HiJackThis/Log :Оптимизация/Анализ/Ревю

30 май 200917 г.

hfu, Моля, отворете HijackThis, и изберете Do a system scan only.

Сложете отметки на следните редове:

O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\opnkiICv.dll (file missing)

O2 - BHO: (no name) - {7A4BDA0D-CE77-44AF-9EE8-4AB4AC26A298} - C:\WINDOWS\system32\wvUkKaWN.dll (file missing)

O2 - BHO: qs Class - {8A555E0E-6240-DD93-198D-45F571D4FD9B} - (no file)

O2 - BHO: (no name) - {DAF960F3-8AA6-4826-B9F7-DCA3EB035919} - C:\WINDOWS\system32\ljJBsPhF.dll (file missing)

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)

O20 - Winlogon Notify: cbXPhheB - cbXPhheB.dll (file missing)

O20 - Winlogon Notify: opnkiICv - opnkiICv.dll (file missing)

O20 - Winlogon Notify: vtUoOeFX - vtUoOeFX.dll (file missing)

O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)

O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)

O23 - Service: MS Software Shadow Copy Provider (SwPrv) - Unknown owner - C:\WINDOWS\system32\dllhost.exe (file missing)

След това, затворете всички отворени прозорци, освен този на HiJackThis, и изберете Fix checked.

Следваща стъпка:

1) Изтеглете ComboFix от: тук

2) Запазете го на работния си плот (десктоп).

3) Спрете Real-Time защитата на вашия антивирусен продукт.

4) Отворете Notepad и чрез copy/paste поставете следното:

Killall::


File::

C:\TEMP\CSRSS.EXE

C:\TEMP\rundll32.exe

C:\WINDOWS\system32\wowfx.dll

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След, като програмата приключи ще Ви изведе лог файла. Чрез Copy/Paste поставете информацията тук.

30 май 200917 г.

ComboFix 09-05-29.01 - User1 05.2009 г. 16:59.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2039.1330 [GMT 3:00]

Running from: c:\documents and settings\User1\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\User1\Desktop\CFScript.txt

AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

"c:\windows\_MSRSTRT.EXE"

"c:\windows\iun6002.exe"

"c:\windows\popcinfo.dat"

"c:\windows\sysguard.exe"

"c:\windows\system32\2753430839.dat"

"c:\windows\system32\activedsl.exe"

"c:\windows\system32\iehelper.dll"

"c:\windows\system32\LIAR6.EXE"

"c:\windows\system32\mlfcache.dat"

"c:\windows\system32\unins000.dat"

"c:\windows\system32\unins000.exe"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\User1\DoctorWeb

c:\documents and settings\User1\DoctorWeb\CureIt.log

c:\windows\_MSRSTRT.EXE

c:\windows\iun6002.exe

c:\windows\popcinfo.dat

c:\windows\system32\2753430839.dat

c:\windows\system32\mlfcache.dat

c:\windows\system32\unins000.dat

c:\windows\system32\unins000.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_bgdfq

((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-30 )))))))))))))))))))))))))))))))

.

2009-05-30 10:33 . 2009-05-30 10:33 -------- d-----w c:\program files\Common Files\Adobe

2009-05-30 10:25 . 2009-05-30 10:25 -------- d-----w c:\windows\system32\xircom

2009-05-30 10:25 . 2009-05-30 10:25 -------- d-----w c:\program files\microsoft frontpage

2009-05-30 08:21 . 2009-05-26 10:20 40160 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-30 08:21 . 2009-05-30 08:21 -------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-05-30 08:21 . 2009-05-26 10:19 19096 ----a-w c:\windows\system32\drivers\mbam.sys

2009-05-20 20:50 . 2009-05-20 20:52 -------- d-----w c:\program files\Vista Rainbar

2009-05-18 22:06 . 2009-05-18 22:08 409600 ----a-w c:\windows\system32\wrap_oal.dll

2009-05-18 22:06 . 2009-05-18 22:08 114688 ----a-w c:\windows\system32\OpenAL32.dll

2009-05-18 22:00 . 2009-05-18 22:00 -------- d-----w c:\windows\Downloaded Installations

2009-05-16 19:26 . 2009-05-16 19:26 -------- d-----w c:\documents and settings\User1\Application Data\vlc

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-30 14:02 . 2009-03-13 10:08 -------- d-----w c:\program files\Symantec AntiVirus

2009-05-30 12:10 . 2009-03-13 13:03 -------- d-----w c:\documents and settings\User1\Application Data\Skype

2009-05-30 10:21 . 2009-03-13 12:50 -------- d-----w c:\program files\BitComet

2009-05-29 10:28 . 2009-03-30 15:58 -------- d-----w c:\program files\OpenOffice.org 3

2009-05-29 10:26 . 2009-03-13 12:56 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer

2009-05-23 08:32 . 2009-03-30 16:00 1 ----a-w c:\documents and settings\User1\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2009-05-16 08:27 . 2009-04-11 19:20 -------- d-----w c:\program files\ScreenMates

2009-05-11 10:43 . 2009-03-20 16:48 -------- d-----w c:\documents and settings\User1\Application Data\SUPERAntiSpyware.com

2009-05-11 10:43 . 2009-03-13 16:00 -------- d-----w c:\program files\Common Files\Wise Installation Wizard

2009-04-24 12:59 . 2009-04-24 12:56 -------- d-----w c:\documents and settings\User1\Application Data\Download Master

2009-04-23 12:52 . 2009-04-23 12:50 -------- d-----w c:\documents and settings\User1\Application Data\Hide IP NG

2009-04-22 17:20 . 2009-03-22 13:11 -------- d-----w c:\documents and settings\User1\Application Data\IDM

2009-04-22 17:18 . 2009-03-22 13:11 -------- d-----w c:\documents and settings\User1\Application Data\DMCache

2009-04-19 21:37 . 2009-03-13 09:39 52552 ----a-w c:\documents and settings\User1\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-04-16 14:35 . 2009-04-16 14:35 -------- d-----w c:\documents and settings\All Users\Application Data\Soulseek

2009-04-14 16:37 . 2009-03-20 15:32 721904 ----a-w c:\windows\system32\drivers\sptd.sys

2009-04-14 13:50 . 2009-04-14 13:50 -------- d-----w c:\documents and settings\User1\Application Data\ICAClient

