HiJackThis/Log :Оптимизация/Анализ/Ревю

3 май 200917 г.

Malwarebytes' Anti-Malware 1.36

Database version: 2072

Windows 5.1.2600 Service Pack 3

04.05.2009 02:44:21

mbam-log-2009-05-04 (02-44-21).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 221999

Time elapsed: 23 minute(s), 49 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Trojan.Agent) -> Data: snapapi32.dll -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\snapapi32.dll (Trojan.Agent) -> Quarantined and deleted successfully.

3 май 200917 г.

Това е добре. Оправи сега антивирусната програма.

4 май 200917 г.

Здравейте,моля някой да погледне тук.При опит да се пусне филм ,компа забива и се рестартира ,предполагам видеото но може от друго да е.Благодаря предварително. Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 6:11:53 PM, on 5/4/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RunDll32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\HiJackThis\poaro.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O4 - S-1-5-18 Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe (User 'Default user')

O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: I?aaaae - {60237576-b24c-4ba9-9740-c9f3ec9db557} - C:\PROGRA~1\SkyCode\WebTrance30\wt2ie.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll

O20 - AppInit_DLLs: C:\PROGRA~1\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd.dll,C:\PROGRA~1\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd3.dll,C:\PROGRA~1\Kaspersky Lab\Kaspersky Internet Security 2009\adialhk.dll,C:\PROGRA~1\Kaspersky Lab\Kaspersky Internet Security 2009\kloehk.dll

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--

End of file - 6235 bytes

Редактирано 4 май 200917 г. от demos (преглед на промените)

4 май 200917 г.

Здравей!

В лога ти няма нищо съмнително. Единственото, което можеш да барнеш е Yahoo Tollbar, мисля че нямаш нужда от него и е добре да го деинсталираш. Можеш да пуснеш и едно сканиране с MalwareBytes' Anti-Malware и да пуснеш лог файл накрая тук, за да видим какво е положението.

Изтеглете Malwarebytes' Anti-Malware от тук

Кликнете два пъти върху mbam-setup.exe за да инсталирате програмата.

* Уверете се, че има отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware, след това кликнете на Finish.
* Ако има намерени по-нови обновления, тя ще ги изтегли и инсталира.
* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
* Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
* Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
* Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Бележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

4 май 200917 г.

Благодаря ,ето го и следващия етап : Malwarebytes' Anti-Malware 1.36

Версия на базата от данни: 2074

Windows 5.1.2600 Service Pack 3

5/4/2009 9:32:04 PM

mbam-log-2009-05-04 (21-32-04).txt

Тип сканиране: Пълно сканиране (C:\|D:\|E:\|)

Сканирани обекти: 94864

Изминало време: 9 minute(s), 26 second(s)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 0

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 0

Заразени файлове: 0

Заразени процеси в паметта:

(Не бяха открити заплахи)

Заразени модули в паметта:

(Не бяха открити заплахи)

Заразени ключове в регистратурата:

(Не бяха открити заплахи)

Заразени стойности в регистратурата:

(Не бяха открити заплахи)

Заразени информационни обекти в регистратурата:

(Не бяха открити заплахи)

Заразени папки:

(Не бяха открити заплахи)

Заразени файлове:

(Не бяха открити заплахи)

За съжаление проблемът е в видеокартата явно.

4 май 200917 г.

Както сам виждате проблемът не е поради инфекция на системата Ви. Нямам представа какъв е проблема Ви, можете да попитате в раздел Хардуер.

6 май 200917 г.

Компа отказа да се включи и след 30 мин. опитване го включих някак си ..

Logfile of HijackThis v1.99.1

Scan saved at 12:16:25, on 6.5.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\MioNet\MioNetManager.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\MioNet\jvm\bin\MioNet.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\nvraidservice.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\VM_STI.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\LClock\lclock.exe

C:\Program Files\Winamp Remote\bin\OrbTray.exe

C:\WINDOWS\system32\wbem\unsecapp.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Speaking Clock Deluxe\SpClDlx.exe

C:\Documents and Settings\pipi\Application Data\advantage\AdVantage.exe

C:\Program Files\SwitchType\SwitchType.exe

C:\Documents and Settings\pipi\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [bigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC210NC Webcam

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe

O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKCU\..\Run: [speaking Clock Deluxe] "C:\Program Files\Speaking Clock Deluxe\SpClDlx.exe"

O4 - HKCU\..\Run: [AdVantage] C:\Documents and Settings\pipi\Application Data\advantage\AdVantage.exe

O4 - Startup: SwitchType.lnk = C:\Program Files\SwitchType\SwitchType.exe

O4 - Global Startup: TrayMin210.exe.lnk = ?

