HiJackThis/Log :Оптимизация/Анализ/Ревю

6 юли 200916 г.

Моля, архивирайте папка Qoobox, която се намира в C:\ и я прикачете в http://www.4storing.com . Накрая публикувайте линка тук.

След това:

За да деинсталирате ComboFix и всички резервни копия на файлове, които той премахва:

* Кликнете върху бутона Start и изберете Run
* Въведете ComboFix /u в полето и изберете OK

Бележка: Забележете, че има разстояние между ComboFix и /u, което задължително трябва да има.

Изчистете създадени точки в System Restore: Start -> Run -> cleanmgr -> More Options -> System Restore -> Clean up

След, като завършите всичко, инсталирайте антивирусен софтуер по ваш избор.

Накрая очаквам папката Qoobox и информация, че сте спазили инструкциите ми, инсталирали сте антивирусната и тя работи нормално. След, което Ви оставям на мира

6 юли 200916 г.

здравейте стигнах до Start -> Run -> cleanmgr -> More Options -> System Restore -> Clean up

но след като напиша:

cleanmgr ме пита директно кой диск избирам C или D и започва Disc Cleanup ...няма More Options -> System Restore -> Clean up

ето линка :

http://4storing.com/sfc6bj/d52efba53612e85...ca86d61f21.html

6 юли 200916 г.

Оставете System Restore. Почистете отново с ATF-Cleaner и това ще бъде края. Инсталирайте ли си антивирусна програма? Всичко наред ли е сега?

6 юли 200916 г.

БЛАГОДАРЯ!!!!!!!!!! :ya :yanim: :yanim: nim: :yanim: nim: :yanim: nim:

СТРАХОТНИ ПРОФЕСИОНАЛИСТИ ИМА В ТОЗИ САЙТ!

ВСИЧКО РАБОТИ КАКТО ТРЯБВА СЕГА!!!!

6 юли 200916 г.

Моля, ние благодарим! Случаят Ви наистина беше доста сериозен, радвам се, че сега всичко е наред.

Бих Ви препоръчал да си направите оптимизация на Windows:

http://www.eset.bg/forum/viewtopic.php?f=6...cdbe54e65dca0b0

Убеден съм, че след такава инфектираност сте изгубили доста от производителността.

Успех! :yanim:

7 юли 200916 г.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:15:35, on 07.7.2009 г.

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\D-Tools\daemon.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Skype\Phone\Skype.exe

C:\WINDOWS\system32\CTFMON.EXE

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Opera\opera.exe

C:\HiJackThis\lol.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [steam] "C:\Program Files\Steam\Steam.exe" -silent

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O17 - HKLM\System\CCS\Services\Tcpip\..\{440D54F5-4F49-4FA0-B514-6AA6673683CE}: NameServer = 192.168.0.6,87.120.104.193

O17 - HKLM\System\CCS\Services\Tcpip\..\{B51CCB5E-34C4-4F78-81FF-406AAB743741}: NameServer = 87.120.104.193 212.73.154.2

O17 - HKLM\System\CS1\Services\Tcpip\..\{440D54F5-4F49-4FA0-B514-6AA6673683CE}: NameServer = 192.168.0.6,87.120.104.193

O17 - HKLM\System\CS2\Services\Tcpip\..\{440D54F5-4F49-4FA0-B514-6AA6673683CE}: NameServer = 192.168.0.6,87.120.104.193

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: WM System Decode Application - Unknown owner - C:\WINDOWS\system\msdct.exe (file missing)

--

End of file - 3563 bytes

Има ли нещо нередно ? :S

7 юли 200916 г.

В момента почистваме системата Ви, моля следвайте инструкциите ми!

7 юли 200916 г.

А какви са ви инструкциите ? :shake_puter:

7 юли 200916 г.

Не разбрахте ли, че всичките ни постове са преместени?

http://www.kaldata.com/forums/index.php?sh...5&start=915

13 юли 200916 г.

Здравете.

Логът не е от моят компютър. Поводът да го постна е чувствителното забавяне на компютъра. Ако можете да ми дадете съвети, дали това е поправимо. Често явление се превърна и съобщението за намаляла виртуална памет, макар на С:-то и D:-то да има по над 4 GB.

Вируси няма.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:12:31, on 13.7.2009 г.

