pa4ata

Malwarebytes' Anti-Malware 1.37 Database version: 2247 Windows 6.0.6001 Service Pack 1 8.6.2009 г. 17:44:44 mbam-log-2009-06-08 (17-44-44).txt Scan type: Full Scan (C:\|D:\|) Objects scanned: 144009 Time elapsed: 1 hour(s), 3 minute(s), 5 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\Qoobox\quarantine\C\Windows\System32\rar.exe.vir (Trojan.Backdoor) -> Quarantined and deleted successfully.

Ето от ComboFix ComboFix 09-06-07.05 - Krasi 06.2009 г. 16:30.1 - NTFSx86 Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1251.359.1033.18.1023.507 [GMT 3:00] Running from: c:\users\Krasi\Desktop\ComboFix.exe Command switches used :: c:\users\Krasi\Desktop\CFScript.txt SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} FILE :: "c:\windows\system32\nvtpm32.dll" "c:\windows\system32\rar.exe" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\nvtpm32.dll c:\windows\system32\rar.exe . ((((((((((((((((((((((((( Files Created from 2009-05-08 to 2009-06-08 ))))))))))))))))))))))))))))))) . 2009-06-08 13:34 . 2009-06-08 13:34 2560 ----a-w- c:\windows\system32\bitcometres.dll 2009-06-08 13:33 . 2009-06-08 13:34 -------- d-----w- c:\users\Krasi\AppData\Local\temp 2009-06-08 13:33 . 2009-06-08 13:33 -------- d-----w- C:\temp 2009-06-08 13:33 . 2009-06-08 13:33 -------- d-----w- \temp 2009-06-08 13:28 . 2009-06-08 13:34 -------- d-s---w- \ComboFix 2009-06-08 08:13 . 2009-06-08 13:29 -------- d-----w- \Qoobox 2009-06-07 18:22 . 2009-06-07 18:22 -------- d-----w- c:\program files\Trend Micro 2009-06-06 14:34 . 2009-06-08 08:34 126976 ----a-w- c:\windows\system32\I00138F6874E6.dll 2009-06-06 14:34 . 2009-06-06 20:08 49152 ----a-w- c:\windows\DHTTPFIXER.dll 2009-06-06 14:34 . 2009-06-06 20:08 35840 ----a-w- c:\windows\FIMFILTER.dll 2009-06-06 14:34 . 2009-06-06 20:08 31232 ----a-w- c:\windows\EWEBFILTER.dll 2009-06-06 14:34 . 2009-06-06 20:08 245760 ----a-w- c:\windows\CINTERCEPTOR.dll 2009-06-06 14:34 . 2009-06-06 14:34 -------- d-----w- c:\windows\system32\coredb 2009-06-06 14:34 . 2009-06-06 20:08 98304 ----a-w- c:\windows\BCOREDB.dll 2009-06-06 14:34 . 2009-06-06 20:08 62976 ----a-w- c:\windows\AModCom.dll 2009-06-03 16:34 . 2009-06-03 16:34 -------- d-----w- c:\users\Krasi\AppData\Local\Winamp Toolbar 2009-05-20 13:05 . 2009-05-20 13:05 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-08 13:33 . 2009-04-17 19:29 1386831872 --sha-w- \pagefile.sys 2009-06-08 13:33 . 2009-04-18 09:05 12 ----a-w- c:\windows\bthservsdp.dat 2009-06-08 13:20 . 2009-04-17 12:13 -------- d-----w- c:\users\Krasi\AppData\Roaming\Skype 2009-06-08 08:31 . 2009-04-17 11:13 -------- d-----w- c:\program files\ESET 2009-06-07 13:25 . 2009-04-17 10:02 -------- d-----w- c:\program files\FlashGet 2009-06-07 12:44 . 2009-04-17 11:33 -------- d-----w- c:\program files\Spyware Doctor 2009-06-07 05:02 . 2009-04-17 14:14 -------- d-----w- c:\program files\HLSW 2009-06-06 17:31 . 2009-04-17 10:48 -------- d-----w- c:\users\Krasi\AppData\Roaming\uTorrent 2009-06-06 15:57 . 2009-04-17 10:49 -------- d-----w- c:\program files\uTorrent 2009-05-30 18:18 . 2009-05-09 09:36 -------- d-----w- c:\program files\BitComet 2009-05-25 17:43 . 2009-05-05 12:41 -------- d-----w- c:\program files\CSConfigurator 2009-05-23 12:11 . 2009-05-23 12:11 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2009-05-05 15:14 . 2009-04-17 09:39 50088 ----a-w- c:\users\Krasi\AppData\Local\GDIPFONTCACHEV1.DAT 2009-04-25 09:47 . 2009-04-22 15:16 -------- d-----w- c:\program files\DAEMON Tools 2009-04-23 13:54 . 2009-04-23 13:50 -------- d-----w- c:\program files\PhotoScape 2009-04-23 09:39 . 2009-04-17 11:10 -------- d-----w- c:\program files\Common Files\InstallShield 2009-04-23 09:39 . 2009-04-17 09:55 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-04-23 09:22 . 