firefox\Profiles\ox6fbowx.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll FF - component: C:\Users\Lubo\AppData\Roaming\Mozilla\Firefox\Profiles\ox6fbowx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.53\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npEModelPlugin.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ---- FIREFOX POLICIES ---- FF - user.js: network.cookie.cookieBehavior - 0 FF - user.js: privacy.clearOnShutdown.cookies - false FF - user.js: security.warn_viewing_mixed - false FF - user.js: security.warn_viewing_mixed.show_once - false FF - user.js: security.warn_submit_insecure - false FF - user.js: security.warn_submit_insecure.show_once - false . ============= SERVICES / DRIVERS =============== . R1 AppleCharger;AppleCharger;C:\Windows\System32\drivers\AppleCharger.sys [2010-10-20 20520] R1 ArcSec;archlp;C:\Windows\System32\drivers\ArcSec.sys [2010-12-18 312184] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-8-26 203776] R2 BCUService;Browser Configuration Utility Service;C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2010-10-20 219360] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-10-20 13336] R2 JMB36X;JMB36X;C:\Windows\SysWOW64\XSrvSetup.exe [2010-10-20 65536] R2 TeamViewer6;TeamViewer 6;C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-13 2228008] R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atikmdag.sys [2011-1-26 9085952] R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2011-1-26 299520] R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2010-7-15 116240] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-10-20 295424] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Услуга Google Update (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-1-27 136176] S2 KMService;KMService;C:\Windows\system32\srvany.exe --> C:\Windows\system32\srvany.exe [?] S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;E:\New folder\SolidWorks\swScheduler\DTSCoordinatorService.exe [2009-10-15 87336] S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-10-28 1315592] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-1-27 136176] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-3-25 30969208] S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);C:\Windows\System32\drivers\s1018bus.sys [2010-11-10 113704] S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;C:\Windows\System32\drivers\s1018mdfl.sys [2010-11-10 19496] S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;C:\Windows\System32\drivers\s1018mdm.sys [2010-11-10 153128] S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);C:\Windows\System32\drivers\s1018mgmt.sys [2010-11-10 133160] S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);C:\Windows\System32\drivers\s1018nd5.sys [2010-11-10 34856] S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;C:\Windows\System32\drivers\s1018obex.sys [2010-11-10 128552] S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);C:\Windows\System32\drivers\s1018unic.sys [2010-11-10 146472] S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-10-22 1255736] . =============== File Associations =============== . .scr=AutoCADScriptFile . =============== Created Last 30 ================ . 