Моля прегледайте логовете-направете анализ.
Благодаря предварително!!!
Malwarebytes' Anti-Malware 1.41
Версия на базата от данни: 2790
Windows 5.1.2600 Service Pack 3
13.09.2009 17:15:50
mbam-log-2009-09-13 (17-15-50).txt
Тип сканиране: Бързо сканиране
Сканирани обекти: 79159
Изминало време: 4 minute(s), 33 second(s)
Заразени процеси в паметта: 0
Заразени модули в паметта: 0
Заразени ключове в регистратурата: 0
Заразени стойности в регистратурата: 1
Заразени информационни обекти в регистратурата: 1
Заразени папки: 1
Заразени файлове: 37
Заразени процеси в паметта:
(Не бяха открити заплахи)
Заразени модули в паметта:
(Не бяха открити заплахи)
Заразени ключове в регистратурата:
(Не бяха открити заплахи)
Заразени стойности в регистратурата:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.
Заразени информационни обекти в регистратурата:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Заразени папки:
C:\WINDOWS\system32\kazaabackupfiles (Worm.Archive) -> Quarantined and deleted successfully.
Заразени файлове:
C:\WINDOWS\system32\kazaabackupfiles\administrator.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\angelina.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\AquaNox2 Crack.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\AVP_Crack.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\Battlefield1942_bloodpatch.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\britney_spears.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\C&C Generals_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\celeb.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\cracker_jack.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\cracking_tools.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\FIFA2003 crack.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\free_root.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\free_shell.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\get_admin.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\hacking.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\hotmail_hack.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\kazza_hack.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\McAfee.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\msn.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\NBA2003_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\norton.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\password_stealer.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\phreaking.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\phreaking_tools.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\Porn.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\remoter.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\root.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\serial.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\sms.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\soldier_of_fortune_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\Sygate_all_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\sygate_firawall_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\tiny_personal_firewall_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\Unreal2_bloodpatch.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\UT2003_bloodpatch.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\xxx.exe (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kazaabackupfiles\zoneallarm_pro_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:23:50, on 13.09.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program FilesBlueSoleil\BlueSoleilCS.exe
C:\Program FilesBlueSoleil\BsMobileCS.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\VIA\RAID\vialogsv.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\Program FilesBlueSoleil\BsHelpCS.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.abv.bg/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send by Bluetooth - C:\Program FilesBlueSoleil\TransSend\IE\tsinfo.htm
O8 - Extra context menu item: Send via &Message... - C:\Program FilesBlueSoleil\TransSend\IE\tssms.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DE6EB81A-FE44-4152-9206-ED87F4F3FD06}: NameServer = 212.39.90.42,212.39.90.43
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\skype4com.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: BlueSoleilCS - Unknown owner - C:\Program FilesBlueSoleil\BlueSoleilCS.exe
O23 - Service: BsHelpCS - Unknown owner - C:\Program FilesBlueSoleil\BsHelpCS.exe
O23 - Service: BsMobileCS - Unknown owner - C:\Program FilesBlueSoleil\BsMobileCS.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VRAID Log Service - Unknown owner - C:\Program Files\VIA\RAID\vialogsv.exe
--
End of file - 5395 bytes