2009-04-23 09:22 -------- d-----w- c:\programdata\ATI 2009-04-23 09:20 . 2009-04-23 09:20 -------- d-----w- c:\program files\My Company Name 2009-04-23 09:19 . 2009-04-23 09:17 -------- d-----w- c:\program files\ATI Technologies 2009-04-23 09:19 . 2009-04-23 09:19 9158 ----a-r- c:\users\Krasi\AppData\Roaming\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe 2009-04-23 09:19 . 2009-04-23 09:19 -------- d-----w- c:\program files\Common Files\ATI Technologies 2009-04-23 09:18 . 2009-04-23 09:18 -------- d-----w- c:\program files\ATI 2009-04-23 09:10 . 2009-04-17 09:38 680 ----a-w- c:\users\Krasi\AppData\Local\d3d9caps.dat 2009-04-22 15:33 . 2009-04-22 15:23 -------- d-----w- c:\programdata\NFS Underground 2009-04-22 14:06 . 2009-04-22 14:05 -------- d-----w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab 2009-04-22 14:05 . 2009-04-17 11:49 -------- d-----w- c:\program files\SystemRequirementsLab 2009-04-22 14:05 . 2009-04-22 14:05 207872 ----a-w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4.dll 2009-04-22 14:05 . 2009-04-22 14:05 207872 ----a-w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_3.dll 2009-04-22 14:05 . 2009-04-22 14:05 207872 ----a-w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_2.dll 2009-04-22 14:05 . 2009-04-22 14:05 207872 ----a-w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_1.dll 2009-04-22 10:31 . 2009-04-22 10:31 -------- d-----w- c:\program files\K-Lite Codec Pack 2009-04-20 11:44 . 2009-04-20 11:44 -------- d-----w- c:\users\Krasi\AppData\Roaming\Media Player Classic 2009-04-17 16:33 . 2009-04-17 16:32 -------- d-----w- c:\program files\Skype 2009-04-17 16:33 . 2009-04-17 12:13 -------- d-----w- c:\programdata\Skype 2009-04-17 16:32 . 2009-04-17 16:32 -------- d-----w- c:\program files\Common Files\Skype 2009-04-17 16:23 . 2009-04-17 16:23 -------- d-----w- c:\program files\Ahead 2009-04-17 16:23 . 2009-04-17 16:23 -------- d-----w- c:\program files\Common Files\Ahead 2009-04-17 13:37 . 2009-04-17 12:23 -------- d-----w- c:\users\Krasi\AppData\Roaming\Winamp 2009-04-17 13:02 . 2009-04-17 12:14 -------- d-----w- c:\users\Krasi\AppData\Roaming\skypePM 2009-04-17 12:32 . 2009-04-17 12:23 -------- d-----w- c:\program files\Winamp 2009-04-17 12:29 . 2009-04-17 12:29 611064 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-04-17 12:29 . 2009-04-17 12:29 142904 ----a-w- c:\windows\system32\drivers\sptddrv1.sys 2009-04-17 12:29 . 2009-04-17 12:29 -------- d-----w- c:\program files\Datecs 2009-04-17 12:26 . 2009-04-17 12:26 -------- d-----w- c:\programdata\DFX 2009-04-17 12:26 . 2009-04-17 12:26 -------- d-----w- c:\program files\DFX 2009-04-17 12:23 . 2009-04-17 12:23 -------- d-----w- c:\program files\Winamp Toolbar 2009-04-17 12:23 . 2009-04-17 12:23 -------- d-----w- c:\programdata\Winamp Toolbar 2009-04-17 12:14 . 2009-04-17 12:14 56 ---ha-w- c:\windows\system32\ezsidmv.dat 2009-04-17 12:08 . 2009-04-17 12:08 7680 ----a-w- c:\users\Krasi\AppData\Roaming\Thinstall\SkypePortable\400000150a00002i\Skype.exe 2009-04-17 12:07 . 2009-04-17 12:07 -------- d-----w- c:\users\Krasi\AppData\Roaming\Thinstall 2009-04-17 12:00 . 2009-04-17 12:00 0 ----a-w- c:\windows\nsreg.dat 2009-04-17 11:48 . 2009-04-17 11:48 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-04-17 11:48 . 2009-04-17 11:48 -------- d-----w- c:\program files\Java 2009-04-17 11:33 . 2009-04-17 11:33 -------- d-----w- c:\users\Krasi\AppData\Roaming\PC Tools 2009-04-17 11:29 . 2009-04-17 11:29 -------- d-----w- c:\users\Krasi\AppData\Roaming\GetRightToGo 2009-04-17 11:11 . 2009-04-17 11:11 -------- d-----w- c:\program files\Realtek Sound Manager 2009-04-17 11:11 . 2009-04-17 11:11 -------- d-----w- c:\program files\AvRack 2009-04-17 11:03 . 