Помощ при откриване и премахване на вируси, троянски коне и др., част 2

25 март 200917 г.

Windows Xp Sp3 ... тези 2-та сайта кадето си ги дал също не ми ги отваря и като инсталирвам anti-malware ми дава някакви грешки .. !

П.П Ей сега изтеглих 1-та и я инсталирах и пуснах да сканира на бързо и след малко ще дам резултатите

Редактирано 25 март 200917 г. от Tim4o0 (преглед на промените)

25 март 200917 г.

Windows Xp Sp3 ... тези 2-та сайта кадето си ги дал също не ми ги отваря и като инсталирвам anti-malware ми дава някакви грешки .. !

Виж тези линкове:

http://store3.data.bg/kal/Programs/Malware...aldata.com).exe

http://store3.data.bg/kal/Programs/SUPERAn...aldata.com).exe

И те ли не се отварят?

Какво имаш предвид, като спомена anti-malware? Забрави да споменеш антивирусната си програма.

P.S. Ето линк за (архивирани) инсталатори на тези двете програми: тук.

Редактирано 25 март 200917 г. от nologo (преглед на промените)

25 март 200917 г.

Виж тези линкове:

http://store3.data.bg/kal/Programs/Malware...aldata.com).exe

http://store3.data.bg/kal/Programs/SUPERAn...aldata.com).exe

И те ли не се отварят?

Какво имаш предвид, като спомена anti-malware? Аз такова нещо не съм давал...

Ей сега ги пуснах и 2-те програмки .. Когати си свършат работата ще дам да видиш какво е станало .... !

P.S. Ето резултата от malware... http://pic-bg.net/files/tsoyg3pna85yvjgp8rw6.jpg ....И би ли ми казал да ги трия ли тези или ..

Редактирано 25 март 200917 г. от Tim4o0 (преглед на промените)

25 март 200917 г.

Ей сега ги пуснах и 2-те програмки .. Когати си свършат работата ще дам да видиш какво е станало .... !

P.S. Ето резултата от malware... http://pic-bg.net/files/tsoyg3pna85yvjgp8rw6.jpg

Помолих те за лог на две програми, а не за снимка. Както и да е, може да дадеш сега още един лог в тази тема, виж първия пост. Може също така да качиш някъде (например в 4storing) файла msnsc.exe, намира се в папката C:\Windows\System32.

25 март 200917 г.

Ето ти линка с файла http://4storing.com/lhj63/519a835fba3fdbe0...9ffe49471b.html .. и си виш лС-то

25 март 200917 г.

Ето ти линка с файла http://4storing.com/lhj63/519a835fba3fdbe0...9ffe49471b.html .. и си виш лС-то

Следвай сега инструкциите на B-boy[styLe].

Редактирано 25 март 200917 г. от nologo (преглед на промените)

25 март 200917 г.

Има напредък щом е успял да я инсталира.

А иначе за оправяне на проблемите с интернет достъпа до сайтовете на разработчиците на зщитен софтуер пробвай и следните неща:

http://www.kaldata.com/forums/index.php?sh...t&p=1309186

@nologo добра работа.

28 март 200917 г.

Ето това е:

ComboFix 09-03-27.02 - 2009-03-28 23:46:22.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.511.158 [GMT 2:00]

.......................

Command switches used :: /killall

AV: AVG Internet Security *On-access scanning enabled* (Updated)

FW: AVG Firewall *enabled*

* Created a new restore point

* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\_000005_.tmp.dll

c:\windows\system32\_000006_.tmp.dll

c:\windows\system32\dumphive.exe

c:\windows\system32\o4Patch.exe

c:\windows\system32\Process.exe

c:\windows\system32\SrchSTS.exe

c:\windows\system32\tmp.reg

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_PCIDump

((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-28 )))))))))))))))))))))))))))))))

.