O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html

O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html

O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html

O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O11 - Options group: [iNTERNATIONAL] International*

O11 - Options group: [TABS] Tabbed Browsing

O13 - Gopher Prefix:

O17 - HKLM\System\CCS\Services\Tcpip\..\{C993C58F-6F6B-41FF-B1A6-5D8A8D2C6D06}: NameServer = 89.106.106.2 89.106.106.8

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe" -s "C:\Program Files\MioNet\wrapper.conf (file missing)

6 май 200917 г.

Отворете HiJackThis, изберете Do a system scan only и сложете отметки на следните редове:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

O4 - HKCU\..\Run: [AdVantage] C:\Documents and Settings\pipi\Application Data\advantage\AdVantage.exe

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe" -s "C:\Program Files\MioNet\wrapper.conf (file missing)

Накрая затворете браузъра си и изберете Fix Checked.

След това:

Изтеглете Malwarebytes' Anti-Malware от тук

Кликнете два пъти върху mbam-setup.exe за да инсталирате програмата.

* Уверете се, че има отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware, след това кликнете на Finish.
* Ако има намерени по-нови обновления, тя ще ги изтегли и инсталира.
* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
* Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
* Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
* Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Бележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Очаквам лог файл от MalwareBytes' Anti-Malware.

Накрая направете и нов лог файл от HiJackThis.

6 май 200917 г.

След като изтеглих и започнах да сканирам с Malwarebytes' Anti-Malware стига до някаде и бъгва системата.Два пъти се едно и също... не можеш да направиш нищо... само рестарт :S до този момент беше открило 166 инфектирани файла. Сега какво да правя ?

6 май 200917 г.

1) Изтеглете ComboFix от: тук

2) Запазете го на работния си плот (десктоп).

3) Кликнете два пъти върху combofix.exe

4) ComboFix ще започне да сканира вашата система, докато трае сканирането не барайте нищо. Накрая ще се рестартира компютъра Ви.

5) След рестарта изчакайте да завърши сканирането на ComboFix и да генерира лог файл. Когато сканирането завърши ще Ви изскочи Notepad, копирайте съдържанието му и го публикувайте в следващия си пост тук. Ако не Ви изскочи, влезте в C:\ и намерете файл с името combofix.txt . Отворете го, копирайте съдържанието му и го публикувайте тук.

6 май 200917 г.

ComboFix 09-05-05.04 - pipi 06.05.2009 17:45.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.381.1033.18.255.68 [GMT 3:00]

Running from: c:\documents and settings\pipi\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\pipi\Application Data\.#

c:\windows\TEMP\tga1.tmp

.

((((((((((((((((((((((((( Files Created from 2009-04-06 to 2009-05-06 )))))))))))))))))))))))))))))))

.

2009-05-06 10:00 . 2009-05-06 10:00 -------- d-----w c:\documents and settings\pipi\Application Data\Malwarebytes

2009-05-06 10:00 . 2009-04-06 12:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-05-06 10:00 . 2009-04-06 12:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-06 10:00 . 2009-05-06 10:00 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2009-05-06 10:00 . 2009-05-06 10:00 -------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-04-26 20:32 . 2009-04-26 20:32 -------- d-----w C:\Favorite-Games

2009-04-26 19:55 . 2009-04-26 19:55 -------- d-----w c:\program files\Games

2009-04-25 12:56 . 2009-04-25 12:56 -------- d-----w c:\windows\Logs

2009-04-25 12:54 . 2009-04-25 12:54 -------- d-----w c:\program files\Idoru

2009-04-25 10:46 . 2009-04-25 10:46 -------- d-----w c:\program files\Namco

2009-04-20 20:41 . 2009-04-20 20:41 -------- d-----w c:\program files\KONAMI

2009-04-20 20:36 . 2009-04-20 20:36 223128 ----a-w c:\windows\system32\drivers\dtscsi.sys

2009-04-20 20:36 . 2009-04-20 20:36 -------- d-----w c:\program files\DAEMON Tools