2009-04-17 11:03 -------- d-----w- c:\users\Krasi\AppData\Roaming\ATI 2009-04-17 11:02 . 2009-04-17 11:02 0 ----a-w- c:\windows\ativpsrm.bin 2009-04-17 10:10 . 2009-04-17 10:10 -------- d-----w- c:\program files\1PC Drivers HeadQuarters 2009-04-17 10:02 . 2009-04-17 10:02 -------- d-----w- c:\users\Krasi\AppData\Roaming\FlashGet 2009-04-17 09:54 . 2009-04-17 09:54 -------- d-----w- c:\programdata\PC Drivers HeadQuarters 2009-04-17 09:54 . 2009-04-17 09:54 -------- d-----w- c:\program files\PC Drivers HeadQuarters 2009-03-16 11:18 . 2009-06-06 17:39 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-03-16 11:18 . 2009-06-06 17:39 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-03-16 11:18 . 2009-06-06 17:39 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-03-16 11:18 . 2009-06-06 17:39 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-05-28 23458344] "BitComet"="c:\program files\BitComet\BitComet.exe" [2007-11-07 1881400] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-17 148888] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-09-14 157592] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2005-05-17 77824] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2009-4-17 95232] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3950373857-1089411189-3887508328-1000] "EnableNotificationsRef"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{8168822E-00E0-4400-8206-41B4DFEBBC8E}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet "UDP Query User{3DBCFF37-09B8-464B-9F74-EE752D8BD8F9}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet "TCP Query User{34C8599D-8DA7-4FF0-B2E7-00BEE8448E6F}c:\\users\\krasi\\desktop\\crack_driver.detective.6.3.3.0.exe"= UDP:c:\users\krasi\desktop\crack_driver.detective.6.3.3.0.exe:crack_driver.detective.6.3.3.0.exe "UDP Query User{8D190404-EA00-4C83-B054-6BA37E104D93}c:\\users\\krasi\\desktop\\crack_driver.detective.6.3.3.0.exe"= TCP:c:\users\krasi\desktop\crack_driver.detective.6.3.3.0.exe:crack_driver.detective.6.3.3.0.exe "{7F1DB835-81B2-47CC-8E9C-ED0691D8488D}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{4758E54C-7833-4BC0-AB50-48DE367A091C}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{4998E113-6844-4D71-B252-C49ACE28E9D5}"= c:\users\Krasi\Desktop\SkypePortable\App\Skype\Phone\Skype.exe:Skype "TCP Query User{EB485B82-144E-4C93-80E7-84AB21DC85A8}c:\\users\\krasi\\appdata\\roaming\\thinstall\\skypeportable\\400000150a00002i\\skype.exe"= UDP:c:\users\krasi\appdata\roaming\thinstall\skypeportable\400000150a00002i\skype.exe:skype.exe "UDP Query User{43331614-0A1F-402B-8EE7-B9A01011F4E9}c:\\users\\krasi\\appdata\\roaming\\thinstall\\skypeportable\\400000150a00002i\\skype.exe"= TCP:c:\users\krasi\appdata\roaming\thinstall\skypeportable\400000150a00002i\skype.exe:skype.exe "TCP Query User{A896B0B1-DA09-4AB8-A829-A926D5D28F56}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype "TCP Query User{01A71FFB-0207-4DC8-B39F-B406F4653336}c:\\program files\\hlsw\\hlsw.exe"= UDP:c:\program files\hlsw\hlsw.exe:HLSW "UDP Query User{25C7B4C9-827B-4A5A-9A4D-7212D77B2F7A}c:\\program files\\hlsw\\hlsw.exe"= TCP:c:\program files\hlsw\hlsw.exe:HLSW "TCP Query User{0F6D0A44-7F91-4EB2-863E-4B0BA1E0FE03}d:\\games\\sierra\\half-life\\hl.exe"= UDP:d:\games\sierra\half-life\hl.exe:Half-Life Launcher "UDP Query User{8322EB21-46FD-463F-B6DF-71CE9AAC9BDF}d:\\games\\sierra\\half-life\\hl.exe"= TCP:d:\games\sierra\half-life\hl.exe:Half-Life Launcher "TCP Query User{305C6423-DF31-482F-9ACB-423AD4F1CFB6}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet "UDP Query User{862B7C93-1A9E-487D-BB1F-1A15B96325F5}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet "TCP Query User{49B60488-1893-4306-8F0A-819B5ABE8EE2}d:\\games\\diablo ii\\game.exe"= UDP:d:\games\diablo