balito

Значи да напиша и аз какво открих за да не караме хората да търсят като луди. Само да предупредя все още не съм пробвал кодовете но чакам тези дни да ми донесът една Нокия 5130 и ще съобщя резултата. Nokia 5130 Xpress Music/RM-459 - Има още един телефон с този фирмуеър - Nokia 5132. 0571607 EURASIA-EJ MOLDO, Cyrillic, BLUE 0571607 EURASIA-EJ MOLDO, Cyrillic, BLUE 0571609 EURASIA-EJ MOLDO, Cyrillic, RED 0571609 EURASIA-EJ MOLDO, Cyrillic, RED

Направих го и от известно време няма проблем. Благодаря ви за вниманието

Не става със сменянето на изгледа...сега ще пробвам ъпдейтите пък ако не стане...се местя на убунту.

Прблема е... Излиза само в тази папка не съм сигурен какво е но от години не ми е правило така Ето и останалите файлове: virusinfo_syscure.zip hijackthis.txt virusinfo_syscheck.zip mbam-log-2010-10-02 (12-33-47).txt

Няма проблеми! Благодаря на HJT Team и по-точно на icotonev за вниманието

Готово! ComboFix.txt

Така готово. Друго? hijackthis1.txt mbam-log-2010-09-22 (19-20-27).txt virusinfo_syscure.zip virusinfo_syscure.xml

Сканирах го след обяд към 15:00 и после го изключих. Мисля че е RAT или някъв троянец mbam-log-2010-09-22 (14-40-33).txt

Няма никакви проблеми Инсталатора също е в изправност Благодаря много на HJT Team и по-точно на nologo Проблема е решен

Running from: C:\Documents and Settings\balito\Desktop\Win32kDiag.exe Log file at : C:\Documents and Settings\balito\Desktop\Win32kDiag.txt WARNING: Could not get backup privileges! Searching 'C:\WINDOWS'... Finished!

MalwareBytes Нещо се побърка Прикачих OTL лога Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Âåðñèÿ íà áàçàòà îò äàííè: 4373 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 7/31/2010 11:42:05 PM mbam-log-2010-07-31 (23-42-05).txt Òèï ñêàíèðàíå: Áúðçî ñêàíèðàíå Ñêàíèðàíè îáåêòè: 135856 Èçìèíàëî âðåìå: 7 ìèíóòà(è), 15 ñåêóíäà(è) Çàðàçåíè ïðîöåñè â ïàìåòòà: 0 Çàðàçåíè ìîäóëè â ïàìåòòà: 0 Çàðàçåíè êëþ÷îâå â ðåãèñòðàòóðàòà: 0 Çàðàçåíè ñòîéíîñòè â ðåãèñòðàòóðàòà: 0 Çàðàçåíè èíôîðìàöèîííè îáåêòè â ðåãèñòðàòóðàòà: 3 Çàðàçåíè ïàïêè: 0 Çàðàçåíè ôàéëîâå: 0 Çàðàçåíè ïðîöåñè â ïàìåòòà: (Íå áÿõà îòêðèòè çëîâðåäíè îáåêòè) Çàðàçåíè ìîäóëè â ïàìåòòà: (Íå áÿõà îòêðèòè çëîâðåäíè îáåêòè) Çàðàçåíè êëþ÷îâå â ðåãèñòðàòóðàòà: (Íå áÿõà îòêðèòè çëîâðåäíè îáåêòè) Çàðàçåíè ñòîéíîñòè â ðåãèñòðàòóðàòà: (Íå áÿõà îòêðèòè çëîâðåäíè îáåêòè) Çàðàçåíè èíôîðìàöèîííè îáåêòè â ðåãèñòðàòóðàòà: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Çàðàçåíè ïàïêè: (Íå áÿõà îòêðèòè çëîâðåäíè îáåêòè) Çàðàçåíè ôàéëîâå: (Íå áÿõà îòêðèòè çëîâðåäíè îáåêòè) OTL.Txt

Ето го ! Мисля че стана прекалено бързо така ли трябва да е ? Report.txt

Грешка на езика! Не след AutoClean, а след OTL.exe ми поиска рестарт. После пипах тука едни Safe Mode не знам, си какво и се оправи. Би ли ми обяснил как да маркирам тези манюта в RKUnHooker че неможах да разбера Това ми отвори когато се опитах да повторя операцията от OTL.exe All processes killed ========== FILES ========== C:\WINDOWS\SET3.tmp moved successfully. C:\WINDOWS\SET4.tmp moved successfully. C:\WINDOWS\SET8.tmp moved successfully. C:\WINDOWS\System32\CONFIG.TMP moved successfully. C:\WINDOWS\System32\kbd101a.dll.tmp moved successfully. C:\WINDOWS\System32\SET4AD.tmp moved successfully. C:\WINDOWS\System32\SET4AE.tmp moved successfully. C:\WINDOWS\System32\SET4AF.tmp moved successfully. C:\WINDOWS\System32\dllcache\SET4C0.tmp moved successfully. C:\WINDOWS\System32\dllcache\SET4C1.tmp moved successfully. C:\WINDOWS\System32\dllcache\SET4C2.tmp moved successfully. C:\WINDOWS\System32\dllcache\SET4C3.tmp moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: balito ->Temp folder emptied: 906829855 bytes ->Temporary Internet Files folder emptied: 8645171 bytes ->FireFox cache emptied: 65985451 bytes ->Google Chrome cache emptied: 244102785 bytes ->Flash cache emptied: 39078 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 402 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 98304 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 1,169.00 mb [EMPTYFLASH] User: All Users User: balito ->Flash cache emptied: 0 bytes User: Default User User: LocalService User: NetworkService Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.9.1 log created on 07312010_190411 Files\Folders moved on Reboot... File\Folder C:\Documents and Settings\balito\Local Settings\Temp\Perflib_Perfdata_bec.dat not found! Registry entries deleted on Reboot...

След като махнах тоолбар-а и използвах AutoClean искаше рестарт направих рестарт-а обаче какво да видя не се включи Преди да стигне до зареждането Всичко става черен екран! п.с. -Сега намерих един диск на Убунту и го използвам без преинсталация

хмм...Бързо стана Лог от HijackThis Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 6:33:41 PM, on 7/31/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Winamp\winampa.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Skype\Phone\Skype.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\balito\Local Settings\Application Data\Google\Update\1.2.183.29\GoogleCrashHandler.exe C:\Program Files\Datecs\FlexType 2K\FType2K.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Mozilla Firefox 4.0 Beta 1\firefox.exe C:\Program Files\Mozilla Firefox 4.0 Beta 1\plugin-container.exe D:\HijackThis.exe R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - mscoree.dll (file missing) O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Gretech Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll O3 - Toolbar: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - mscoree.dll (file missing) O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [skyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\balito\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: FlexType 2K.lnk = C:\Program Files\Datecs\FlexType 2K\FType2K.exe O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: &Експортиране към Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Free YouTube Download - C:\Documents and Settings\balito\Application Data\DVDVideoSoftIEHelpers\youtubedownload.htm O9 - Extra button: Изпрати към OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Изпрати към OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 7772 bytes OTL.Txt Extras.Txt