2011-05-11 11:11:29 5509504 ----a-w- C:\Windows\System32\ntoskrnl.exe 2011-05-11 11:11:29 3957632 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2011-05-11 11:11:29 3901824 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe 2011-05-04 18:00:05 -------- d-----w- C:\Users\Lubo\DoctorWeb 2011-05-03 17:36:02 -------- d-----w- C:\programa 2011-05-03 11:46:28 -------- d-----w- C:\Windows\pv 2011-05-03 11:46:27 -------- d-----w- C:\Windows\SysWow64\embedded 2011-05-03 11:46:27 -------- d-----w- C:\Windows\LHSP 2011-05-03 11:46:26 -------- d-----w- C:\Program Files (x86)\Polyglot7 2011-05-03 11:31:17 -------- d-----w- C:\Users\Lubo\AppData\Local\Opera 2011-05-03 09:35:06 924632 ----a-w- C:\Program Files (x86)\Mozilla Firefox\firefox.exe 2011-05-03 09:35:06 89048 ----a-w- C:\Program Files (x86)\Mozilla Firefox\libEGL.dll 2011-05-03 09:35:06 781272 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozsqlite3.dll 2011-05-03 09:35:06 465880 ----a-w- C:\Program Files (x86)\Mozilla Firefox\libGLESv2.dll 2011-05-03 09:35:06 1974616 ----a-w- C:\Program Files (x86)\Mozilla Firefox\D3DCompiler_42.dll 2011-05-03 09:35:06 1892184 ----a-w- C:\Program Files (x86)\Mozilla Firefox\d3dx9_42.dll 2011-05-03 09:35:06 1874904 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2011-05-03 09:35:06 16856 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe 2011-05-03 09:35:06 15832 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozalloc.dll 2011-05-03 09:35:06 142296 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll 2011-05-03 09:31:52 -------- d-----w- C:\Program Files (x86)\MozBackup 2011-04-28 18:27:13 -------- d-----w- C:\Program Files (x86)\Zuken . ==================== Find3M ==================== . 2011-04-13 17:12:30 123392 --sha-r- C:\Windows\SysWow64\syncuiw.dll 2011-03-11 06:19:26 1395712 ----a-w- C:\Windows\System32\mfc42.dll 2011-03-11 06:19:26 1359872 ----a-w- C:\Windows\System32\mfc42u.dll 2011-03-11 05:40:24 1164288 ----a-w- C:\Windows\SysWow64\mfc42u.dll 2011-03-11 05:40:24 1137664 ----a-w- C:\Windows\SysWow64\mfc42.dll 2011-03-08 06:14:30 976896 ----a-w- C:\Windows\System32\inetcomm.dll 2011-03-08 05:38:13 740864 ----a-w- C:\Windows\SysWow64\inetcomm.dll 2011-03-03 06:17:10 182272 ----a-w- C:\Windows\System32\dnsrslvr.dll 2011-03-03 06:14:38 30208 ----a-w- C:\Windows\System32\dnscacheugc.exe 2011-03-03 05:27:30 28672 ----a-w- C:\Windows\SysWow64\dnscacheugc.exe 2011-03-03 03:58:32 3133440 ----a-w- C:\Windows\System32\win32k.sys 2011-02-24 06:29:15 1197056 ----a-w- C:\Windows\System32\wininet.dll 2011-02-24 06:24:57 57856 ----a-w- C:\Windows\System32\licmgr10.dll 2011-02-24 05:32:44 981504 ----a-w- C:\Windows\SysWow64\wininet.dll 2011-02-24 05:30:16 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll 2011-02-24 05:05:13 482816 ----a-w- C:\Windows\System32\html.iec 2011-02-24 04:24:04 1638912 ----a-w- C:\Windows\System32\mshtml.tlb 2011-02-24 04:23:48 386048 ----a-w- C:\Windows\SysWow64\html.iec 2011-02-24 03:50:26 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2011-02-23 05:16:28 461312 ----a-w- C:\Windows\System32\drivers\srv.sys 2011-02-23 05:16:01 401920 ----a-w- C:\Windows\System32\drivers\srv2.sys 2011-02-23 05:15:50 161792 ----a-w- C:\Windows\System32\drivers\srvnet.sys 2011-02-23 05:15:27 157696 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys 2011-02-23 05:15:14 286720 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys 2011-02-23 05:15:13 126464 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys 2011-02-23 05:15:06 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys 2011-02-19 06:36:13 46080 ----a-w- C:\Windows\System32\atmlib.dll 2011-02-19 05:32:08 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll 2011-02-19 04:13:39 367104 ----a-w- C:\Windows\System32\atmfd.dll 2011-02-19 03:37:02 294912 ----a-w- C:\Windows\SysWow64\atmfd.dll 2011-02-18 06:37:05 612352 ----a-w- C:\Windows\System32\vbscript.dll 2011-02-18 05:36:26 428032 ----a-w- C:\Windows\SysWow64\vbscript.dll . ============= FINISH: 10:21:03,00 =============== ------------------------------------------------------------------------------------------------------------------------ . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_11-03-05.01) . Microsoft Windows 7 Ultimate Boot Device: \Device\HarddiskVolume1 Install Date: 21.10.2010 г. 05:51:36 System Uptime: 14.5.2011 г. 10:10:54 (0 hours ago) . Motherboard: Gigabyte Technology Co., Ltd. | | P55-US3L Processor: Intel® Core i3 CPU 530 @ 2.93GHz | Socket 1156 | 1316/133mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 50 GiB total, 9,268 GiB free. D: is FIXED (NTFS) - 208 GiB total, 22,552 GiB free. E: is FIXED (NTFS) - 208 GiB total, 36,207 GiB free. G: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1} Description: archlp Device ID: ROOT\LEGACY_ARCHLP\0000 Manufacturer: Name: archlp PNP Device ID: ROOT\LEGACY_ARCHLP\0000 Service: archlp . ==== System Restore Points =================== . No restore point in system. . ==== Installed Programs ====================== . µTorrent Adobe AIR Adobe Community Help Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Media Player Adobe Photoshop CS5 Adobe Reader 9.4.4 AGEIA PhysX v7.09.13 ArcSoft TotalMedia Theatre 5 ATI Catalyst Registration Browser Configuration Utility CADSTAR 12.0 Catalyst Control Center - Branding Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy ccc-core-static CCC Help English CCleaner Clock Screen Saver Definition update for Microsoft Office 2010 (KB982726) Dev-C++ 5 beta 9 release (4.9.9.2) DTS+AC3 Filter DWGeditor EA Download Manager EVEREST Ultimate Edition v5.50 FIFA 11 Full Tilt Poker Futuremark SystemInfo Gigabyte Raid Cinfigurer GOM Player Google Earth Plug-in Google Update Helper Graph 4.3 HD Tune Pro 4.60 Intel® Control Center Intel® Rapid Storage Technology Java Auto Updater Java 6 Update 24 Just Great Software EditPad Lite 6.6.4 Lunarmedia Clock B. Malwarebytes' Anti-Malware Microsoft Office 2003 Web Components Microsoft Office Access MUI (English) 2010 Microsoft Office Access Setup Metadata MUI (English) 2010 Microsoft Office Excel MUI (English) 2010 Microsoft Office Groove MUI (English) 2010 Microsoft Office InfoPath MUI (English) 2010 Microsoft Office OneNote MUI (English) 2010 Microsoft Office Outlook MUI (English) 2010 Microsoft Office PowerPoint MUI (English) 2010 Microsoft Office Professional Plus 2010 Microsoft Office Proof (English) 2010 Microsoft Office Proof (French) 2010 Microsoft Office Proof (Spanish) 2010 Microsoft Office Proofing (English) 2010 Microsoft Office Publisher MUI (English) 2010 Microsoft Office Shared MUI (English) 2010 Microsoft Office Shared Setup Metadata MUI (English) 2010 Microsoft Office Word MUI (English) 2010 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual Studio 2005 Tools for Applications - ENU Microsoft_VC80_CRT_x86 Microsoft_VC80_MFC_x86 Microsoft_VC80_MFCLOC_x86 Microsoft_VC90_ATL_x86 Microsoft_VC90_CRT_x86 Microsoft_VC90_MFC_x86 MozBackup 1.5.1 Mozilla Firefox 4.0.1 (x86 bg) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Need for Speed Hot Pursuit ON_OFF Charge B10.0301.1 Opera 11.10 PacSteamT Panda USB Vaccine 1.0.1.4 PDF Settings CS5 PhotoView 360 PokerStars POLYGLOT 7 ReadManiac 2.5.2 Realtek Ethernet Controller Driver For Windows 7 Realtek High Definition Audio Driver Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft Excel 2010 (KB2466146) Security Update for Microsoft Office 2010 (KB2289078) Security Update for Microsoft Office 2010 (KB2289161) Security Update for Microsoft PowerPoint 2010 (KB2519975) Security Update for Microsoft Publisher 2010 (KB2409055) Security Update for Microsoft Word 2010 (KB2345000) Skype™ 4.0 SolidWorks 2010 x64 Edition SP0 SolidWorks eDrawings 2010 SopCast 3.2.9 Team Fortress 2 TeamViewer 6 The Lord of the Rings FREE Trial UMS 5.0.1.3 Update for Microsoft Office 2010 (KB2202188) Update for Microsoft Office 2010 (KB2413186) Update for Microsoft Office 2010 (KB2494150) Update for Microsoft OneNote 2010 (KB2493983) Update for Microsoft Outlook Social Connector (KB2441641) VLC media player 1.1.7 . ==== Event Viewer Messages From Past Week ======== . 