ii\game.exe:Diablo II "UDP Query User{2F6B8650-0720-44B1-AA2C-7ECD37CBC1AC}d:\\games\\diablo ii\\game.exe"= TCP:d:\games\diablo ii\game.exe:Diablo II "TCP Query User{F3308F5A-520D-4621-9BCF-16F823F4D936}d:\\games\\sierra\\sierra\\half-life\\hl.exe"= UDP:d:\games\sierra\sierra\half-life\hl.exe:Half-Life Launcher "UDP Query User{FBA9B6A2-C4AF-40B7-AF9F-AB0CC632B0FA}d:\\games\\sierra\\sierra\\half-life\\hl.exe"= TCP:d:\games\sierra\sierra\half-life\hl.exe:Half-Life Launcher "{560B5F64-6370-4CB9-AA70-F34E90853884}"= UDP:9886:BitComet 9886 TCP "{404FB38A-19FE-4048-9941-CC5D05D8CBEF}"= TCP:9886:BitComet 9886 UDP "TCP Query User{D2A63A50-8FE4-4045-8FA9-9CDECD079E1D}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "UDP Query User{48E62777-366A-4B41-88D0-C56709742CF6}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "{F2BEC1A5-DC5B-4EEC-A877-8BDEB50D7812}"= UDP:9886:BitComet 9886 TCP "{519146DE-04F1-438D-ADA7-E06F72281A93}"= TCP:9886:BitComet 9886 UDP "{59C822BE-4D4D-4506-86E3-A0DD0973BA10}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.8.9506-to-3.0.9.9551-enUS-downloader.exe:Blizzard Downloader "{844275EC-E985-4C94-BA2D-DEEC88BB3B14}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.8.9506-to-3.0.9.9551-enUS-downloader.exe:Blizzard Downloader "{4E3E976E-5F0D-4BAE-8C1E-CE82C7C3BE80}"= UDP:3724:Blizzard Downloader: 3724 "TCP Query User{6B059089-BA4D-4D04-84D3-B453DA714D5F}d:\\downloads\\world of warcraft wrath of the lich king\\launcher.exe"= UDP:d:\downloads\world of warcraft wrath of the lich king\launcher.exe:Blizzard Launcher "UDP Query User{5D3C5F8F-45C6-4BA7-8590-0DFD26717A17}d:\\downloads\\world of warcraft wrath of the lich king\\launcher.exe"= TCP:d:\downloads\world of warcraft wrath of the lich king\launcher.exe:Blizzard Launcher "{B206F6D8-5A8E-411A-AA68-43719BB2589D}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe:Blizzard Downloader "{7936A227-77C0-4282-B1F8-EEBAD7E6FFF0}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe:Blizzard Downloader S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [4/17/2009 2:33 PM 356920] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ . . ------- Supplementary Scan ------- . uStart Page = hxxp://google.bitcomet.com/ IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm TCP: {C98FC91A-8473-49BE-8D8D-6DC88CC21F35} = 82.103.123.254 FF - ProfilePath - c:\users\Krasi\AppData\Roaming\Mozilla\Firefox\Profiles\w6y80hb7.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query= FF - prefs.js: browser.search.selectedEngine - Winamp Search FF - prefs.js: browser.startup.homepage - hxxp://google.bg FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query= . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-08 16:34 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'Explorer.exe'(3392) c:\windows\system32\newdll.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\System32\Ati2evxx.exe c:\windows\System32\audiodg.exe c:\windows\System32\Ati2evxx.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe c:\program files\Skype\Plugin Manager\skypePM.exe . ************************************************************************** . Completion time: 2009-06-08 16:36 - machine was rebooted ComboFix-quarantined-files.txt 2009-06-08 13:36 ComboFix2.txt 2009-06-08 10:25 Pre-Run: 14 715 498 496 bytes free Post-Run: 14 570 364 928 bytes free 227 А от Malwarebytes' Anti-Malware неможах да го копирам защото пойска рестарт на машината и аз дадох и са немога да го намера а неми се чака пак 1 час да сканира а сега е как трябва мерси