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\Good-Luck.ru\Chinese Coin\Chinese Coin.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\atiptaxx.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\drivers\CDAC11BA.EXE

C:\WINDOWS\system32\crypserv.exe

C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

C:\Program Files\Norton Utilities\NPROTECT.EXE

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\WINDOWS\System32\tcpsvcs.exe

C:\Program Files\Speed Disk\nopdb.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZONELABS\vsmon.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\gergana\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll

O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [Chinese Coin] C:\Program Files\Good-Luck.ru\Chinese Coin\Chinese Coin.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Startup: rncsys32.exe

O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm

O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1245870464562

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1245870360531

O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{2AAE8E93-64A3-4092-B181-A2CCE1D5B2FE}: NameServer = 212.39.90.42,212.39.90.43

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE

O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe

O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe

O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: ELAN TTS Speech Cube Service (SpeechCube TTS) - ELAN Speech - C:\Program Files\ELAN Speech\Speech Cube\Bin\SpeechCube.exe

O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZONELABS\vsmon.exe

--

End of file - 7573 bytes

ПС: В случай, че е нужен някакъв диалог, притежателят на компютъра от който е логът ще се включи.

Лек ден.

13 юли 200916 г.

Без да преглеждам лога...видях вирус...троянец...провери с програмата от подписа ми...после ще пиша пак или ще ви прехвърля на колегите. :speak:

O4 - Startup: rncsys32.exe

13 юли 200916 г.

Без да преглеждам лога...видях вирус...троянец...провери с програмата от подписа ми...после ще пиша пак или ще ви прехвърля на колегите.
O4 - Startup: rncsys32.exe

Благодаря ти за мигновената реакция. Дано професионализмът ти премахне скептичността му и да обърне внимание на поддръжката на компютъра си, която е занемарил и да пише сам, ако се наложи.

13 юли 200916 г.

Да поправи този ред в HijackThis, да деинсталира всички тулбари...и да замени adware - Download Accelerator Plus (DAP) с нещо по нормално като (Flashget или Orbit Download Manager).

Добре е да почисти и временните файлове, защото този паразит най-много там вършее:

http://www.threatexpert.com/report.aspx?md...c82edb00b24ba73

Понеже аз нямам време за допълнителни разяснения се обърни към колегата Fixer, за да довършите почистването на системата.

Няма да е лошо да публикувате и лог файла от проверката с Malwarebytes' за да улесните работата му.

Поздрави !

13 юли 200916 г.

Нека бъде направено следното:

Сега, изтеглете ATF Cleaner

Запазете го на вашия десктоп.

Кликнете два пъти върху ATF-Cleaner.exe , за да стартирате програмата.
Кликнете на Select All, който се намира в най-долната част на списъка.
Кликнете на бутона Empty Selected.

Ако използвате браузъра Mozilla Firefox, направете следното:

Кликнете върху Firefox, който се намира в началото и изберете Select All от списъка.
Кликнете на бутона Empty Selected.
Бележка: Ако искате да съхраните запазените пароли, моля кликнете на No от новопоявилия се прозорец.

Ако използвате браузъра Opera, направете следното:

Кликнете върху Opera който се намира в началото и изберете Select All от списъка.
Кликнете на бутона Empty Selected.
Бележка: Ако искате да съхраните запазените пароли, моля кликнете на No от новопоявилия се прозорец.

Кликнете на бутона Exit, който се намира в главното меню, за да затворите програмата.

След това:

1) Изтеглете ComboFix от: тук

2) Запазете го на работния си плот (десктоп).

3) Изключете Real-Time защитата на Avira AntiVir.

4) Кликнете два пъти върху combofix.exe

5) ComboFix ще започне да сканира вашата система, докато трае сканирането не барайте нищо. Накрая ще се рестартира компютъра Ви.

6) След рестарта изчакайте да завърши сканирането на ComboFix и да генерира лог файл. Когато сканирането завърши ще Ви изскочи Notepad, копирайте съдържанието му и го публикувайте в следващия си пост тук. Ако не Ви изскочи, влезте в C:\ и намерете файл с името combofix.txt . Отворете го, копирайте съдържанието му и го публикувайте тук. В случай на проблем, ComboFix създава и файл с име BUG.txt, ако съществува, моля копирайте и поставете и неговото съдържание.

13 юли 200916 г.

Нека бъде направено следното:
...

Изпълних указанията. Ето логът:

ComboFix 09-07-13.01 - 07.2009 г. 21:22.1.1 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.511.279 [GMT 3:00]

Running from: c:\documents and settings\gergana\Desktop\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000}

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804E5358-FFA4-00D9-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804E5358-FFA4-00EB-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804E5358-FFA4-00FC-0D24-347CA8A3377C}

FW: ZoneAlarm Pro Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\documents and settings\gergana\Application Data\wiaserva.log

c:\documents and settings\gergana\Start Menu\Programs\Startup\rncsys32.exe

c:\windows\a3kebook.ini

c:\windows\akebook.ini

c:\windows\ANS2000.INI

c:\windows\Installer\75d0b4.msi

c:\windows\system32\Cache

c:\windows\system32\Drivers\joxvr.sys

c:\windows\system32\msconfig.exe

c:\windows\system32\tmp.reg

----- BITS: Possible infected sites -----

hxxp://tmaproject.ru

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_hfmow

((((((((((((((((((((((((( Files Created from 2009-06-13 to 2009-07-13 )))))))))))))))))))))))))))))))

.

2009-07-13 17:04 . 2009-07-13 17:04 0 ----a-w- c:\windows\nsreg.dat

2009-07-11 23:11 . 2004-08-03 21:56 21504 ----a-w- c:\windows\system32\hidserv.dll

2009-07-11 23:11 . 2004-08-03 21:56 21504 ----a-w- c:\windows\system32\dllcache\hidserv.dll

2009-07-09 05:59 . 2009-07-09 05:59 -------- d-----w- c:\documents and settings\Vorfax

2009-07-02 00:24 . 2009-07-02 00:24 -------- d-----w- c:\program files\MITCalc

2009-07-01 03:25 . 2009-07-01 03:25 -------- d-sh--w- C:\FOUND.004

2009-06-30 11:53 . 2009-06-30 11:53 -------- d-----w- c:\program files\Freia 15 (AllSiemens.com)

2009-06-30 11:07 . 2009-06-30 11:07 -------- d-sh--w- C:\FOUND.003

2009-06-30 05:54 . 2009-06-30 05:54 -------- d-sh--w- C:\FOUND.002

2009-06-25 04:59 . 2009-06-25 04:59 -------- d-----w- c:\documents and settings\gergana\Application Data\Media Player Classic

2009-06-24 18:53 . 2009-06-24 18:53 -------- d-----w- c:\windows\SxsCaPendDel

2009-06-19 14:48 . 2009-06-19 14:48 -------- d-----w- c:\documents and settings\gergana\Application Data\URSoft

2009-06-19 14:48 . 2009-06-19 14:48 -------- d-----w- c:\program files\Your Uninstaller 2008

2009-06-19 13:08 . 2009-06-19 13:08 -------- d-----w- c:\documents and settings\gergana\Application Data\TuneUp Software

2009-06-19 13:08 . 2009-06-19 13:08 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-13 18:30 . 2009-07-13 18:32 135680 ------w- c:\windows\Internet Logs\xDB1.tmp

2009-07-11 20:33 . 2009-07-11 20:51 115200 ------w- c:\windows\Internet Logs\xDB4.tmp

2009-06-19 14:15 . 2009-01-15 20:13 3561743 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-06-17 08:27 . 2008-12-24 19:11 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-06-17 08:27 . 2008-12-24 19:11 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-06-16 07:45 . 2007-05-15 15:59 25 ----a-w- c:\windows\popcinfo.dat

2009-06-08 23:32 . 2009-06-08 23:31 1028096 ----a-w- c:\windows\system32\mfc42.dll

2009-06-08 23:31 . 2009-06-08 23:31 1060864 ----a-w- c:\windows\system32\MFC71.dll

2009-06-06 22:01 . 2009-06-06 22:01 -------- d-----w- c:\program files\Avira

2009-06-06 22:01 . 2009-06-06 22:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2009-06-04 22:27 . 2009-06-04 22:27 -------- d-----w- c:\documents and settings\gergana\Application Data\Blender Foundation

2009-06-04 22:27 . 2009-06-04 22:27 -------- d-----w- c:\program files\Blender Foundation

2009-05-29 15:42 . 2009-05-29 15:42 12288 ----a-w- c:\windows\system32\impborl.dll

2009-05-13 03:53 . 2008-07-19 12:41 2932 ----a-w- c:\windows\system32\d3d9caps.dat

2009-04-19 00:24 . 2007-12-10 22:22 766 ----a-r- c:\documents and settings\gergana\Application Data\Microsoft\Installer\{00F1BC5B-39E0-4038-B123-D274C9D775FB}\_63ed66f2.exe

2009-04-19 00:24 . 2007-12-10 22:22 766 ----a-r- c:\documents and settings\gergana\Application Data\Microsoft\Installer\{00F1BC5B-39E0-4038-B123-D274C9D775FB}\_3277c98.exe

2009-04-19 00:24 . 2007-12-10 22:22 3774 ----a-r- c:\documents and settings\gergana\Application Data\Microsoft\Installer\{00F1BC5B-39E0-4038-B123-D274C9D775FB}\_60475d34.exe

2009-04-18 19:25 . 2006-10-18 12:54 5710024 ------w- c:\windows\Internet Logs\tvDebug.Zip

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-29 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-15 981384]

"Chinese Coin"="c:\program files\Good-Luck.ru\Chinese Coin\Chinese Coin.exe" [2006-09-27 1210981]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]

"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2002-09-11 46592]

"AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2002-07-26 290816]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Photo Downloader"="d:\nokia\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\System32\\ZoneLabs\\vsmon.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping

"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)

"17002:TCP"= 17002:TCP:BitComet 17002 TCP

"17002:UDP"= 17002:UDP:BitComet 17002 UDP

"20922:TCP"= 20922:TCP:BitComet 20922 TCP

"20922:UDP"= 20922:UDP:BitComet 20922 UDP

"7219:TCP"= 7219:TCP:BitComet 7219 TCP

"7219:UDP"= 7219:UDP:BitComet 7219 UDP

"8661:TCP"= 8661:TCP:BitComet 8661 TCP

"8661:UDP"= 8661:UDP:BitComet 8661 UDP

"18960:TCP"= 18960:TCP:BitComet 18960 TCP

"18960:UDP"= 18960:UDP:BitComet 18960 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

R0 Si3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [23.10.2008 г. 00:45 116264]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [07.6.2009 г. 01:01 108289]

R2 NProtectService;Norton Unerase Protection;c:\program files\Norton Utilities\NPROTECT.EXE [05.3.2006 г. 17:23 135168]

S1 ace497a9;ace497a9;c:\windows\system32\drivers\ace497a9.sys --> c:\windows\system32\drivers\ace497a9.sys [?]

S3 SpeechCube TTS;ELAN TTS Speech Cube Service;c:\program files\ELAN Speech\Speech Cube\Bin\SpeechCube.exe [14.1.2003 г. 15:04 159827]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

.

Contents of the 'Scheduled Tasks' folder

2009-05-18 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]

.

------- Supplementary Scan -------

.

uStart Page = about:blank

mStart Page = hxxp://www.msn.com

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &Download with &DAP - c:\progra~1\DAP\dapextie.htm

IE: Download &all with DAP - c:\progra~1\DAP\dapextie2.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

TCP: {2AAE8E93-64A3-4092-B181-A2CCE1D5B2FE} = 212.39.90.42,212.39.90.43

Name-Space Handler: HTTPS\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\DAP\dapie.dll

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-07-13 21:33

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3776)

c:\windows\IME\SPGRMR.DLL

c:\program files\Haali\MatroskaSplitter\mmfinfo.dll

c:\program files\Haali\MatroskaSplitter\mkunicode.dll

c:\program files\Microsoft Office\Office10\msohev.dll

c:\progra~1\FICTIO~1\FBShell.dll

c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\system32\drivers\CDAC11BA.EXE

c:\windows\system32\crypserv.exe

c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe

c:\program files\CyberLink\Shared files\RichVideo.exe

c:\windows\System32\tcpsvcs.exe

c:\program files\Speed Disk\nopdb.exe

c:\windows\system32\ZONELABS\vsmon.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-07-13 21:39 - machine was rebooted

ComboFix-quarantined-files.txt 2009-07-13 18:38

Pre-Run: 4 387 323 904 bytes free

Post-Run: 4 218 175 488 bytes free

185

Прикачвам и лог от прекъснатият (за да изпълня горното) сканиране на Malwarebytes' Anti-Malware. Сканирам наново с него.

mbam_log_2009_07_13__21_14_58_.txt

13 юли 200916 г.

Отворете Notepad и чрез комбинацията copy/paste поставете следния текст:

Killall::


File::

c:\windows\Internet Logs\xDB1.tmp

c:\windows\Internet Logs\xDB4.tmp

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След като, програмата приключи ще Ви изведе лог файла. Отново чрез комбинацията от Copy/Paste поставете информацията тук.

Редактирано 13 юли 200916 г. от Fixer (преглед на промените)

13 юли 200916 г.

По ред.

След влаченето ми изведе следното:

а малко по-късно и това:

Постъпил съм така както се вижда от принтскрийните. Как да тълкувам случилото се?

Ето и логът:

ComboFix 09-07-13.01 - gergana 07.2009 г. 22:38.2.1 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.511.216 [GMT 3:00]

Running from: c:\documents and settings\gergana\Desktop\ALL\ComboFix.exe

Command switches used :: c:\documents and settings\gergana\Desktop\CFScript.txt

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000}

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804E5358-FFA4-00D9-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804E5358-FFA4-00EB-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804E5358-FFA4-00FC-0D24-347CA8A3377C}

FW: ZoneAlarm Pro Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

"c:\windows\Internet Logs\xDB1.tmp"

"c:\windows\Internet Logs\xDB4.tmp"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\Internet Logs\xDB1.tmp

c:\windows\Internet Logs\xDB4.tmp