2009-04-12 22:11 . 2009-03-20 17:09 -------- d-----w c:\documents and settings\User1\Application Data\DeskSoft

2009-04-12 18:09 . 2009-04-12 13:49 873472 ----a-w c:\windows\WATERYDS.SCR

2009-04-12 13:49 . 2009-04-12 13:49 -------- d-----w c:\program files\PUSH Entertainment

2009-04-11 17:46 . 2009-04-11 17:45 -------- d-----w c:\program files\DeskMates

2009-04-11 13:58 . 2009-04-11 13:58 -------- d-----w c:\documents and settings\User1\Application Data\FDRLab

2009-04-07 23:15 . 2009-04-07 23:15 -------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2

2009-04-05 19:26 . 2009-04-05 19:26 2814112 ----a-w c:\documents and settings\User1\Application Data\IDM\idmupdt.exe

2009-04-02 19:19 . 2009-04-02 19:19 -------- d-sh--w c:\documents and settings\All Users\Application Data\PCDM

2009-03-29 14:02 . 2009-03-29 14:02 319488 ----a-w c:\windows\HideWin.exe

2009-03-29 00:08 . 2009-03-29 00:08 21035 ----a-w c:\windows\system32\drivers\AegisP.sys

2009-03-27 16:43 . 2009-03-30 11:42 82448 ----a-w c:\windows\system32\drivers\VBoxNetAdp.sys

2009-03-22 13:30 . 2009-03-22 13:30 1048576 ----a-w c:\documents and settings\User1\Application Data\Mozilla\Firefox\Profiles\zt25vx7x.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll

2009-03-21 15:33 . 2009-03-20 17:09 65536 ----a-w c:\windows\DTDraw.dll

2009-03-13 09:57 . 2009-03-13 08:56 89783 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-03-13 08:53 . 2009-03-13 08:53 21640 ----a-w c:\windows\system32\emptyregdb.dat

2009-03-06 13:49 . 2008-04-14 04:42 284160 ----a-w c:\windows\system32\pdh.dll

2009-03-03 00:18 . 2008-12-20 22:15 826368 ----a-w c:\windows\system32\wininet.dll

.

------- Sigcheck -------

[-] 2009-01-08 20:12 361600 5AE1C2695F6523AD98B948F2887D8C5E c:\windows\system32\drivers\tcpip.sys

[-] 2009-01-08 19:41 1614848 362BC5AF8EAF712832C58CC13AE05750 c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((( SnapShot@2009-05-30_10.26.17 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-03-13 13:12 . 2009-05-30 10:32 86016 c:\windows\Installer\{07287123-B8AC-41CE-8346-3D777245C35B}\PrntWzrdIco.exe

- 2009-03-13 13:12 . 2009-03-13 13:12 86016 c:\windows\Installer\{07287123-B8AC-41CE-8346-3D777245C35B}\PrntWzrdIco.exe

.

((((((((((((((((((((((((((((((((((((((( System Restore )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\32788r22fwjfw\pv.exe

02.03.2006 г. 23:42 73728 \RP1\A0000002.exe

02.03.2006 г. 23:42 73728 \RP2\A0000277.exe

c:\documents and settings\User1\DoctorWeb\Quarantine\UACciwjsgpjovdypil.dll

29.05.2009 г. 20:29 66560 \RP2\A0000355.dll

c:\documents and settings\User1\DoctorWeb\Quarantine\UACttqobtcwqtepxps.dll

29.05.2009 г. 20:29 24064 \RP2\A0000356.dll

16.03.2009 г. 11:00 101936 c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10910.sys

16.03.2009 г. 11:00 101936 \RP1\A0000086.sys

16.03.2009 г. 11:00 101936 \RP2\A0000368.sys

c:\windows\_MSRSTRT.EXE

30.05.2009 г. 16:59 2560 \RP2\A0000357.EXE

c:\windows\Installer\{AC76BA86-7AD7-1033-7B44-A70500000002}\SC_Reader.exe

13.03.2009 г. 12:55 25214 \RP2\A0000233.exe

c:\windows\iun6002.exe

30.05.2009 г. 16:59 737280 \RP2\A0000358.exe

c:\windows\system32\ammppg.dll

14.09.2007 г. 11:40 336896 \RP1\A0000081.dll

c:\windows\system32\unins000.exe

30.05.2009 г. 16:59 695578 \RP2\A0000359.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-03 94208]

"Felix II"="c:\program files\ScreenMates\Felix II\Felix2.exe" [2009-05-25 958464]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ZCfgSvc.exe"="c:\windows\system32\ZCfgSvc.exe" [2006-08-03 639040]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2003-11-14 33792]

"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-04-17 85184]

"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2005-07-07 135168]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-04-08 48752]

"ATKHOTKEY"="c:\program files\ATK Hotkey\Hcontrol.exe" [2007-04-24 225280]

"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2007-11-06 1826816]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-11-06 16384512]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2009-3-13 151552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]

2006-08-03 01:20 188482 ----a-w c:\windows\system32\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Winamp\\winampa.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"11142:TCP"= 11142:TCP:BitComet 11142 TCP

"11142:UDP"= 11142:UDP:BitComet 11142 UDP

R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [29.3.2009 і. 03:09 38144]

R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187B.sys [29.3.2009 і. 03:40 275712]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [29.3.2009 і. 16:52 1684736]

S3 KS-959;Kingsun KS-959 USB Infrared Adapter;c:\windows\system32\drivers\KS-959.sys [16.3.2009 і. 01:10 19018]

S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [17.4.2005 і. 13:30 124608]

S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [30.3.2009 і. 14:42 82448]

S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - EraserUtilDrv10910

.