Ето какво дава след сканране с ComboFix ComboFix 09-06-07.05 - Krasi 06.2009 г. 13:19.2 - NTFSx86 Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1251.359.1033.18.1023.480 [GMT 3:00] Running from: c:\users\Krasi\Desktop\ComboFix.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\bitcometres.dll c:\windows\system32\nvrsk.dll . ---- Previous Run ------- . c:\windows\system32\azton.mt . ((((((((((((((((((((((((( Files Created from 2009-05-08 to 2009-06-08 ))))))))))))))))))))))))))))))) . 2009-06-08 10:23 . 2009-06-08 10:23 -------- d-----w- c:\users\Krasi\AppData\Local\temp 2009-06-08 10:18 . 2009-06-08 10:23 -------- d-s---w- \ComboFix 2009-06-08 08:13 . 2009-06-08 08:15 -------- d-----w- \Qoobox 2009-06-07 18:22 . 2009-06-07 18:22 -------- d-----w- c:\program files\Trend Micro 2009-06-06 14:34 . 2009-06-08 08:34 126976 ----a-w- c:\windows\system32\I00138F6874E6.dll 2009-06-06 14:34 . 2009-06-06 20:08 49152 ----a-w- c:\windows\DHTTPFIXER.dll 2009-06-06 14:34 . 2009-06-06 20:08 35840 ----a-w- c:\windows\FIMFILTER.dll 2009-06-06 14:34 . 2009-06-06 20:08 31232 ----a-w- c:\windows\EWEBFILTER.dll 2009-06-06 14:34 . 2009-06-06 20:08 245760 ----a-w- c:\windows\CINTERCEPTOR.dll 2009-06-06 14:34 . 2009-06-06 14:34 -------- d-----w- c:\windows\system32\coredb 2009-06-06 14:34 . 2009-06-06 20:08 98304 ----a-w- c:\windows\BCOREDB.dll 2009-06-06 14:34 . 2009-06-06 20:08 62976 ----a-w- c:\windows\AModCom.dll 2009-06-03 16:34 . 2009-06-03 16:34 -------- d-----w- c:\users\Krasi\AppData\Local\Winamp Toolbar 2009-05-20 13:05 . 2009-05-20 13:05 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-08 10:17 . 2009-04-17 19:29 1386831872 --sha-w- \pagefile.sys 2009-06-08 08:31 . 2009-04-17 12:13 -------- d-----w- c:\users\Krasi\AppData\Roaming\Skype 2009-06-08 08:31 . 2009-04-17 11:13 -------- d-----w- c:\program files\ESET 2009-06-08 08:30 . 2009-04-18 09:05 12 ----a-w- c:\windows\bthservsdp.dat 2009-06-07 13:25 . 2009-04-17 10:02 -------- d-----w- c:\program files\FlashGet 2009-06-07 12:44 . 2009-04-17 11:33 -------- d-----w- c:\program files\Spyware Doctor 2009-06-07 05:02 . 2009-04-17 14:14 -------- d-----w- c:\program files\HLSW 2009-06-06 17:31 . 2009-04-17 10:48 -------- d-----w- c:\users\Krasi\AppData\Roaming\uTorrent 2009-06-06 15:57 . 2009-04-17 10:49 -------- d-----w- c:\program files\uTorrent 2009-05-30 18:18 . 2009-05-09 09:36 -------- d-----w- c:\program files\BitComet 2009-05-25 17:43 . 2009-05-05 12:41 -------- d-----w- c:\program files\CSConfigurator 2009-05-23 12:11 . 2009-05-23 12:11 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2009-05-05 15:14 . 2009-04-17 09:39 50088 ----a-w- c:\users\Krasi\AppData\Local\GDIPFONTCACHEV1.DAT 2009-04-25 09:47 . 2009-04-22 15:16 -------- d-----w- c:\program files\DAEMON Tools 2009-04-23 13:54 . 2009-04-23 13:50 -------- d-----w- c:\program files\PhotoScape 2009-04-23 09:39 . 2009-04-17 11:10 -------- d-----w- c:\program files\Common Files\InstallShield 2009-04-23 09:39 . 2009-04-17 09:55 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-04-23 09:22 . 2009-04-23 09:22 -------- d-----w- c:\programdata\ATI 2009-04-23 09:20 . 2009-04-23 09:20 -------- d-----w- c:\program files\My Company Name 2009-04-23 09:19 . 2009-04-23 09:17 -------- d-----w- c:\program files\ATI Technologies 2009-04-23 09:19 . 2009-04-23 09:19 9158 ----a-r- c:\users\Krasi\AppData\Roaming\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe 2009-04-23 09:19 . 2009-04-23 09:19 -------- d-----w- c:\program files\Common Files\ATI Technologies 2009-04-23 09:18 . 2009-04-23 09:18 -------- d-----w- c:\program files\ATI 2009-04-23 09:10 . 2009-04-17 09:38 680 ----a-w- c:\users\Krasi\AppData\Local\d3d9caps.dat 2009-04-22 15:33 . 2009-04-22 15:23 -------- d-----w- c:\programdata\NFS Underground 2009-04-22 14:06 . 2009-04-22 14:05 -------- d-----w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab 2009-04-22 14:05 . 2009-04-17 11:49 -------- d-----w- c:\program files\SystemRequirementsLab 2009-04-22 14:05 . 