2009-04-20 19:37 . 2009-04-20 19:37 -------- d-----w c:\program files\phenomedia

2009-04-20 00:55 . 2009-04-20 00:56 -------- d-----w c:\program files\New Star Soccer 3

2009-04-20 00:55 . 2009-04-20 00:55 -------- d-----w c:\program files\New Star Soccer 4

2009-04-20 00:54 . 2009-04-20 00:54 -------- d-----w c:\program files\FIFA Soccer

2009-04-17 20:24 . 2009-04-29 22:03 -------- d-----w c:\program files\Poker Indicator

2009-04-12 11:56 . 2009-04-12 11:56 -------- d-----w c:\documents and settings\pipi\Application Data\Windows Search

2009-04-10 00:17 . 2009-04-10 00:17 -------- d-----w c:\documents and settings\All Users\Application Data\TreeCardGames

2009-04-10 00:17 . 2009-04-10 20:01 -------- d-----w c:\documents and settings\pipi\Application Data\SolSuite

2009-04-10 00:17 . 2009-04-10 00:17 -------- d-----w c:\program files\SolSuite

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-06 14:47 . 2009-04-04 19:17 -------- d-----w c:\program files\SwitchType

2009-05-06 10:38 . 2009-03-17 13:43 -------- d-----w c:\program files\AdVantage

2009-04-20 20:43 . 2009-03-17 13:31 -------- d--h--w c:\program files\InstallShield Installation Information

2009-04-20 20:38 . 2009-03-17 13:26 -------- d-----w c:\program files\Common Files\InstallShield

2009-04-20 19:50 . 2009-04-05 00:19 -------- d-----w c:\program files\GameHouse

2009-04-17 20:23 . 2009-04-05 00:24 -------- d-----w c:\program files\[AIO] BEST POKER COLLECTION 2007

2009-04-17 10:20 . 2009-04-05 00:23 -------- d-----w c:\program files\Mahjong Fortuna 2 Deluxe

2009-04-05 03:31 . 2009-04-05 02:39 -------- d-----w c:\program files\Full Tilt Poker

2009-04-05 00:31 . 2009-04-05 00:17 -------- d-----w c:\program files\Secrets Of Great Art

2009-04-05 00:18 . 2009-04-05 00:18 -------- d-----w c:\program files\Google

2009-04-04 23:50 . 2009-04-04 23:49 -------- d-----w c:\program files\harry

2009-04-04 19:18 . 2009-04-04 19:18 -------- d-----w c:\program files\Speaking Clock Deluxe

2009-04-04 11:25 . 2009-04-04 11:25 49520 ----a-w c:\documents and settings\pipi\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-03-31 00:34 . 2009-03-17 13:43 -------- d-----w c:\program files\BitComet

2009-03-30 05:58 . 2009-03-30 05:58 -------- d-----w c:\program files\Women's Murder Club - Death in Scarlet

2009-03-28 00:49 . 2009-03-28 00:49 -------- d-----w c:\program files\Common Files\SWF Studio

2009-03-27 20:11 . 2009-03-27 20:07 -------- d-----w c:\program files\Satisfashion

2009-03-27 20:10 . 2009-03-27 20:10 -------- d-----w c:\program files\Tradewinds 2

2009-03-27 20:07 . 2009-03-27 20:07 -------- d-----w c:\program files\ReflexiveArcade

2009-03-27 20:06 . 2009-03-27 20:05 -------- d-----w c:\program files\Wendys Wellness

2009-03-27 20:05 . 2009-03-27 20:04 -------- d-----w c:\program files\Nick Chase A Detective Story

2009-03-27 20:04 . 2009-03-27 20:04 -------- d-----w c:\program files\Nick Chase A Detective Story Strategy Guide

2009-03-27 20:03 . 2009-03-27 20:03 -------- d-----w c:\program files\Azteca

2009-03-26 21:42 . 2009-03-26 21:42 -------- d-----w c:\program files\Philips

2009-03-24 19:03 . 2009-03-24 19:02 -------- d-----w c:\program files\Shop-n-Spree

2009-03-23 19:04 . 2009-03-23 19:04 -------- d-----w c:\program files\Farm Craft

2009-03-23 19:03 . 2009-03-23 19:02 -------- d-----w c:\program files\Jane's Realty

2009-03-22 20:56 . 2009-03-22 20:56 -------- d-----w c:\program files\Dress Shop Hop

2009-03-21 18:50 . 2009-03-21 18:50 -------- d-----w c:\program files\Party Down

2009-03-21 11:35 . 2009-03-21 11:35 -------- d-----w c:\program files\AskBarDis

2009-03-21 11:35 . 2009-03-21 11:35 -------- d-----w c:\program files\Foxit Software

2009-03-21 10:54 . 2009-03-21 10:54 -------- d-----w c:\program files\Microsoft ActiveSync

2009-03-21 10:53 . 2009-03-21 10:53 -------- d-----w c:\program files\Microsoft.NET

2009-03-21 10:40 . 2009-03-21 10:40 717296 ----a-w c:\windows\system32\drivers\sptd.sys

2009-03-20 19:59 . 2009-03-20 19:59 -------- d-----w c:\program files\Wedding Dash

2009-03-20 10:18 . 2009-03-20 10:17 -------- d-----w c:\program files\Ranch Rush

2009-03-19 11:33 . 2009-03-19 11:32 -------- d-----w c:\program files\Top Chef

2009-03-18 10:16 . 2009-03-18 09:17 -------- d-----w c:\program files\Datecs

2009-03-18 10:04 . 2009-03-18 09:17 8992 ----a-w c:\windows\system32\KBDBPH.dLL

2009-03-17 22:51 . 2009-03-17 12:53 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-03-17 19:07 . 2009-03-17 19:07 56 ---ha-w c:\windows\system32\ezsidmv.dat

2009-03-17 18:47 . 2009-03-17 18:47 0 ----a-w c:\windows\nsreg.dat

2009-03-17 18:38 . 2009-03-17 18:37 -------- d-----w c:\program files\ATI Technologies

2009-03-17 18:33 . 2009-03-17 18:33 -------- d-----w c:\program files\Skype

2009-03-17 18:33 . 2009-03-17 18:33 -------- d-----w c:\program files\Common Files\Skype

2009-03-17 13:51 . 2009-03-17 13:51 -------- d-----w c:\program files\Ahead

2009-03-17 13:51 . 2009-03-17 13:51 -------- d-----w c:\program files\Common Files\Ahead

2009-03-17 13:45 . 2009-03-17 13:44 -------- d-----w c:\program files\Winamp

2009-03-17 13:45 . 2009-03-17 13:45 -------- d-----w c:\program files\Winamp Remote

2009-03-17 13:44 . 2009-03-17 13:44 2560 ----a-w c:\windows\system32\bitcometres.dll

2009-03-17 13:42 . 2009-03-17 13:42 -------- d-----w c:\program files\Webteh

2009-03-17 13:42 . 2009-03-17 13:42 -------- d-----w c:\program files\K-Lite Codec Pack

2009-03-17 13:32 . 2009-03-17 13:32 -------- d-----w c:\program files\Realtek Sound Manager

2009-03-17 13:32 . 2009-03-17 13:32 -------- d-----w c:\program files\AvRack

2009-03-17 13:31 . 2009-03-17 13:31 -------- d-----w c:\program files\AMD

2009-03-17 13:05 . 2009-03-17 13:05 -------- d-----w c:\program files\microsoft frontpage

2009-03-17 13:00 . 2009-03-17 13:00 64200 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2009-03-17 12:59 . 2009-03-17 12:59 -------- d-----w c:\program files\MSBuild

2009-03-17 12:59 . 2009-03-17 12:59 -------- d-----w c:\program files\Reference Assemblies

2009-03-17 12:54 . 2009-03-17 12:54 -------- d-----w c:\program files\LClock

2009-03-17 12:54 . 2009-03-17 12:54 -------- d-----w c:\program files\Alky for Applications

2009-03-17 12:53 . 2001-08-23 11:00 67 --sha-w c:\windows\Fonts\desktop.ini

2009-03-17 12:52 . 2009-03-17 12:48 -------- d-----w c:\program files\Windows Media Connect 2

2009-03-17 12:49 . 2009-03-17 12:49 21640 ----a-w c:\windows\system32\emptyregdb.dat

2009-03-17 12:48 . 2009-03-17 12:48 -------- d-----w c:\program files\Windows Desktop Search