9.5.2011 г. 18:21:43, Error: Microsoft-Windows-DistributedCOM [10001] - Unable to start a DCOM Server: {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83} as /. The error: "5" Happened while starting this command: C:\Windows\System32\slui.exe -Embedding 9.5.2011 г. 16:58:12, Error: Microsoft-Windows-DistributedCOM [10001] - Unable to start a DCOM Server: {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83} as /. The error: "5" Happened while starting this command: C:\Windows\System32\slui.exe -Embedding 9.5.2011 г. 13:24:14, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp 8.5.2011 г. 20:25:06, Error: Microsoft-Windows-DistributedCOM [10001] - Unable to start a DCOM Server: {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83} as /. The error: "5" Happened while starting this command: C:\Windows\System32\slui.exe -Embedding 8.5.2011 г. 20:22:17, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp 14.5.2011 г. 10:14:19, Error: Microsoft-Windows-DistributedCOM [10001] - Unable to start a DCOM Server: {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83} as /. The error: "5" Happened while starting this command: C:\Windows\System32\slui.exe -Embedding 14.5.2011 г. 10:11:13, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp 13.5.2011 г. 18:28:11, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp 13.5.2011 г. 16:02:12, Error: Microsoft-Windows-DistributedCOM [10001] - Unable to start a DCOM Server: {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83} as /. The error: "5" Happened while starting this command: C:\Windows\System32\slui.exe -Embedding 13.5.2011 г. 15:59:22, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp 12.5.2011 г. 11:49:18, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp 12.5.2011 г. 10:35:36, Error: Microsoft-Windows-DistributedCOM [10001] - Unable to start a DCOM Server: {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83} as /. The error: "5" Happened while starting this command: C:\Windows\System32\slui.exe -Embedding 12.5.2011 г. 10:32:24, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp 11.5.2011 г. 19:28:07, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp 11.5.2011 г. 17:41:36, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp 11.5.2011 г. 14:07:45, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp 11.5.2011 г. 08:58:06, Error: Microsoft-Windows-DistributedCOM [10001] - Unable to start a DCOM Server: {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83} as /. The error: "5" Happened while starting this command: C:\Windows\System32\slui.exe -Embedding 11.5.2011 г. 08:50:56, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f020b: AOC International (Europe) GmbH - Display - AOC 831W. 11.5.2011 г. 08:49:40, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Windows Internet Explorer 9 for Windows 7 for x64-based Systems. 11.5.2011 г. 08:45:12, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp 10.5.2011 г. 12:03:12, Error: Microsoft-Windows-DistributedCOM [10001] - Unable to start a DCOM Server: {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83} as /. The error: "5" Happened while starting this command: C:\Windows\System32\slui.exe -Embedding 10.5.2011 г. 10:30:48, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp . ==== End Of File ===========================