2009-04-22 14:05 207872 ----a-w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4.dll 2009-04-22 14:05 . 2009-04-22 14:05 207872 ----a-w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_3.dll 2009-04-22 14:05 . 2009-04-22 14:05 207872 ----a-w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_2.dll 2009-04-22 14:05 . 2009-04-22 14:05 207872 ----a-w- c:\users\Krasi\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_1.dll 2009-04-22 10:31 . 2009-04-22 10:31 -------- d-----w- c:\program files\K-Lite Codec Pack 2009-04-20 11:44 . 2009-04-20 11:44 -------- d-----w- c:\users\Krasi\AppData\Roaming\Media Player Classic 2009-04-17 16:33 . 2009-04-17 16:32 -------- d-----w- c:\program files\Skype 2009-04-17 16:33 . 2009-04-17 12:13 -------- d-----w- c:\programdata\Skype 2009-04-17 16:32 . 2009-04-17 16:32 -------- d-----w- c:\program files\Common Files\Skype 2009-04-17 16:23 . 2009-04-17 16:23 -------- d-----w- c:\program files\Ahead 2009-04-17 16:23 . 2009-04-17 16:23 -------- d-----w- c:\program files\Common Files\Ahead 2009-04-17 13:37 . 2009-04-17 12:23 -------- d-----w- c:\users\Krasi\AppData\Roaming\Winamp 2009-04-17 13:02 . 2009-04-17 12:14 -------- d-----w- c:\users\Krasi\AppData\Roaming\skypePM 2009-04-17 12:32 . 2009-04-17 12:23 -------- d-----w- c:\program files\Winamp 2009-04-17 12:29 . 2009-04-17 12:29 611064 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-04-17 12:29 . 2009-04-17 12:29 142904 ----a-w- c:\windows\system32\drivers\sptddrv1.sys 2009-04-17 12:29 . 2009-04-17 12:29 -------- d-----w- c:\program files\Datecs 2009-04-17 12:26 . 2009-04-17 12:26 -------- d-----w- c:\programdata\DFX 2009-04-17 12:26 . 2009-04-17 12:26 -------- d-----w- c:\program files\DFX 2009-04-17 12:23 . 2009-04-17 12:23 -------- d-----w- c:\program files\Winamp Toolbar 2009-04-17 12:23 . 2009-04-17 12:23 -------- d-----w- c:\programdata\Winamp Toolbar 2009-04-17 12:14 . 2009-04-17 12:14 56 ---ha-w- c:\windows\system32\ezsidmv.dat 2009-04-17 12:08 . 2009-04-17 12:08 7680 ----a-w- c:\users\Krasi\AppData\Roaming\Thinstall\SkypePortable\400000150a00002i\Skype.exe 2009-04-17 12:07 . 2009-04-17 12:07 -------- d-----w- c:\users\Krasi\AppData\Roaming\Thinstall 2009-04-17 12:00 . 2009-04-17 12:00 0 ----a-w- c:\windows\nsreg.dat 2009-04-17 11:48 . 2009-04-17 11:48 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-04-17 11:48 . 2009-04-17 11:48 -------- d-----w- c:\program files\Java 2009-04-17 11:38 . 2009-04-17 11:18 37888 ----a-w- c:\windows\system32\rar.exe 2009-04-17 11:33 . 2009-04-17 11:33 -------- d-----w- c:\users\Krasi\AppData\Roaming\PC Tools 2009-04-17 11:29 . 2009-04-17 11:29 -------- d-----w- c:\users\Krasi\AppData\Roaming\GetRightToGo 2009-04-17 11:11 . 2009-04-17 11:11 -------- d-----w- c:\program files\Realtek Sound Manager 2009-04-17 11:11 . 2009-04-17 11:11 -------- d-----w- c:\program files\AvRack 2009-04-17 11:03 . 2009-04-17 11:03 -------- d-----w- c:\users\Krasi\AppData\Roaming\ATI 2009-04-17 11:02 . 2009-04-17 11:02 0 ----a-w- c:\windows\ativpsrm.bin 2009-04-17 10:44 . 2009-04-17 10:44 147456 ----a-w- c:\windows\system32\nvtpm32.dll 2009-04-17 10:10 . 2009-04-17 10:10 -------- d-----w- c:\program files\1PC Drivers HeadQuarters 2009-04-17 10:02 . 2009-04-17 10:02 -------- d-----w- c:\users\Krasi\AppData\Roaming\FlashGet 2009-04-17 09:54 . 2009-04-17 09:54 -------- d-----w- c:\programdata\PC Drivers HeadQuarters 2009-04-17 09:54 . 2009-04-17 09:54 -------- d-----w- c:\program files\PC Drivers HeadQuarters 2009-03-16 11:18 . 2009-06-06 17:39 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-03-16 11:18 . 2009-06-06 17:39 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-03-16 11:18 . 2009-06-06 17:39 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-03-16 11:18 . 