Contents of the 'Scheduled Tasks' folder

2009-05-29 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.bg/

uInternet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,;*.local

uInternet Settings,ProxyServer = socks=

IE: &С&валяне &с BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

IE: &С&валяне на всички с BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

IE: &С&валяне на всичкото видео с BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: + Offline &Explorer: Download the link - file://c:\program files\Offline Explorer\Add_UrlO.htm

IE: + Offline E&xplorer: Download the current page - file://c:\program files\Offline Explorer\Add_AllO.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

IE: Закачать ВСЕ при помощи Download Master

IE: Закачать при помощи Download Master

IE: Передать на удаленную закачку DM

FF - ProfilePath - c:\documents and settings\User1\Application Data\Mozilla\Firefox\Profiles\zt25vx7x.default\

FF - prefs.js: browser.startup.homepage - hxxp://google.bg

FF - component: c:\documents and settings\User1\Application Data\Mozilla\Firefox\Profiles\zt25vx7x.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll

FF - plugin: c:\program files\MpcStar\Codecs\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\MpcStar\Codecs\Real\browser\plugins\nprpjplug.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-30 17:02

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(920)

c:\windows\system32\LgNotify.dll

- - - - - - - > 'explorer.exe'(1948)

c:\windows\system32\newdll.dll

c:\progra~1\WINDOW~2\wmpband.dll

c:\windows\system32\msi.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\Symantec Shared\ccSetMgr.exe

c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe

c:\windows\system32\agrsmsvc.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Symantec AntiVirus\DefWatch.exe

c:\program files\Symantec AntiVirus\Rtvscan.exe

c:\program files\Symantec AntiVirus\DoScan.exe

c:\windows\system32\wscntfy.exe

c:\program files\ATK Hotkey\ATKOSD.exe

.

**************************************************************************

.

Completion time: 2009-05-30 17:04 - machine was rebooted

ComboFix-quarantined-files.txt 2009-05-30 14:04

ComboFix2.txt 2009-05-30 10:28

Pre-Run: 19 632 943 104 bytes free

Post-Run: 19 624 628 224 bytes free

226 --- E O F --- 2009-05-28 11:24

30 май 200917 г.

@Stemil1

Архивирай папката C:\Qoobox и я качи на надрес http://www.4storing.com

След това от Start Menu => Run => въведи командата

combofix /u

combofix%20u.JPG

Това ще стартира Combofix оше веднъж за да го деинсталира.

Обнови антивирусната си програма и Malwarebytes' Anti-Malware и направи ПЪЛНА проверка на хардиска.

Публикувайте резултатите.

След това кажи как чувстваш системата си.

Поздрави !

30 май 200917 г.

Malwarebytes' Anti-Malware 1.37

Версия на базата от данни: 2195

Windows 5.1.2600 Service Pack 3

30.5.2009 г. 18:11:27

mbam-log-2009-05-30 (18-11-27).txt

Тип сканиране: Пълно сканиране (C:\|D:\|E:\|)

Сканирани обекти: 109145

Изминало време: 16 minute(s), 48 second(s)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 0

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 0

Заразени файлове: 0

Заразени процеси в паметта:

(Не бяха открити заплахи)

Заразени модули в паметта:

(Не бяха открити заплахи)

Заразени ключове в регистратурата:

(Не бяха открити заплахи)

Заразени стойности в регистратурата:

(Не бяха открити заплахи)

Заразени информационни обекти в регистратурата:

(Не бяха открити заплахи)

Заразени папки:

(Не бяха открити заплахи)

Заразени файлове:

(Не бяха открити заплахи)

30 май 200917 г.

С антивирусна провери ли ?

Какво стана с папката Qoobox ?

Как е сега системата според теб ?

30 май 200917 г.

Не съм сигурен дали това е лог-а щото не се копира от първият път а го бях затворил и търсих в ц-то

ComboFix 09-05-30.03 - User 30.05.2009 21:37.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2047.1287 [GMT 3:00]

Running from: c:\documents and settings\User\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\User\Desktop\CFScript.txt

AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

"c:\temp\CSRSS.EXE"

"c:\temp\rundll32.exe"

"c:\windows\system32\wowfx.dll"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\altcmd

c:\program files\altcmd\altcmd.inf

c:\program files\altcmd\uninstall.bat

c:\temp\b.bat

c:\windows\system32\DIGEST32.DLL

c:\windows\system32\kbdbph.dll

c:\windows\system32\snapapi32.dll

.

((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-30 )))))))))))))))))))))))))))))))

.

2009-05-30 18:42 . 2009-05-30 18:42 0 ----a-w c:\temp\gxvx5ijp.dll

2009-05-30 18:40 . 2009-05-30 18:40 60416 ----a-w c:\temp\Perflib_Perfdata__755.dat

2009-05-28 18:28 . 2009-05-28 18:41 -------- d-----w c:\temp\plugtmp-24

2009-05-28 17:04 . 2009-05-28 17:15 -------- d-----w c:\temp\plugtmp-23

2009-05-27 15:46 . 2009-05-27 15:46 -------- d-----w c:\temp\plugtmp-22

2009-05-27 14:35 . 2009-05-27 14:38 -------- d-----w c:\temp\plugtmp-21

2009-05-27 13:51 . 2009-05-30 18:39 -------- d-----w c:\temp\plugtmp-20

2009-05-25 18:34 . 2009-05-25 18:34 -------- d-----w c:\temp\plugtmp-19

2009-05-25 12:34 . 2009-05-25 13:37 -------- d-----w c:\documents and settings\User\Application Data\BSplayer PRO

2009-05-25 00:30 . 2009-05-25 00:30 -------- d-----w c:\temp\bye2911.tmp

2009-05-25 00:19 . 2009-05-30 18:39 -------- d-----w c:\temp\OLSUpdate

2009-05-25 00:17 . 2009-05-25 00:17 -------- d-----w c:\temp\{4BA32E32-F256-4777-97FE-81B67DDE9C2A}

2009-05-25 00:17 . 2009-05-25 00:17 -------- d-----w c:\temp\photoshop9-en_US-RET

2009-05-24 22:20 . 2009-05-30 18:39 -------- d-----w c:\temp\crl

2009-05-23 15:09 . 2009-05-23 15:33 -------- d-----w c:\documents and settings\User\Application Data\Daimler

2009-05-23 15:08 . 2009-05-23 15:08 -------- d-----w c:\program files\Chrysler West Coast Rally

2009-05-23 09:28 . 2009-05-23 09:28 -------- d-----w c:\temp\plugtmp-18

2009-05-21 19:23 . 2009-05-21 19:23 -------- d-----w c:\windows\Downloaded Installations

2009-05-21 08:01 . 2009-05-21 08:08 -------- d-----w c:\temp\plugtmp-17

2009-05-18 18:50 . 2009-05-18 18:50 10134 ----a-r c:\documents and settings\User\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe

2009-05-18 18:50 . 2008-09-05 00:22 447752 ----a-r c:\windows\system32\vp6vfw.dll

2009-05-18 18:50 . 2009-05-18 18:50 -------- d-----w c:\program files\Microsoft WSE

2009-05-15 07:29 . 2009-05-15 07:29 -------- d-----w c:\windows\system32\xlib254.dll

2009-05-15 07:29 . 2009-05-15 07:29 -------- d-----w c:\windows\system32\append.dll

2009-05-14 20:51 . 2007-03-04 11:55 1936528 ----a-w c:\windows\system32\ltmm15.dll

2009-05-14 20:51 . 2007-03-04 11:55 135168 ----a-w c:\windows\system32\DSKernel2.dll

2009-05-14 20:51 . 2009-05-14 20:50 737280 ----a-w c:\windows\iun6002.exe

2009-05-14 20:50 . 2009-05-14 20:55 -------- d-----w c:\program files\Replay Converter

2009-05-12 12:04 . 2009-05-12 12:04 -------- d-----w c:\program files\Microsoft Games

2009-05-11 12:00 . 2009-05-11 12:00 -------- d-----w c:\documents and settings\User\Local Settings\Application Data\Wildtangent

2009-05-11 12:00 . 2009-05-11 12:00 -------- d-----w c:\windows\wt

2009-05-11 11:59 . 2009-05-11 12:00 -------- d-----w c:\program files\WildTangent

2009-05-11 11:22 . 2009-05-11 11:22 -------- d-----w c:\documents and settings\All Users\Application Data\TERMINAL Studio

2009-05-11 11:22 . 2009-05-11 11:22 -------- d-----w c:\documents and settings\All Users\Application Data\Trymedia

2009-05-11 11:22 . 2009-05-11 11:22 -------- d-----w c:\program files\BFG

2009-05-09 10:10 . 2009-05-09 10:11 -------- d-----w C:\lals

2009-05-07 10:13 . 2009-05-07 10:13 -------- d-----w c:\documents and settings\User\DoctorWeb

2009-05-07 10:13 . 2009-05-30 18:39 -------- d-----w c:\temp\RarSFX0

2009-05-06 12:32 . 2009-05-06 13:10 -------- d-----w c:\temp\plugtmp-16

2009-05-06 11:36 . 2009-05-06 12:07 -------- d-----w c:\temp\plugtmp-15

2009-05-06 11:14 . 2009-05-06 11:14 -------- d-----w c:\windows\system32\KB905474

2009-05-06 11:14 . 2009-03-10 19:26 1403264 ----a-w c:\windows\system32\KB905474\wganotifypackageinner.exe

2009-05-06 11:14 . 2009-03-10 19:18 453512 ----a-w c:\windows\system32\KB905474\wgasetup.exe

2009-05-06 09:52 . 2009-05-06 09:54 -------- d-----w c:\temp\plugtmp-14

2009-05-05 09:09 . 2009-05-05 09:10 -------- d-----w c:\temp\plugtmp-13

2009-05-04 19:24 . 2009-05-04 20:02 -------- d-----w c:\program files\TalismanOnline

2009-05-04 17:37 . 2009-05-04 18:09 -------- d-----w c:\temp\plugtmp-12

2009-05-04 11:11 . 2008-06-13 11:05 272128 -c----w c:\windows\system32\dllcache\bthport.sys

2009-05-04 11:11 . 2008-06-13 11:05 272128 ------w c:\windows\system32\drivers\bthport.sys

2009-05-04 11:10 . 2009-02-06 11:08 2189056 -c----w c:\windows\system32\dllcache\ntoskrnl.exe

2009-05-04 11:10 . 2009-02-06 11:06 2145280 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe

2009-05-04 11:10 . 2009-02-06 10:32 2023936 -c----w c:\windows\system32\dllcache\ntkrpamp.exe

2009-05-04 11:08 . 2008-10-24 11:21 455296 -c----w c:\windows\system32\dllcache\mrxsmb.sys

2009-05-04 11:03 . 2008-05-03 11:55 2560 ----a-w c:\windows\system32\xpsp4res.dll

2009-05-03 21:52 . 2009-05-03 21:52 -------- d-----w c:\documents and settings\User\Application Data\Malwarebytes

2009-05-03 21:52 . 2009-04-06 12:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-05-03 21:51 . 2009-04-06 12:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-03 21:51 . 2009-05-03 21:52 -------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-05-03 21:51 . 2009-05-03 21:51 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2009-05-03 21:06 . 2009-05-03 21:08 -------- d-----w c:\temp\plugtmp-11

2009-05-03 11:47 . 2009-05-03 11:47 -------- d-----w c:\program files\JoWood

2009-05-03 09:54 . 2009-05-03 09:54 -------- d-----w c:\documents and settings\User\Application Data\Tilted Mill

2009-05-03 09:49 . 2009-05-03 09:49 -------- d-----w c:\program files\Tilted Mill

2009-05-01 07:31 . 2009-05-03 22:50 -------- d-----w c:\temp\plugtmp-10

2009-04-30 20:24 . 2009-05-30 18:39 -------- d-sh--w c:\temp\Cookies

2009-04-30 20:24 . 2009-04-30 20:24 -------- d-sh--w c:\temp\Temporary Internet Files

2009-04-30 20:24 . 2009-04-30 20:24 -------- d-sh--w c:\temp\History

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-30 18:42 . 2008-12-17 08:45 -------- d-----w c:\documents and settings\User\Application Data\Skype

2009-05-30 18:42 . 2008-12-18 15:28 -------- d-----w c:\documents and settings\User\Application Data\skypePM

2009-05-30 18:34 . 2008-12-18 15:30 -------- d-----w c:\program files\BitComet

2009-05-25 00:17 . 2008-12-17 07:47 -------- d--h--w c:\program files\InstallShield Installation Information

2009-05-23 09:47 . 2009-04-29 16:57 -------- d-----w c:\program files\Wippien

2009-05-23 09:47 . 2009-04-29 16:57 -------- d-----w c:\documents and settings\User\Application Data\Wippien

2009-05-12 18:56 . 2009-04-29 15:17 -------- d-----w c:\documents and settings\User\Application Data\Hamachi