2009-03-17 12:48 . 2009-03-17 12:48 -------- d-----w c:\program files\Microsoft Silverlight

2009-02-12 16:33 . 2009-02-12 16:33 1614848 ----a-w c:\windows\system32\sfcfiles.dll

2009-02-12 16:27 . 2001-08-17 22:36 3200 ----a-w c:\windows\system32\wowfax.dll

2009-02-12 15:58 . 2009-02-12 15:58 361600 ----a-w c:\windows\system32\drivers\tcpip.sys

2009-02-12 15:58 . 2009-02-12 15:58 218624 ----a-w c:\windows\system32\uxtheme.dll

2009-02-12 15:58 . 2009-02-12 15:58 990208 ----a-w c:\windows\system32\syssetup.dll

2009-02-12 15:50 . 2009-03-17 12:48 56320 ----a-w c:\windows\system32\xmlfilter.dll

2009-02-12 15:50 . 2009-02-12 15:50 43544 ----a-w c:\windows\system32\wups2.dll

2009-02-12 15:50 . 2001-08-23 11:00 1302600 ----a-w c:\windows\system32\wudfupdate_01007.dll

2009-02-12 15:50 . 2001-08-23 11:00 581192 ----a-w c:\windows\system32\winusbcoinstaller.dll

2009-02-12 15:50 . 2001-08-23 11:00 1112288 ----a-w c:\windows\system32\wdfcoinstaller01007.dll

2009-02-12 15:48 . 2009-02-12 15:48 262108 ----a-w c:\windows\system32\pintool.exe

2009-02-12 15:47 . 2009-02-12 15:47 323696 ----a-w c:\windows\system32\msdrm.dll

2009-02-12 15:43 . 2009-02-12 15:43 465920 ----a-w c:\windows\system32\imapi2fs.dll

2009-02-12 15:43 . 2009-02-12 15:43 317952 ----a-w c:\windows\system32\imapi2.dll

2009-02-12 15:43 . 2009-02-12 15:43 151552 ----a-w c:\windows\system32\ifxcardm.dll

2009-02-12 15:43 . 2009-02-12 15:39 75264 ----a-w c:\windows\inf\ieResetIcons.tmp

2009-02-12 15:42 . 2009-02-12 15:42 633344 ----a-w c:\windows\system32\gpprefcl.dll

2009-02-12 15:42 . 2009-02-12 15:42 133632 ----a-w c:\windows\system32\drivers\exfat.sys

2009-02-12 15:37 . 2009-02-12 15:37 96792 ----a-w c:\windows\system32\basecsp.dll

2009-02-12 15:37 . 2009-02-12 15:37 25600 ----a-w c:\windows\system32\bcsprsrc.dll

2009-02-12 15:37 . 2009-02-12 15:37 133120 ----a-w c:\windows\system32\axaltocm.dll

2009-02-12 15:37 . 2009-02-12 15:37 383488 ----a-w c:\windows\system32\wzcdlg.dll

2009-02-12 15:37 . 2009-03-17 12:51 202776 ----a-w c:\windows\system32\wuweb.dll

2009-02-12 15:37 . 2009-03-17 12:51 34328 ----a-w c:\windows\system32\wups.dll

2009-02-12 15:37 . 2009-02-12 15:37 316416 ----a-w c:\windows\system32\wudfx.dll

2009-02-12 15:37 . 2009-02-12 15:37 82944 ----a-w c:\windows\system32\drivers\wudfrd.sys

2009-02-12 15:37 . 2009-02-12 15:37 55808 ----a-w c:\windows\system32\wudfsvc.dll

2009-02-12 15:37 . 2009-02-12 15:37 77568 ----a-w c:\windows\system32\drivers\wudfpf.sys

2009-02-12 15:37 . 2009-02-12 15:37 324064 ----a-w c:\windows\system32\wudfhost.exe

2009-02-12 15:35 . 2009-02-12 15:35 4096 ----a-w c:\windows\system32\wmvadve.dll

2009-02-12 15:35 . 2009-02-12 15:35 4096 ----a-w c:\windows\system32\wmvadvd.dll

2009-02-12 15:35 . 2009-02-12 15:35 1329152 ----a-w c:\windows\system32\wmspdmoe.dll

2009-02-12 15:35 . 2009-02-12 15:35 603648 ----a-w c:\windows\system32\wmspdmod.dll

2009-02-12 15:35 . 2009-02-12 15:35 4096 ----a-w c:\windows\system32\wmsdmoe2.dll

.