2009-06-06 17:39 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-05-28 23458344] "BitComet"="c:\program files\BitComet\BitComet.exe" [2007-11-07 1881400] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-17 148888] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-09-14 157592] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2005-05-17 77824] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2009-4-17 95232] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3950373857-1089411189-3887508328-1000] "EnableNotificationsRef"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{8168822E-00E0-4400-8206-41B4DFEBBC8E}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet "UDP Query User{3DBCFF37-09B8-464B-9F74-EE752D8BD8F9}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet "TCP Query User{34C8599D-8DA7-4FF0-B2E7-00BEE8448E6F}c:\\users\\krasi\\desktop\\crack_driver.detective.6.3.3.0.exe"= UDP:c:\users\krasi\desktop\crack_driver.detective.6.3.3.0.exe:crack_driver.detective.6.3.3.0.exe "UDP Query User{8D190404-EA00-4C83-B054-6BA37E104D93}c:\\users\\krasi\\desktop\\crack_driver.detective.6.3.3.0.exe"= TCP:c:\users\krasi\desktop\crack_driver.detective.6.3.3.0.exe:crack_driver.detective.6.3.3.0.exe "{7F1DB835-81B2-47CC-8E9C-ED0691D8488D}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{4758E54C-7833-4BC0-AB50-48DE367A091C}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{4998E113-6844-4D71-B252-C49ACE28E9D5}"= c:\users\Krasi\Desktop\SkypePortable\App\Skype\Phone\Skype.exe:Skype "TCP Query User{EB485B82-144E-4C93-80E7-84AB21DC85A8}c:\\users\\krasi\\appdata\\roaming\\thinstall\\skypeportable\\400000150a00002i\\skype.exe"= UDP:c:\users\krasi\appdata\roaming\thinstall\skypeportable\400000150a00002i\skype.exe:skype.exe "UDP Query User{43331614-0A1F-402B-8EE7-B9A01011F4E9}c:\\users\\krasi\\appdata\\roaming\\thinstall\\skypeportable\\400000150a00002i\\skype.exe"= TCP:c:\users\krasi\appdata\roaming\thinstall\skypeportable\400000150a00002i\skype.exe:skype.exe "TCP Query User{A896B0B1-DA09-4AB8-A829-A926D5D28F56}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype "TCP Query User{01A71FFB-0207-4DC8-B39F-B406F4653336}c:\\program files\\hlsw\\hlsw.exe"= UDP:c:\program files\hlsw\hlsw.exe:HLSW "UDP Query User{25C7B4C9-827B-4A5A-9A4D-7212D77B2F7A}c:\\program files\\hlsw\\hlsw.exe"= TCP:c:\program files\hlsw\hlsw.exe:HLSW "TCP Query User{0F6D0A44-7F91-4EB2-863E-4B0BA1E0FE03}d:\\games\\sierra\\half-life\\hl.exe"= UDP:d:\games\sierra\half-life\hl.exe:Half-Life Launcher "UDP Query User{8322EB21-46FD-463F-B6DF-71CE9AAC9BDF}d:\\games\\sierra\\half-life\\hl.exe"= TCP:d:\games\sierra\half-life\hl.exe:Half-Life Launcher "TCP Query User{305C6423-DF31-482F-9ACB-423AD4F1CFB6}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet "UDP Query User{862B7C93-1A9E-487D-BB1F-1A15B96325F5}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet "TCP Query User{49B60488-1893-4306-8F0A-819B5ABE8EE2}d:\\games\\diablo ii\\game.exe"= UDP:d:\games\diablo ii\game.exe:Diablo II "UDP Query User{2F6B8650-0720-44B1-AA2C-7ECD37CBC1AC}d:\\games\\diablo ii\\game.exe"= TCP:d:\games\diablo ii\game.exe:Diablo II "TCP Query User{F3308F5A-520D-4621-9BCF-16F823F4D936}d:\\games\\sierra\\sierra\\half-life\\hl.exe"= UDP:d:\games\sierra\sierra\half-life\hl.exe:Half-Life Launcher "UDP Query User{FBA9B6A2-C4AF-40B7-AF9F-AB0CC632B0FA}d:\\games\\sierra\\sierra\\half-life\\hl.exe"= TCP:d:\games\sierra\sierra\half-life\hl.exe:Half-Life Launcher "{560B5F64-6370-4CB9-AA70-F34E90853884}"= UDP:9886:BitComet 9886 TCP "{404FB38A-19FE-4048-9941-CC5D05D8CBEF}"= TCP:9886:BitComet 9886 UDP "TCP Query User{D2A63A50-8FE4-4045-8FA9-9CDECD079E1D}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "UDP Query User{48E62777-366A-4B41-88D0-C56709742CF6}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "{F2BEC1A5-DC5B-4EEC-A877-8BDEB50D7812}"= UDP:9886:BitComet 9886 TCP "{519146DE-04F1-438D-ADA7-E06F72281A93}"= TCP:9886:BitComet 9886 UDP "{59C822BE-4D4D-4506-86E3-A0DD0973BA10}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.8.9506-to-3.0.9.9551-enUS-downloader.exe:Blizzard Downloader "{844275EC-E985-4C94-BA2D-DEEC88BB3B14}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.8.9506-to-3.0.9.9551-enUS-downloader.exe:Blizzard Downloader "{4E3E976E-5F0D-4BAE-8C1E-CE82C7C3BE80}"= UDP:3724:Blizzard Downloader: 3724 "TCP Query User{6B059089-BA4D-4D04-84D3-B453DA714D5F}d:\\downloads\\world of warcraft wrath of the lich king\\launcher.exe"= UDP:d:\downloads\world of warcraft wrath of the lich king\launcher.exe:Blizzard Launcher "UDP Query User{5D3C5F8F-45C6-4BA7-8590-0DFD26717A17}d:\\downloads\\world of warcraft wrath of the lich king\\launcher.exe"= TCP:d:\downloads\world of warcraft wrath of the lich king\launcher.exe:Blizzard Launcher "{B206F6D8-5A8E-411A-AA68-43719BB2589D}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe:Blizzard Downloader "{7936A227-77C0-4282-B1F8-EEBAD7E6FFF0}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe:Blizzard Downloader S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [4/17/2009 2:33 PM 356920] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ . - - - - ORPHANS REMOVED - - - - SSODL-vHdaxqUCGS-{CCCC5208-6666-F8A2-F0EF-5A90AFFC2BD6} - c:\windows\system32\oimp.dll SafeBoot-procexp90.Sys . ------- Supplementary Scan ------- . uStart Page = hxxp://google.bitcomet.com/ IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm TCP: {C98FC91A-8473-49BE-8D8D-6DC88CC21F35} = 82.103.123.254 FF - ProfilePath - c:\users\Krasi\AppData\Roaming\Mozilla\Firefox\Profiles\w6y80hb7.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query= FF - prefs.js: browser.search.selectedEngine - Winamp Search FF - prefs.js: browser.startup.homepage - hxxp://google.bg FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query= . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-08 13:23 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2009-06-08 13:25 ComboFix-quarantined-files.txt 2009-06-08 10:25 Pre-Run: 14 634 479 616 bytes free Post-Run: 14 674 964 480 bytes free 212

Аз имам същия проблем с процесора ето какво ми дава HijackThis моля помогнете ми и на мен че направо незнам какво да права вече компа толко много се бави че мн мн трудно се работи с него. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:58 ч., on 7.6.2009 г. Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\soundman.exe C:\Program Files\ESET\nod32kui.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Datecs\FlexType 2K\FType2K.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bitcomet.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O1 - Hosts: ::1 localhost O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [bitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Policies\Explorer\Run: [Windows Security Tool] WinSecure.exe O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Global Startup: FlexType 2K.lnk = C:\Program Files\Datecs\FlexType 2K\FType2K.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll (file missing) O13 - Gopher Prefix: O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-09.sun.com/s/ESD7/JSCDL/jdk...ows-i586-jc.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{C98FC91A-8473-49BE-8D8D-6DC88CC21F35}: NameServer = 82.103.123.254 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: nvrsk O21 - SSODL: vHdaxqUCGS - {CCCC5208-6666-F8A2-F0EF-5A90AFFC2BD6} - C:\Windows\system32\oimp.dll (file missing) O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe -- End of file - 4674 bytes