2009-05-12 18:15 . 2009-04-29 15:17 25544 ----a-w c:\windows\system32\drivers\hamachi.sys

2009-05-12 12:00 . 2008-12-19 21:39 -------- d-----w c:\program files\Diablo II

2009-05-04 20:01 . 2009-02-16 20:31 -------- d-----w c:\program files\GameTribe

2009-05-04 19:56 . 2008-12-17 07:41 64104 ----a-w c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-05-03 21:37 . 2008-12-17 08:19 -------- d-----w c:\program files\Common Files\Adobe

2009-04-29 16:30 . 2009-04-29 16:30 -------- d-----w c:\documents and settings\All Users\Application Data\dbg

2009-04-29 15:17 . 2009-04-29 15:16 -------- d-----w c:\program files\Hamachi

2009-04-18 13:33 . 2009-04-18 13:33 -------- d-----w c:\documents and settings\All Users\Application Data\KONAMI

2009-04-18 13:29 . 2009-04-18 13:29 -------- d-----w c:\program files\KONAMI

2009-04-10 11:14 . 2009-01-19 10:43 -------- d-----w c:\program files\Metin2.us

2009-04-09 12:21 . 2009-04-09 12:21 94360 ----a-w c:\windows\system32\drivers\epfwtdir.sys

2009-04-09 12:18 . 2009-04-09 12:18 107256 ----a-w c:\windows\system32\drivers\ehdrv.sys

2009-04-09 12:10 . 2009-04-09 12:10 113960 ----a-w c:\windows\system32\drivers\eamon.sys

2009-04-05 20:38 . 2009-03-29 05:37 -------- d-----w c:\program files\DaemonTools_WhenUSave_Installer

2009-04-05 11:12 . 2009-04-05 11:12 -------- d-----w c:\program files\Speaking Clock Deluxe

2009-04-02 05:30 . 2009-04-02 05:30 -------- d-----w c:\program files\AGEIA Technologies

2009-04-02 05:30 . 2009-04-02 05:30 -------- d-----w c:\program files\Common Files\Wise Installation Wizard

2009-04-02 05:03 . 2009-01-17 18:12 -------- d-----w c:\program files\Codemasters

2009-04-02 05:03 . 2009-04-02 05:03 -------- d-----w c:\documents and settings\User\Application Data\InstallShield

2009-03-28 08:07 . 2008-12-18 19:05 717296 ----a-w c:\windows\system32\drivers\sptd.sys

2009-03-06 14:22 . 2008-04-14 02:42 284160 ----a-w c:\windows\system32\pdh.dll

2009-03-03 00:18 . 2008-04-14 02:42 826368 ----a-w c:\windows\system32\wininet.dll

2007-03-09 07:12 . 2007-03-09 07:12 27648 --sha-w c:\windows\system32\AVSredirect.dll

.

------- Sigcheck -------

[-] 2005-11-03 00:43 578560 7818B69A3A5EC4588B155374EBDE2ED1 c:\windows\system32\user32.dll

[-] 2005-11-03 00:43 578560 7818B69A3A5EC4588B155374EBDE2ED1 c:\windows\system32\dllcache\user32.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]

"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-10-02 1124352]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-16 24264488]

"ctfmon.exe"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]

"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]

"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

"BigDogPath"="c:\windows\VM_STI.EXE" [2004-06-09 40960]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-04-09 2029640]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-10-25 16855552]

"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2007-10-11 1826816]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\User\Start Menu\Programs\Startup\

Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

TrayMin210.exe.lnk - c:\program files\Philips\Philips SPC210NC Webcam\TrayMin210.exe [2009-2-24 278528]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digest32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\BitComet\\BitComet.exe"=

"c:\\Downloads\\Valve\\Valve\\hl.exe"=

"c:\\Downloads\\Valve\\Valve\\hlds.exe"=

"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=

"c:\\Program Files\\Saints Row 2\\SR2_pc.exe"=

"c:\\Downloads\\Valve\\Valve\\hltv.exe"=

"%windir%\\system32\\ShellExt\\Sys\\NvCpi.exe"=

"c:\\Program Files\\Diablo II\\Diablo II.exe"=

"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"=

"c:\\WINDOWS\\system32\\svchost.exe"=

"c:\\WINDOWS\\system32\\Ati2evxx.exe"=

"c:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"11576:TCP"= 11576:TCP:BitComet 11576 TCP

"11576:UDP"= 11576:UDP:BitComet 11576 UDP

"5353:TCP"= 5353:TCP:Adobe CSI CS4

"1700:TCP"= 1700:TCP:MioNet Remote Drive Access

"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

"4719:TCP"= 4719:TCP:4719

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [09.04.2009 15:18 107256]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [09.04.2009 15:21 94360]

R2 ekrn;ESET Service;c:\program files\Eset\ESET NOD32 Antivirus\ekrn.exe [09.04.2009 15:19 731840]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 wip0204;Wippien Network Adapter 2.4;c:\windows\system32\drivers\wip0204.sys [29.04.2009 19:57 23480]

S3 XDva224;XDva224;\??\c:\windows\system32\XDva224.sys --> c:\windows\system32\XDva224.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{10a38954-cd37-11dd-90d4-001fc6b653df}]

\Shell\AutoRun\command - E:\Install_TRAIN_ENG_2008_05_27.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3171c025-ce96-11dd-90d8-001fc6b653df}]

\Shell\AutoRun\command - G:\autorun.exe

.

Contents of the 'Scheduled Tasks' folder

2009-05-14 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2009-05-06 19:18]

.

- - - - ORPHANS REMOVED - - - -

SafeBoot-procexp90.Sys

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.bg/

uInternet Settings,ProxyServer = 172.16.41.9:8080

IE: &С&валяне &с BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

IE: &С&валяне на всички с BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

IE: &С&валяне на всичкото видео с BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\kljuudty.default\

FF - prefs.js: browser.search.selectedEngine - DAEMON Search

FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\kljuudty.default\extensions\[email protected]\components\BkMrkExt.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-30 21:41

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(796)

c:\windows\system32\Ati2evxx.dll

c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

c:\program files\PC Connectivity Solution\ServiceLayer.exe

c:\program files\Common Files\Nokia\MPAPI\MPAPI3s.exe

c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe

c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe

c:\program files\Skype\Plugin Manager\skypePM.exe

c:\windows\system32\wbem\wmiadap.exe

.