2009-03-28 23:42 . 2009-03-28 23:43 <DIR> d-------- C:\32788R22FWJFW

2009-03-25 23:03 . 2009-03-25 23:03 <DIR> d-------- c:\program files\Trend Micro

2009-03-25 23:00 . 2009-03-28 15:42 <DIR> d-------- c:\program files\Arovax AntiSpyware

2009-03-25 23:00 . 2009-03-25 23:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\Arovax

2009-03-25 00:56 . 2009-03-25 00:56 2,140 --a------ c:\windows\system32\10003.sks

2009-03-25 00:56 . 2009-03-25 00:56 1,718 --a------ c:\windows\system32\10004.sks

2009-03-25 00:56 . 2009-03-25 00:56 244 --a------ c:\windows\system32\10001.sks

2009-03-25 00:56 . 2009-03-25 00:56 0 --a------ c:\windows\system32\10002.sks

2009-03-25 00:50 . 2009-03-25 00:56 2,380 --a------ c:\windows\system32\BlockedCookies

2009-03-24 18:29 . 2009-03-24 20:58 492 --a------ c:\windows\FOE2.ini

2009-03-24 16:45 . 2003-07-19 17:17 5,174 --a------ c:\windows\system32\nppt9x.vxd

2009-03-24 16:45 . 2005-01-03 08:43 4,682 --a------ c:\windows\system32\npptNT2.sys

2009-03-24 16:44 . 2009-03-24 16:44 <DIR> d-------- c:\program files\Common Files\INCA Shared

2009-03-22 19:25 . 2009-03-22 19:25 <DIR> d-------- C:\TEMP

2009-03-21 21:08 . 2009-03-21 21:08 <DIR> d--h----- c:\windows\PIF

2009-03-21 20:06 . 2009-03-21 20:06 0 --a------ c:\windows\ativpsrm.bin

2009-03-21 20:01 . 2009-03-21 20:05 610,336 --ahs---- c:\windows\system32\drivers\fidbox.dat

2009-03-21 20:01 . 2009-03-21 20:05 9,272 --ahs---- c:\windows\system32\drivers\fidbox.idx

2009-03-21 19:40 . 2009-03-24 23:21 <DIR> d-------- c:\program files\Wise Disk Cleaner

2009-03-21 19:33 . 2009-03-25 01:12 <DIR> d-------- c:\program files\Wise Registry Cleaner 3 Pro

2009-03-20 15:36 . 2009-03-20 15:36 <DIR> d-------- c:\documents and settings\stefan ivanov\Application Data\DAEMON Tools Pro

2009-03-20 15:36 . 2009-03-20 15:36 <DIR> d-------- c:\documents and settings\stefan ivanov\Application Data\DAEMON Tools

2009-03-20 15:35 . 2009-03-20 15:35 <DIR> d-------- c:\program files\DAEMON Tools Lite

2009-03-20 15:35 . 2009-03-20 15:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite

2009-03-20 15:32 . 2009-03-20 15:37 <DIR> d-------- c:\documents and settings\stefan ivanov\Application Data\DAEMON Tools Lite

2009-03-20 15:32 . 2009-03-20 15:32 717,296 --a------ c:\windows\system32\drivers\sptd.sys

2009-03-17 21:43 . 2009-03-24 14:36 <DIR> d-------- c:\program files\BitComet

2009-03-17 20:46 . 2009-03-17 20:46 <DIR> d-------- c:\program files\SA Dictionary 2008 Beta 4

2009-03-17 19:56 . 2009-03-28 22:04 <DIR> d-------- c:\documents and settings\stefan ivanov\Application Data\Skype

2009-03-17 19:55 . 2009-03-17 19:55 <DIR> dr------- c:\program files\Skype

2009-03-17 19:55 . 2009-03-17 19:55 <DIR> d-------- c:\documents and settings\All Users\Application Data\Skype

2009-03-17 18:11 . 2009-03-17 18:11 <DIR> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2

2009-03-17 18:09 . 2009-03-27 14:49 110 --a------ C:\index.ini

2009-03-17 16:09 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll

2009-03-17 16:09 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll

2009-03-17 16:09 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui

2009-03-17 15:59 . 2009-03-16 14:27 15,688 --a------ c:\windows\system32\lsdelete.exe

2009-03-17 13:41 . 2009-03-17 13:41 4,444 --a------ c:\windows\system32\pid.PNF

2009-03-17 11:48 . 2008-04-14 05:42 116,224 --a--c--- c:\windows\system32\dllcache\xrxwiadr.dll