1

14 май 201115 г.

Следва:

Стъпка 1

Изтеглете Suspicious File Packer и го разархивирайте на работния плот (десктоп).
Стартирайте sfp.exe
Копирайте (Copy) съдържанието на текста в синьо, който е по-долу и го поставете (Paste) в програмата:

C:\Windows\SysWow64\syncuiw.dll
Натиснете Continue. Програмата ще направи CAB файл на работния плот (десктоп), който изглежда ето така: requested-files[година-месец-ден_час_минута].cab
Качете файла на rapidshare.com и дайте линк, за да го изтеглим.

Стъпка 2

Продължете с OTL, както съм дал инструкция във втория коментар от тази тема.

2

14 май 201115 г.

Автор

https://rapidshare.com/files/2923666599/requested-files_2011-05-14_12_20_.cab

Extras.Txt

OTL.Txt

2

14 май 201115 г.

Следва:

Стъпка 1

Стартирайте пак OTL и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:otl
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Secure Search"
FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query="
FF - prefs.js..browser.search.order.1: "Ask.com"
[2010.12.19 16:28:50 | 000,002,396 | ---- | M] () -- C:\Users\Lubo\AppData\Roaming\Mozilla\Firefox\Profiles\ox6fbowx.default\searchplugins\askcom.xml
O3 - HKU\S-1-5-21-879092097-2170891728-3846873964-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O33 - MountPoints2\{0f4062eb-ec2f-11df-b83e-1c6f6523ecd1}\Shell - "" = AutoRun
O33 - MountPoints2\{0f4062eb-ec2f-11df-b83e-1c6f6523ecd1}\Shell\AutoRun\command - "" = F:\Startme.exe
O33 - MountPoints2\{4a1c8c2f-dd16-11df-9b01-1c6f6523ecd1}\Shell - "" = AutoRun
O33 - MountPoints2\{4a1c8c2f-dd16-11df-9b01-1c6f6523ecd1}\Shell\AutoRun\command - "" = G:\Autorun.exe
O33 - MountPoints2\{a7aa4701-dcbd-11df-a133-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a7aa4701-dcbd-11df-a133-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Run.exe
:files
C:\Windows\SysWOW64\syncuiw.dll
C:\Windows\Tasks\Sshaqbuee.job
recycler /alldrives
ipconfig /flushdns /c
:commands
[purity]
[resethosts]
[emptytemp]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Стъпка 2

Обновете и стартирайте MalwareBytes' Anti-Malware и изберете Perform Quick Scan (Бързо сканиране), след това кликнете на Scan.
Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

4

14 май 201115 г.

Автор

All processes killed

========== OTL ==========

Prefs.js: "Ask.com" removed from browser.search.defaultengine

Prefs.js: "Secure Search" removed from browser.search.defaultenginename

Prefs.js: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=" removed from browser.search.defaulturl

Prefs.js: "Ask.com" removed from browser.search.order.1

C:\Users\Lubo\AppData\Roaming\Mozilla\Firefox\Profiles\ox6fbowx.default\searchplugins\askcom.xml moved successfully.

Registry value HKEY_USERS\S-1-5-21-879092097-2170891728-3846873964-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\ not found.

File {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mso-offdap11\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32505114-5902-49B2-880A-1F7738E5A384}\ not found.

File {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}\ not found.

File {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found not found.

64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.

64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f4062eb-ec2f-11df-b83e-1c6f6523ecd1}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f4062eb-ec2f-11df-b83e-1c6f6523ecd1}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f4062eb-ec2f-11df-b83e-1c6f6523ecd1}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f4062eb-ec2f-11df-b83e-1c6f6523ecd1}\ not found.

File F:\Startme.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4a1c8c2f-dd16-11df-9b01-1c6f6523ecd1}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a1c8c2f-dd16-11df-9b01-1c6f6523ecd1}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4a1c8c2f-dd16-11df-9b01-1c6f6523ecd1}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a1c8c2f-dd16-11df-9b01-1c6f6523ecd1}\ not found.

File G:\Autorun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7aa4701-dcbd-11df-a133-806e6f6e6963}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a7aa4701-dcbd-11df-a133-806e6f6e6963}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7aa4701-dcbd-11df-a133-806e6f6e6963}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a7aa4701-dcbd-11df-a133-806e6f6e6963}\ not found.

File F:\Run.exe not found.

========== FILES ==========

C:\Windows\SysWOW64\syncuiw.dll moved successfully.

C:\Windows\Tasks\Sshaqbuee.job moved successfully.

recycler not found in C:\

recycler not found in D:\

recycler not found in E:\

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\Lubo\Desktop\cmd.bat deleted successfully.

C:\Users\Lubo\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56504 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: Lubo

->Temp folder emptied: 18023107 bytes

->Temporary Internet Files folder emptied: 36360585 bytes

->Java cache emptied: 749597 bytes

->FireFox cache emptied: 178184961 bytes

->Opera cache emptied: 13521421 bytes

->Flash cache emptied: 9583 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 9304728 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 84793 bytes

RecycleBin emptied: 21878888 bytes

Total Files Cleaned = 265,00 mb

[EMPTYFLASH]

User: All Users

User: Default

->Flash cache emptied: 0 bytes

User: Default User

->Flash cache emptied: 0 bytes

User: Lubo

->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 05142011_210800

Files\Folders moved on Reboot...

C:\Users\Lubo\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

________________________________________________________________________________________________________________________________

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Версия на базата от данни: 6579

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

14.5.2011 г. 21:14:03

mbam-log-2011-05-14 (21-14-03).txt

Тип сканиране: Бързо сканиране

Сканирани обекти: 156043

Изминало време: 3 минута(и), 3 секунда(и)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 0

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 0

Заразени файлове: 0

Заразени процеси в паметта: