Planeta

Здравейте! Надявям се,че съм направила всичко както трябва. Между другото, когато изтеглях програмата от стъпка 2 отново антивирусната съобщи, че е троянски кон, както и за една от вчерашните стъпки.Този път, обаче , разреших да се стартира, дано не е било неправилно решението ми!Ето и линка с трите файла: http://rs810tl.rapidshare.com/cgi-bin/upload.cgi?rsuploadid=146792377346937591, ако е това изобщо - за първи път правя това! Планета Не става с онзи линк, проверих, ето това мисля, че е http://rapidshare.com/files/408168387/planeta_stapki123.zip MD5: 829884FD53E06EFE21ED7B134C390C4B

Ето и прикаченият фяйл от OTL след инсталацията на Service Pack 3 и рестарт след това. OTL.Txt

Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4331 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 20.7.2010 г. 16:26:04 mbam-log-2010-07-20 (16-26-04).txt Scan type: Quick scan Objects scanned: 147508 Time elapsed: 5 minute(s), 26 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 5 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Продължавам нататък!

Здравейте! Направих, каквото ми препоръчахте, с изкл. на програмата за почестването на флаш-памети, камери и т.н., защото антивирусната, която е на компютъра (AVG), открива троянски кон при стартиране на .ехе-файлът. Публикувам резултатите. С поздрав! Планета ОТ СТЪПКА 1: All processes killed ========== OTL ========== Service VcommMgr stopped successfully! Service VcommMgr deleted successfully! File C:\windows\System32\Drivers\VcommMgr.sys File not found not found. Service VComm stopped successfully! Service VComm deleted successfully! File C:\windows\System32\DRIVERS\VComm.sys File not found not found. Service catchme stopped successfully! Service catchme deleted successfully! File C:\DOCUME~1\planeta\LOCALS~1\Temp\catchme.sys File not found not found. Service Btcsrusb stopped successfully! Service Btcsrusb deleted successfully! File C:\windows\System32\Drivers\btcusb.sys File not found not found. Service BT stopped successfully! Service BT deleted successfully! File C:\windows\System32\DRIVERS\btnetdrv.sys File not found not found. Registry value HKEY_USERS\S-1-5-21-1085031214-1303643608-725345543-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully. C:\WINDOWS\system32\pdvnekhtmupxqfpjwkepvnqzsaogypvsexfai.qau moved successfully. C:\WINDOWS\pdvnekhtmupxqfpjwkepvnqzsaogypvsexfai.qau moved successfully. C:\Program Files\pdvnekhtmupxqfpjwkepvnqzsaogypvsexfai.qau moved successfully. C:\Documents and Settings\planeta\Local Settings\Application Data\pdvnekhtmupxqfpjwkepvnqzsaogypvsexfai.qau moved successfully. C:\WINDOWS\xbjryuhjsqbzinnxaeopltmlusw.mtp moved successfully. C:\WINDOWS\system32\xbjryuhjsqbzinnxaeopltmlusw.mtp moved successfully. C:\Program Files\xbjryuhjsqbzinnxaeopltmlusw.mtp moved successfully. C:\Documents and Settings\planeta\Local Settings\Application Data\xbjryuhjsqbzinnxaeopltmlusw.mtp moved successfully. C:\WINDOWS\system32\kbwrluujfqozvnaxnebpytzlhsjeztccrnywhdvi.vmj moved successfully. C:\WINDOWS\kbwrluujfqozvnaxnebpytzlhsjeztccrnywhdvi.vmj moved successfully. C:\Program Files\kbwrluujfqozvnaxnebpytzlhsjeztccrnywhdvi.vmj moved successfully. C:\Documents and Settings\planeta\Local Settings\Application Data\kbwrluujfqozvnaxnebpytzlhsjeztccrnywhdvi.vmj moved successfully. C:\WINDOWS\vnjfaklbykjvslzxogetdzgtqcuqmhrsifrqczsge.nla moved successfully. C:\Documents and Settings\planeta\Local Settings\Application Data\vnjfaklbykjvslzxogetdzgtqcuqmhrsifrqczsge.nla moved successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:BFE23423 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:F8B88761 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:A31FAD21 deleted successfully. ========== FILES ========== C:\RECYCLER\S-1-5-21-1085031214-1303643608-725345543-1003 folder moved successfully. C:\RECYCLER folder moved successfully. D:\RECYCLER\S-1-5-21-1606980848-1979792683-839522115-1003 folder moved successfully. D:\RECYCLER\S-1-5-21-1085031214-1303643608-725345543-1003 folder moved successfully. D:\RECYCLER folder moved successfully. C:\WINDOWS\0 moved successfully. C:\WINDOWS\System32\0 moved successfully. C:\windows\002901_.tmp moved successfully. C:\windows\SET3.tmp moved successfully. C:\windows\SET4.tmp moved successfully. C:\windows\SET8.tmp moved successfully. C:\windows\system32\CONFIG.TMP moved successfully. ========== COMMANDS ========== C:\windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: multiskype ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: multiskype.SOU-D3723505518 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: multiskype.SOU-D3723505518.000 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: planeta ->Temp folder emptied: 295630303 bytes ->Temporary Internet Files folder emptied: 257199 bytes ->Java cache emptied: 72948609 bytes ->FireFox cache emptied: 99928371 bytes ->Google Chrome cache emptied: 5978377 bytes ->Flash cache emptied: 30502 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 17179 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 453,00 mb OTL by OldTimer - Version 3.2.9.1 log created on 07202010_121519 Files\Folders moved on Reboot... Registry entries deleted on Reboot... ОТ СТЪПКА 2: ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=727aff257b78044b99294369a941d841 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2010-07-20 10:52:48 # local_time=2010-07-20 01:52:48 (+0200, FLE Daylight Time) # country="Bulgaria" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=1029 16777173 100 100 1185 340594 0 0 # compatibility_mode=1280 16777215 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 695 695 0 0 # scanned=53500 # found=24 # cleaned=24 # scan_time=4401 C:\Documents and Settings\planeta\Desktop\MK.exe multiple threats (deleted - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\autorun.inf.vir INF/Autorun.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\bjvhssjpc.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\pznboqjrgkb.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\vblvecr.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\brlfygftoyvfardzo.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\ibyvrcevtggtrlazrkjz.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\kbwrluujfqozvnaxne.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\ojihfswppegvvrijdyzred.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\ujcvnusfzienhxid.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\vnjfaklbykjvslzxoge.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\xrpnkwzrqeftsnddwqqht.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\brlfygftoyvfardzo.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\ibyvrcevtggtrlazrkjz.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\kbwrluujfqozvnaxne.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\ojihfswppegvvrijdyzred.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\ujcvnusfzienhxid.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\vnjfaklbykjvslzxoge.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\WINDOWS\system32\xrpnkwzrqeftsnddwqqht.exe.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\autorun.inf.vir INF/Autorun.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\bjvhssjpc.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\pznboqjrgkb.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\D\vblvecr.bat.vir a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Movie\Windows XP Turbo3D SP3 2010\Windows XP Turbo3D SP3 2010.iso Win32/Adware.ErrorRepairPro application (deleted - quarantined) 00000000000000000000000000000000 OTL.Txt