2009-03-17 11:48 . 2001-08-17 22:37 27,648 --a--c--- c:\windows\system32\dllcache\xrxftplt.exe

2009-03-17 11:48 . 2001-08-17 22:36 23,040 --a--c--- c:\windows\system32\dllcache\xrxwbtmp.dll

2009-03-17 11:48 . 2008-04-14 05:42 18,944 --a--c--- c:\windows\system32\dllcache\xrxscnui.dll

2009-03-17 11:48 . 2001-08-17 22:37 4,608 --a--c--- c:\windows\system32\dllcache\xrxflnch.exe

2009-03-17 11:47 . 2001-08-17 22:37 99,865 --a--c--- c:\windows\system32\dllcache\xlog.exe

2009-03-17 11:47 . 2008-04-13 22:04 19,455 --a--c--- c:\windows\system32\dllcache\wvchntxx.sys

2009-03-17 11:47 . 2001-08-17 12:11 16,970 --a--c--- c:\windows\system32\dllcache\xem336n5.sys

2009-03-17 11:47 . 2008-04-13 22:04 12,063 --a--c--- c:\windows\system32\dllcache\wsiintxx.sys

2009-03-17 11:47 . 2008-04-14 05:42 8,192 --a--c--- c:\windows\system32\dllcache\wshirda.dll

2009-03-17 11:45 . 2001-08-17 13:28 794,399 --a--c--- c:\windows\system32\dllcache\usr1806v.sys

2009-03-17 11:45 . 2001-08-17 13:28 765,884 --a--c--- c:\windows\system32\dllcache\usrti.sys

2009-03-17 11:45 . 2001-08-17 13:28 687,999 --a--c--- c:\windows\system32\dllcache\usrwdxjs.sys

2009-03-17 11:45 . 2001-08-17 13:28 604,253 --a--c--- c:\windows\system32\dllcache\vmodem.sys

2009-03-17 11:45 . 2001-08-17 13:28 397,502 --a--c--- c:\windows\system32\dllcache\vpctcom.sys

2009-03-17 11:45 . 2001-08-17 12:14 249,402 --a--c--- c:\windows\system32\dllcache\vinwm.sys

2009-03-17 11:45 . 2001-08-17 13:28 224,802 --a--c--- c:\windows\system32\dllcache\usr1807a.sys

2009-03-17 11:45 . 2001-08-17 13:28 113,762 --a--c--- c:\windows\system32\dllcache\usrpda.sys

2009-03-17 11:45 . 2001-08-17 13:28 64,605 --a--c--- c:\windows\system32\dllcache\vvoice.sys

2009-03-17 11:45 . 2001-08-17 13:49 24,576 --a--c--- c:\windows\system32\dllcache\viairda.sys

2009-03-17 11:45 . 2001-08-17 13:28 7,556 --a--c--- c:\windows\system32\dllcache\usroslba.sys

2009-03-17 11:45 . 2008-04-14 00:10 5,376 --a--c--- c:\windows\system32\dllcache\viaide.sys

2009-03-17 11:43 . 2001-08-17 22:36 525,568 --a--c--- c:\windows\system32\dllcache\tridxp.dll

2009-03-17 11:42 . 2001-08-17 14:56 172,768 --a--c--- c:\windows\system32\dllcache\t2r4disp.dll

2009-03-17 11:42 . 2008-04-14 00:10 149,376 --a--c--- c:\windows\system32\dllcache\tffsport.sys

2009-03-17 11:42 . 2001-08-17 12:51 138,528 --a--c--- c:\windows\system32\dllcache\tgiulnt5.sys

2009-03-17 11:42 . 2001-08-17 12:14 123,995 --a--c--- c:\windows\system32\dllcache\tjisdn.sys

2009-03-17 11:42 . 2001-08-17 14:56 81,408 --a--c--- c:\windows\system32\dllcache\tgiul50.dll

2009-03-17 11:42 . 2001-08-17 12:13 37,961 --a--c--- c:\windows\system32\dllcache\tdk100b.sys

2009-03-17 11:42 . 2001-08-17 12:50 36,640 --a--c--- c:\windows\system32\dllcache\t2r4mini.sys

2009-03-17 11:42 . 2001-08-17 14:07 32,640 --a--c--- c:\windows\system32\dllcache\symc8xx.sys

2009-03-17 11:42 . 2001-08-17 13:49 30,464 --a--c--- c:\windows\system32\dllcache\tbatm155.sys

2009-03-17 11:42 . 2001-08-17 12:10 28,232 --a--c--- c:\windows\system32\dllcache\tos4mo.sys

2009-03-17 11:42 . 2001-08-17 12:13 17,129 --a--c--- c:\windows\system32\dllcache\tdkcd31.sys

2009-03-17 11:42 . 2001-08-17 13:52 7,040 --a--c--- c:\windows\system32\dllcache\tandqic.sys

2009-03-17 11:40 . 2001-08-17 22:36 114,688 --a--c--- c:\windows\system32\dllcache\sonypi.dll

2009-03-17 11:40 . 2001-08-17 22:36 106,584 --a--c--- c:\windows\system32\dllcache\spdports.dll

2009-03-17 11:40 . 2001-08-17 22:36 99,328 --a--c--- c:\windows\system32\dllcache\srusd.dll

2009-03-17 11:40 . 2001-08-17 13:51 61,824 --a--c--- c:\windows\system32\dllcache\speed.sys

2009-03-17 11:40 . 2001-08-17 12:51 58,368 --a--c--- c:\windows\system32\dllcache\smiminib.sys

2009-03-17 11:40 . 2001-08-17 12:51 37,040 --a--c--- c:\windows\system32\dllcache\sonypi.sys

2009-03-17 11:40 . 2001-08-17 22:36 24,660 --a--c--- c:\windows\system32\dllcache\spxupchk.dll

2009-03-17 11:40 . 2001-08-17 12:51 20,752 --a--c--- c:\windows\system32\dllcache\sonync.sys

2009-03-17 11:40 . 2001-08-17 14:07 19,072 --a--c--- c:\windows\system32\dllcache\sparrow.sys

2009-03-17 11:40 . 2001-08-17 13:53 9,600 --a--c--- c:\windows\system32\dllcache\sonymc.sys

2009-03-17 11:40 . 2001-08-17 13:56 7,552 --a--c--- c:\windows\system32\dllcache\sonypvu1.sys

2009-03-17 11:40 . 2008-04-14 00:10 7,552 --a--c--- c:\windows\system32\dllcache\sonyait.sys

2009-03-17 11:40 . 2001-08-17 13:53 7,040 --a--c--- c:\windows\system32\dllcache\snyaitmc.sys

2009-03-17 11:38 . 2001-08-17 14:56 252,032 --a--c--- c:\windows\system32\dllcache\sis300iv.dll

2009-03-17 11:38 . 2001-08-17 22:36 238,592 --a--c--- c:\windows\system32\dllcache\sisgrv.dll

2009-03-17 11:38 . 2001-07-21 14:29 161,568 --a--c--- c:\windows\system32\dllcache\sgsmusb.sys

2009-03-17 11:38 . 2001-08-17 14:56 150,144 --a--c--- c:\windows\system32\dllcache\sis6306v.dll

2009-03-17 11:38 . 2001-08-17 12:50 104,064 --a--c--- c:\windows\system32\dllcache\sisgrp.sys

2009-03-17 11:38 . 2001-08-17 12:50 101,760 --a--c--- c:\windows\system32\dllcache\sis300ip.sys

2009-03-17 11:38 . 2001-08-17 12:51 98,080 --a--c--- c:\windows\system32\dllcache\sgiulnt5.sys

2009-03-17 11:38 . 2001-08-17 12:50 68,608 --a--c--- c:\windows\system32\dllcache\sis6306p.sys

2009-03-17 11:38 . 2001-08-17 12:50 50,432 --a--c--- c:\windows\system32\dllcache\sisv.sys

2009-03-17 11:38 . 2008-04-13 22:05 32,768 --a--c--- c:\windows\system32\dllcache\sisnic.sys