**************************************************************************

.

Completion time: 2009-05-30 21:45 - machine was rebooted

ComboFix-quarantined-files.txt 2009-05-30 18:45

ComboFix2.txt 2009-05-03 23:09

Pre-Run: 21 232 254 976 bytes free

Post-Run: 22 526 410 752 bytes free

255 --- E O F --- 2009-05-14 17:48

31 май 200917 г.

Сега, изтеглете ATF Cleaner

Запазете го на вашия десктоп.

Кликнете два пъти върху ATF-Cleaner.exe , за да стартирате програмата.
Кликнете на Select All, който се намира в най-долната част на списъка.
Кликнете на бутона Empty Selected.

Ако използвате браузъра Mozilla Firefox, направете следното:

Кликнете върху Firefox, който се намира в началото и изберете Select All от списъка.
Кликнете на бутона Empty Selected.
Бележка: Ако искате да съхраните запазените пароли, моля кликнете на No от новопоявилия се прозорец.

Ако използвате браузъра Opera, направете следното:

Кликнете върху Opera който се намира в началото и изберете Select All от списъка.
Кликнете на бутона Empty Selected.
Бележка: Ако искате да съхраните запазените пароли, моля кликнете на No от новопоявилия се прозорец.

Кликнете на бутона Exit, който се намира в главното меню, за да затворите програмата.

---

Отворете Notepad и чрез copy/paste поставете следното:

KillAll::


File::

c:\temp\gxvx5ijp.dll

c:\temp\bye2911.tmp

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След, като програмата приключи ще Ви изведе лог файла. Чрез Copy/Paste поставете информацията тук.

---

Обновете MalwareBytes' Anti-Malware и пуснете пълно сканиране на системата Ви. Накрая очаквам лог файл от MalwareBytes' Anti-Malware, както и от ComboFix.

1 юни 200917 г.

Помогнахте ми предният път , отървах се от Троянец-а !

НО сега от всички премахванки и триене се оказва нещо , което нищо не ми говори ...

Постоянно като опитам да вляза в някои /повечето /сайтове не мога да ги отворя .ИЗПИСВА МИ СЕ , ЧЕ Текущиге настройки не позволяват при теглене на файл не зависимо какъв е и Popups were blocked on this page .Последно на някои места пише Your security settings do not alow Web site to use Active X controlls installed on your computer .This page can not display correctly ...

Какво съм забъркала сега и как да го оправя ... някоя програма ли ми трябва която да инсталирам или ...

Помагайте !!!

Редактирано 1 юни 200917 г. от evita1717 (преглед на промените)

1 юни 200917 г.

Отворете Internet Explorer, изберете Tools -> Internet Options и отидете на таба Security. Там кликнете на Reset all zones to default level. И накрая натиснете OK. Затворете и отново отворете Internet Explorer и проверете дали има промяна.

3 юни 200917 г.

Отворете Internet Explorer, изберете Tools -> Internet Options и отидете на таба Security. Там кликнете на Reset all zones to default level. И накрая натиснете OK. Затворете и отново отворете Internet Explorer и проверете дали има промяна.

Много , много ти благодаря !!! :wors: :lol6: :yanim: :clap: :clap: :clap:

8 юни 200917 г.

Здравейте!

Нещо става с дял С...Пространството се топи...Вчера направих неуспешен опит да инстална Adboe Photoshop CS4, но не знам дали това е повлияе, защото все пак С-то се смалява и то доста подозрилтелно. Останала съм малко над 500 МБ. Смятам, че има и замесен вирус. Притеснява ме това smss.exe. Четох за него, че е възможно и да е тройанец...Хора ще ви бъда повече от задължена, ако ми помогнете, че работата взе да става доста напечена. Изключих System Restore-а (при което свободното пространство се увеличи), сканирах с Avira, Malwarebytes' Anti-Malware и SUPERAntiSpyware, но нищо не откриха...И като включих System Restore-а и пак почнаха да се топят МБ...

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:22:42 AM, on 6/8/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe

C:\WINDOWS\system32\RunDll32.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe

C:\WINDOWS\Datecs\Flex2K.exe

C:\Program Files\ACE Lab\SMART vision\SMART.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\TUProgSt.exe

C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

E:\HiJackThis\post.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 85.217.170.2:8080

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Free Download Manager\iefdm2.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [FineReader7NewsReaderPro] C:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

O4 - Startup: SmartVision.lnk = C:\Program Files\ACE Lab\SMART vision\SMART.exe

O4 - Global Startup: BitDefender_P2P_Startup.lnk = C:\WINDOWS\BitDefender_P2P_Startup.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Image Transfer.lnk = ?

O4 - Global Startup: FlexType 2K.lnk = C:\WINDOWS\Datecs\Flex2K.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Е&кспортирай в Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Свали видеото с Free Download Manager - file://E:\Free Download Manager\dlfvideo.htm

O8 - Extra context menu item: Свали всички с Free Download Manager - file://E:\Free Download Manager\dlall.htm

O8 - Extra context menu item: Свали избраните с Free Download Manager - file://E:\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Свали с Free Download Manager - file://E:\Free Download Manager\dllink.htm

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-09.sun.com/s/ESD7/JSCDL/jdk...ows-i586-jc.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{5B32A637-65A2-4644-83E2-26B121489D7E}: NameServer = 85.217.170.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{5B32A637-65A2-4644-83E2-26B121489D7E}: NameServer = 85.217.170.1

O17 - HKLM\System\CS2\Services\Tcpip\..\{5B32A637-65A2-4644-83E2-26B121489D7E}: NameServer = 85.217.170.1

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)

O23 - Service: Услуга Google Update (gupdate1c99db1152ddf0) (gupdate1c99db1152ddf0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe

O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--

End of file - 7186 bytes

Редактирано 8 юни 200917 г. от petinka90 (преглед на промените)

8 юни 200917 г.

Логът е чист (като изключим част от ненужните програми). :blink:

Причината е по-скоро другаде.

http://www.kaldata.com/forums/index.php?s=...t&p=1415207

9 юни 200917 г.

Аз все пак намерих проблема (както съм посочила в друг раздел). Но и фактът, че нямам вируси, ме успокоява още повече. А що се отнася до ненужни програмки... те са ми най-малък проблем (поне засега) :rolleyes:

Благодаря ти!

14 юни 200917 г.

Здравейте, един приятел от скоро се оплаква, че машината му не върви, както трябва.

Ето и лога, ако всичко е наред - значи проблемът е другаде:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:05:23, on 14.6.2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16850)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

H:\New Folder (6)\aswUpdSv.exe

H:\New Folder (6)\ashServ.exe

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Eset\nod32kui.exe

H:\New Folder (6)\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

H:\New Folder (6)\ashMaiSv.exe

H:\New Folder (6)\ashWebSv.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\mIRC\mirc.exe

C:\Program Files\Steam\Steam.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

H:\New Folder (10)\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [uVS11 Preload] H:\ULEAD STUDI INSTALATION DIRECTORY\uvPL.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [avast!] "H:\New Folder (6)\ashDisp.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [bitComet] "C:\Program Files\BitComet\BitComet.exe" /tray

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [steam] "c:\program files\steam\steam.exe" -silent

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{3B5DBCED-717D-4D59-BF6E-A879568420C1}: NameServer = 212.50.10.50 212.50.10.50

O17 - HKLM\System\CS1\Services\Tcpip\..\{3B5DBCED-717D-4D59-BF6E-A879568420C1}: NameServer = 212.50.10.50 212.50.10.50

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\New Folder (6)\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - H:\New Folder (6)\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - H:\New Folder (6)\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - H:\New Folder (6)\ashWebSv.exe

O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe

O23 - Service: Услуга Google Update (gupdate1c9c2cbb56e9966) (gupdate1c9c2cbb56e9966) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--

End of file - 9129 bytes

14 юни 200917 г.

Забелязвам, че приятеля ти използва повече от една антивирусна програма. Той използва:

Avast
NOD32 v2

Това е много опасно,тъй като употребата на повече антивирусни продукти могат да влязат в конфликт и да позволи системата да бъде изложена на риск.

Важно е да се използва само една антивирусна програма, която да работи в Real-Time режим.

Аз силно препоръчвам да бъде избран един антивирусен продукт и да се деинсталира другия. За тази цел, нека приятеля ти отвори Add or remove Programs и премахне ненужния продукт. Дори да реши да използва NOD32 трябва да го деинсталира и да си изтегли най-новата версия (версия 4), може и на български, може и на английски, защото сегашната не му помага въобще.

Сега, изтеглете ATF Cleaner

Запазете го на вашия десктоп.

Кликнете два пъти върху ATF-Cleaner.exe , за да стартирате програмата.
Кликнете на Select All, който се намира в най-долната част на списъка.
Кликнете на бутона Empty Selected.

Ако използвате браузъра Mozilla Firefox, направете следното:

Кликнете върху Firefox, който се намира в началото и изберете Select All от списъка.
Кликнете на бутона Empty Selected.
Бележка: Ако искате да съхраните запазените пароли, моля кликнете на No от новопоявилия се прозорец.

Ако използвате браузъра Opera, направете следното:

Кликнете върху Opera който се намира в началото и изберете Select All от списъка.
Кликнете на бутона Empty Selected.
Бележка: Ако искате да съхраните запазените пароли, моля кликнете на No от новопоявилия се прозорец.

Кликнете на бутона Exit, който се намира в главното меню, за да затворите програмата.

Изтеглете Malwarebytes' Anti-Malware от тук

Кликнете два пъти върху mbam-setup.exe за да инсталирате програмата.

* Уверете се, че има отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware, след това кликнете на Finish.
* Ако има намерени по-нови обновления, тя ще ги изтегли и инсталира.
* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
* Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
* Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
* Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Бележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемите вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

15 юни 200917 г.

Привети!!Пускам лог със съмнения за зараза ...започнаха много бавно да ми се отварят страниците с IE 8.Моля за съдействие:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:35:25, on 6/15/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe

C:\WINDOWS\system32\svchost.exe

D:\DC++\инсталации\Engineer Edition\Everest Ultimate Engineer Edition 5.00.1692 (Multilanguage)\everest.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Documents and Settings\Lenovo PC\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\HiJackThis\post.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Lenovo PC\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O8 - Extra context menu item: Send to &Bluetooth Device... - btsendto_ie_ctx.htm

O8 - Extra context menu item: Добави към защитата от банери - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.lenovo.com/us/en/

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe

O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe

O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--

End of file - 4206 bytes

Редактирано 15 юни 200917 г. от icotonev (преглед на промените)

15 юни 200917 г.

Логът е чист. Сканирай и с трите програми от първия пост на тази тема и после пусни логове.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

15 юни 200917 г.

Логът е чист. Сканирай и с трите програми от първия пост на тази тема и после пусни логове.

GoogleUpdate....kakво е това..?

Логът от mbam:

Malwarebytes' Anti-Malware 1.37

Версия на базата от данни: 2284

Windows 5.1.2600 Service Pack 3

6/15/2009 22:55:08

mbam-log-2009-06-15 (22-55-08).txt

Тип сканиране: Бързо сканиране

Сканирани обекти: 106556

Изминало време: 4 minute(s), 53 second(s)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 0

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 0

Заразени файлове: 0

Заразени процеси в паметта:

(Не бяха открити заплахи)

Заразени модули в паметта:

(Не бяха открити заплахи)

Заразени ключове в регистратурата:

(Не бяха открити заплахи)

Заразени стойности в регистратурата:

(Не бяха открити заплахи)

Заразени информационни обекти в регистратурата:

(Не бяха открити заплахи)

Заразени папки:

(Не бяха открити заплахи)

Заразени файлове:

(Не бяха открити заплахи)

15 юни 200917 г.

Здравейте, дали този лог е наред ?

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:07:49, on 16.6.2009 г.

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Garena\Garena.exe

C:\Program Files\mIRC\mirc.exe

C:\Program Files\Steam\Steam.exe

c:\program files\steam\steamapps\ackiq\counter-strike\hl.exe

C:\Program Files\Steam\GameOverlayUI.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Winamp\winamp.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O4 - Startup: ComNet.lnk = ?