Този път всичко с програмата потече успешно, ето и прикачените файлове OTL.Txt Extras.Txt

Здравейтe!Ето как протекоха нещата при мен: и след стартиране на DDS не се получаваше нищо - появаваше се прозорец, който ме предупреждаваше за някаква опасност и след затваряне на прозореца се затваряше и тази програма. Свалих си най-важните неща на дискове и пуснах COMBOFIX, съгласявах се на каквото ми искаше и запазих log.tхt, но след рестартиране на компютъра отново изникна проблем - NTLDR is missing. След много ровене из нета, колебание, опити и страх се справих. Отново ми се стартира Windows без преинсталиране, сложих му AVG, смятам, че сега е чиста системата, но знае ли човек )! Благодаря ви за помощта, както на вас, така и на всички хора, които го правят из нета. Поздрави, Планета! Прикачвам и log.tхt от COMBOFIXв случай,че проявявате интерес. log.txt

Тази програма я изтеглихме още вчера със сина ми, мой колега я препоръча, но не се решихме да я стартираме, защото синът ми каза, че не е сигурен какво точно ще се изтрие с нея. Тази вечер ще прекратя временно опитите си, но утре ще запиша на дискове най-важните си неща от лаптопа и ще пробвам с комбо-то. Но ми се струва,че нещата отиват къв формат С и всичко отначало. Много Ви благодаря, че ми отделихте толково време. Във всички случаи ще напиша какво се случва при мен. Лека вечер!

и този път не се получи. отначало започва работа, и секунди след това отново излезе съобщение за поставяне на диск.

ок, започвам отново ..................

.................. Здравейте! какво означава "само това ,което е поставено в кода" - това са всичките тези имена, които са в полето след думите Ви в кавичките ли? Ако е така, направих го, но се появи съобщение, че няма диск в СД устройството, да го поставя, след което с малко усилия спрях процеса. Извинявам се, вероятно не се изразявам най-правилно ,но в някои отношения съм аматьор в комп.работи.

Здравейте! Моля за съвет/помощ за следния проблем.След сваляне на снимки и клипове от камера на компютър, установихме, че много бавно или никак не се стартират клипчетата, с която и да е инсталирана на РС-то програма, а такъв проблем до преди седмица нямаше. Когато включиха камерата на друг компютър, антивирусната му програма веднага улови вирус. Оказа се, че на моя компютър няма инсталирана защита. Започнахме да търсим в интернет антивирусни програми, но при желание за теглене страниците се затваряха сами. След това опитахме с антивирусни на флаш-памет - вирусът се залепи и там. Резултатът е заразен компютър, камера и флаш. Ако някой знае какво би могло да се направи, ще бъда благодарна!