2009-03-17 11:38 . 2001-07-21 14:29 18,400 --a--c--- c:\windows\system32\dllcache\sgsmld.sys

2009-03-17 11:36 . 2001-08-17 14:56 245,632 --a--c--- c:\windows\system32\dllcache\s3savmx.dll

2009-03-17 11:35 . 2001-08-17 13:28 899,146 --a--c--- c:\windows\system32\dllcache\r2mdkxga.sys

2009-03-17 11:35 . 2001-08-17 13:28 714,762 --a--c--- c:\windows\system32\dllcache\r2mdmkxx.sys

2009-03-17 11:35 . 2001-08-17 22:36 86,097 --a--c--- c:\windows\system32\dllcache\reslog32.dll

2009-03-17 11:35 . 2008-04-14 00:10 79,104 --a--c--- c:\windows\system32\dllcache\rocket.sys

2009-03-17 11:35 . 2001-08-17 22:36 41,472 --a--c--- c:\windows\system32\dllcache\qvusd.dll

2009-03-17 11:35 . 2001-08-17 12:12 37,563 --a--c--- c:\windows\system32\dllcache\rlnet5.sys

2009-03-17 11:35 . 2001-08-17 12:19 30,720 --a--c--- c:\windows\system32\dllcache\rthwcls.sys

2009-03-17 11:35 . 2001-08-17 13:51 19,584 --a--c--- c:\windows\system32\dllcache\rasirda.sys

2009-03-17 11:35 . 2001-08-17 12:12 19,017 --a--c--- c:\windows\system32\dllcache\rtl8029.sys

2009-03-17 11:35 . 2001-08-17 22:36 9,216 --a--c--- c:\windows\system32\dllcache\rsmgrstr.dll

2009-03-17 11:35 . 2001-08-17 12:19 3,840 --a--c--- c:\windows\system32\dllcache\rpfun.sys

2009-03-17 11:35 . 2001-08-17 13:53 3,328 --a--c--- c:\windows\system32\dllcache\qv2kux.sys

2009-03-17 11:33 . 2008-04-14 05:40 259,328 --a--c--- c:\windows\system32\dllcache\perm3dd.dll

2009-03-17 11:32 . 2001-08-17 14:05 351,616 --a--c--- c:\windows\system32\dllcache\ovcodek2.sys

2009-03-17 11:31 . 2008-08-14 11:33 2,023,936 --a--c--- c:\windows\system32\dllcache\ntkrpamp.exe

2009-03-17 11:31 . 2001-08-17 12:50 198,144 --a--c--- c:\windows\system32\dllcache\nv3.sys

2009-03-17 11:31 . 2001-08-17 22:36 123,776 --a--c--- c:\windows\system32\dllcache\nv3.dll

2009-03-17 11:31 . 2008-04-14 00:16 61,696 --a--c--- c:\windows\system32\dllcache\ohci1394.sys

2009-03-17 11:31 . 2001-08-17 12:20 54,528 --a--c--- c:\windows\system32\dllcache\opl3sax.sys

2009-03-17 11:31 . 2001-08-17 13:28 54,186 --a--c--- c:\windows\system32\dllcache\otcsercb.sys

2009-03-17 11:31 . 2001-08-17 12:49 51,552 --a--c--- c:\windows\system32\dllcache\ntgrip.sys

2009-03-17 11:31 . 2001-08-17 12:12 43,689 --a--c--- c:\windows\system32\dllcache\otceth5.sys

2009-03-17 11:31 . 2008-04-14 00:24 28,672 --a--c--- c:\windows\system32\dllcache\nscirda.sys

2009-03-17 11:31 . 2001-08-17 12:12 27,209 --a--c--- c:\windows\system32\dllcache\otc06x5.sys

2009-03-17 11:31 . 2001-08-17 13:47 9,344 --a--c--- c:\windows\system32\dllcache\ntapm.sys

2009-03-17 11:31 . 2001-08-17 13:53 7,552 --a--c--- c:\windows\system32\dllcache\nsmmc.sys

2009-03-17 11:29 . 2001-08-17 12:50 103,296 --a--c--- c:\windows\system32\dllcache\mtxvideo.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-28 21:51 --------- d-----w c:\program files\Autorun Eater