O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm

O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{07EF6CCF-60BE-428B-995A-0D3AE5168B9D}: NameServer = 84.54.128.9 84.54.128.8

O17 - HKLM\System\CS1\Services\Tcpip\..\{07EF6CCF-60BE-428B-995A-0D3AE5168B9D}: NameServer = 84.54.128.9 84.54.128.8

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)

O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe

--

End of file - 5846 bytes

15 юни 200917 г.

Логът изглежда наред...

Можеш да Fix-неш тези редове:

O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

и ако си деинсталирал Spyware Doctor поправи и тези:

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)

O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)

Един съвет...замени Adobe Reader с Foxit Reader.

Това е.

Редактирано 15 юни 200917 г. от B-boy[StyLe] (преглед на промените)

16 юни 200917 г.

Хора, омръзнами от някакъв проблем, който не мога да хвана от месец! Проблема е хардуерен, предполагам, но сега се добави и проблем от зоналарм. Явно ще сменям защитната стена и антивирус! Ще пусна отделна тема, ако не ме домързи и ако имам свободно време близките дни.

Накратко - от зоналарм - тинсталнатите програми не се затварят с последната версия на зоналарм! Ако отворя и затворя опера, опера стои отворена н броя пъти, колкото съм я ползвал... нямам навика да рестартирам. тунера - за да работи, го отварям поне два пъти... иначе цикли. всяка тинсталната програма стои резидентна в паметта!!! много дразнещо!!! това по отношение на зоналарм... при изключена, няма проблем с нищо! Друго - постоянни рестарти имах преди време- пуснах мемтест - 1300 грешки! идиотска работа... Смених слотове и преинстал. пак мемтест - няма проблем - 42 теста. Вчера - отново рестарт ... Върнах клока и тем подобни - пак същото... Рамта няма проблем, стабилност явно също, но както си работя - бррррррр (бззззззз) и рестарт. Ми с три-четири компютъра съм в нас и лаптоп, но не ми се експериментира да сменям мишки, клавиатури, тунери и т.н., при положение, че са ползвани вече без проблем. Програмите са едни и същи, портабъл, уиндоуса - и той. Всички инсталации са ми едни и същи, с изключение на драйвери. Едни и същи програми и уиндоус се ползва и на други компютри без проблем.

ми ето и...

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 03:46:48, on 16.6.2009 г.

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Unable to get Internet Explorer version!

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\system32\ctfmon.exe

D:\PORTABLE\Opera\Opera.exe

D:\PortableApps\MEDIA\ChrisTV\ChrisTV.exe

D:\PortableApps\PStart\PStart.exe

D:\PortableApps\MEDIA\ChrisTV\ChrisTV.exe

D:\PortableApps\OFFICE\FineReader 8.0 Pro\Thinstall\FineReader 8.0 Pro\40000018100002i\ScanMan.exe

D:\PortableApps\SYSTEM\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: ForceField Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll

O3 - Toolbar: ForceField Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe

O4 - HKLM\..\Run: [pdfFactory Pro Dispatcher v3] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe" /source=HKLM

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O13 - DefaultPrefix:

O13 - WWW Prefix:

O13 - Home Prefix:

O13 - Mosaic Prefix:

O13 - FTP Prefix:

O13 - Gopher Prefix:

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: ForceField IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--

End of file - 3373 bytes

16 юни 200917 г.

Можеш да фикснеш тези неща:

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O13 - DefaultPrefix:

O13 - WWW Prefix:

O13 - Home Prefix:

O13 - Mosaic Prefix:

O13 - FTP Prefix:

O13 - Gopher Prefix:

PS: От доста време ZoneAlarm за мен не струва...А беше такава класика (особено версия 3)...преди да я купят. Аз я тествах наскоро и я разкарах (има-няма) 2 часа.

16 юни 200917 г.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:40:27 PM, on 6/16/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Mixer.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\WINDOWS\Datecs\Flex2K.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Documents and Settings\fdsa\Desktop\post.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bsplayer-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [Z Chilly Memory opt] C:\Program Files\Chily Memory Optimizer\Chily Memory Optimizer.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [fdsa] C:\Documents and Settings\fdsa\fdsa.exe /i

O4 - Global Startup: FlexType 2K.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{15F6F536-9A70-4F6D-9B75-6BBB2C2CFC01}: NameServer = 10.24.2.1

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

--

End of file - 5577 bytes

ето :rolleyes:

Редактирано 16 юни 200917 г. от unslb (преглед на промените)

17 юни 200917 г.

Можеш да фикснеш тези неща:

PS: От доста време ZoneAlarm за мен не струва...А беше такава класика (особено версия 3)...преди да я купят. Аз я тествах наскоро и я разкарах (има-няма) 2 часа.

От поста и нататък съм с комодо - зоналарм е класа, нищо че товари повече. При мен проблемите възникнаха с виртуализиращата новост. Фиксовете - нищо не стана, но не ме притесняват, те са и на другите машинки, които си работят без проблем. Не се фикснаха, логично, май защото са точно свързани с неща, които съм изключил още в инсталацията. Рестартите продължиха. Пускам мемтест - отново хиляди грешки.... Не знам вече... Веднъж с грешки, друг път без... Явно е проблем... Не знам дали ще ми уважът гаранция и т.н. утре я сменям

18 юни 200917 г.

Здравейте! Ползвам AVAST. Не мога да хвана откъде постоянно се генерират в system32 папката
някакви вируси, от рода на 02.scr 43.scr. Свързано е с опцията (когато е разрешена) в Windows Firewoll - Printer and files sharing. Ако споделянето е спряно тези SCR не се генерират.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:45:45, on 18.6.2009 г.

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Documents and Settings\Peter\Desktop\poster.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe

O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

O17 - HKLM\System\CCS\Services\Tcpip\..\{0BEBFACA-F606-4B84-BC13-2139934752A2}: NameServer = 195.24.94.65,195.24.90.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{0BEBFACA-F606-4B84-BC13-2139934752A2}: NameServer = 195.24.94.65,195.24.90.1

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update Service (gupdate1c9edc99c439dfa) (gupdate1c9edc99c439dfa) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

--

End of file - 5936 bytes

Добре дошли!

HiJackThis/Log :Оптимизация/Анализ/Ревю

Featured Replies

Потребители с най-много отговори

Популярни дни

Най-популярни публикации

lost in

lost in

lost in

Публикувани изображения

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)