------- Sigcheck -------

[-] 2009-02-12 15:58 361600 25A740D70E8007814A48D3FA1B34FA34 c:\windows\system32\drivers\tcpip.sys

[-] 2009-02-12 16:33 1614848 F2DF0FDBD41B34112EE05ED04258F052 c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

2008-11-18 10:58 333192 ----a-w c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"LClock"="c:\program files\LClock\lclock.exe" [2004-09-19 65536]

"Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 685526]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-05-30 21718312]

"Speaking Clock Deluxe"="c:\program files\Speaking Clock Deluxe\SpClDlx.exe" [2009-03-08 2327040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2004-06-11 83968]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 333268]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-12 339968]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-13 208952]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-13 59392]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]

"BigDogPath"="c:\windows\VM_STI.EXE" [2004-06-09 218588]

"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 312800]

"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-12-22 255446]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"LClock"="c:\program files\LClock\LClock.exe" [2004-09-19 65536]

c:\documents and settings\pipi\Start Menu\Programs\Startup\

SwitchType.lnk - c:\program files\SwitchType\SwitchType.exe [2008-12-18 135168]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

TrayMin210.exe.lnk - c:\program files\Philips\Philips SPC210NC Webcam\TrayMin210.exe [2009-3-27 456162]

Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2009-3-17 305626]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-02-12 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\BitComet\\BitComet.exe"=

"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=

"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=

"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"7038:TCP"= 7038:TCP:BitComet 7038 TCP

"7038:UDP"= 7038:UDP:BitComet 7038 UDP

"1700:TCP"= 1700:TCP:MioNet Remote Drive Access

"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [6.5.2009 13:00 38496]

.

------- Supplementary Scan -------

.

uStart Page = about:blank

IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

TCP: {C993C58F-6F6B-41FF-B1A6-5D8A8D2C6D06} = 89.106.106.2 89.106.106.8

FF - ProfilePath - c:\documents and settings\pipi\Application Data\Mozilla\Firefox\Profiles\ka23zr30.default\

FF - prefs.js: browser.search.selectedEngine - Ask

FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-06 17:50

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(764)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3436)

c:\windows\system32\msi.dll

c:\program files\LClock\LC.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\wscntfy.exe

c:\windows\system32\wbem\unsecapp.exe

.

**************************************************************************

.

Completion time: 2009-05-06 17:55 - machine was rebooted

ComboFix-quarantined-files.txt 2009-05-06 14:55

Pre-Run: 9.188.700.160 bytes free

Post-Run: 9.289.924.608 bytes free

248

Това е от ComboFix-a сега ще пробам пак да пусна Malwarebytes' Anti-Malware да сканира да видим.. ако успея ще ти пусна лог тук

6 май 200917 г.

Отворете Notepad и чрез copy/paste поставете следното:

KillAll::


Folder::

c:\program files\AdVantage

c:\program files\AskBarDis


Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"=-

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След, като програмата приключи ще Ви изведе лог файла. Чрез Copy/Paste поставете информацията тук.

6 май 200917 г.

Това е лог-а след 2-рият път .. след първият не ми даде лог.. незнам защо

ComboFix 09-05-05.04 - pipi 06.05.2009 19:09.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.381.1033.18.255.59 [GMT 3:00]

Running from: c:\documents and settings\pipi\Desktop\ComboFix.exe

Command switches used :: c:\qoobox\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Previous Run -------

.

c:\program files\AdVantage

c:\program files\AdVantage\AdVantageupdate.exe

c:\program files\AskBarDis

c:\program files\AskBarDis\bar\bin\askBar.dll

c:\program files\AskBarDis\bar\bin\askPopStp.dll

c:\program files\AskBarDis\bar\bin\psvince.dll

c:\program files\AskBarDis\bar\Cache\files.ini

c:\program files\AskBarDis\bar\History\search

c:\program files\AskBarDis\bar\Settings\config.dat

c:\program files\AskBarDis\bar\Settings\config.dat.bak

c:\program files\AskBarDis\bar\Settings\prevCfg2.htm

c:\program files\AskBarDis\unins000.dat

c:\program files\AskBarDis\unins000.exe