2009-03-28 11:39 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP

2009-03-22 14:12 --------- d-----w c:\program files\Common Files\Acronis

2009-03-22 14:12 --------- d-----w c:\program files\Acronis

2009-03-22 06:40 --------- d-----w c:\program files\SpywareBlaster

2009-03-21 17:45 --------- d-----w c:\program files\a-squared HiJackFree

2009-03-20 13:43 --------- d--h--w c:\program files\InstallShield Installation Information

2009-03-20 13:37 --------- d-----w c:\program files\Common Files\InstallShield

2009-03-16 12:56 --------- d-----w c:\program files\C-Media 3D Audio

2009-03-16 12:29 --------- dc-h--w c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}

2009-03-16 12:27 64,160 ----a-w c:\windows\system32\drivers\Lbd.sys

2009-03-16 12:27 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

2009-03-16 12:23 --------- d-----w c:\program files\Lavasoft

2009-03-16 11:59 --------- d-----w c:\program files\ATI Technologies

2009-03-16 11:39 --------- d-----w c:\documents and settings\LocalService\Application Data\Acronis

2009-03-16 11:37 441,760 ----a-w c:\windows\system32\drivers\timntr.sys

2009-03-16 11:37 44,384 ----a-w c:\windows\system32\drivers\tifsfilt.sys

2009-03-16 11:37 --------- d-----w c:\documents and settings\All Users\Application Data\Acronis

2009-03-16 11:36 368,480 ----a-w c:\windows\system32\drivers\tdrpman.sys

2009-03-16 11:36 132,224 ----a-w c:\windows\system32\drivers\snapman.sys

2009-03-16 11:11 --------- d-----w c:\program files\microsoft frontpage

2009-02-09 11:13 1,846,784 ----a-w c:\windows\system32\win32k.sys

2009-01-15 00:05 911,872 ----a-w c:\windows\system32\wininet.dll

2009-01-15 00:05 43,008 ----a-w c:\windows\system32\licmgr10.dll

2009-01-15 00:04 18,944 ----a-w c:\windows\system32\corpol.dll

2009-01-15 00:03 72,704 ----a-w c:\windows\system32\admparse.dll

2009-01-15 00:03 71,680 ----a-w c:\windows\system32\iesetup.dll

2009-01-15 00:03 420,352 ----a-w c:\windows\system32\vbscript.dll

2009-01-15 00:01 34,304 ----a-w c:\windows\system32\imgutil.dll

2009-01-15 00:00 48,128 ----a-w c:\windows\system32\mshtmler.dll

2009-01-15 00:00 45,568 ----a-w c:\windows\system32\mshta.exe

2009-01-14 23:50 156,160 ----a-w c:\windows\system32\msls31.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2008-04-09 2595792]

"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2008-04-09 909208]

"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2008-04-09 136472]

"Autorun Eater"="c:\program files\Autorun Eater\oldmcdonald.exe" [2008-11-27 501768]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-16 515416]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-27 1932568]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-03-27 09:27 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

"d:\\Games\\FIFA Online\\FIFA Online 2\\FF2Client.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-03-17 12552]

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-03-16 64160]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-03-17 325640]

R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-03-17 108552]

R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-03-17 908056]

R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-17 298264]

R2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-03-17 1356616]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 951632]

R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2009-03-17 29208]

S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2009-03-17 29208]

S3 SM_SUGE1_FUService;SUGE1 Status Monitor Service;"c:\program files\SAMSUNG\Samsung SCX-4200 Series\SPanel\ssmsrvc /Service --> c:\program files\SAMSUNG\Samsung SCX-4200 Series\SPanel\ssmsrvc [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-03-23 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-16 14:26]

.

- - - - ORPHANS REMOVED - - - -

Notify-dimsntfy - (no file)

.

------- Supplementary Scan -------

.

Trusted Zone: microsoft.com\*.update

Trusted Zone: microsoft.com\*.windowsupdate

Trusted Zone: microsoft.com\update

Trusted Zone: windowsupdate.com

Trusted Zone: windowsupdate.com\download

TCP: {83EFADA1-2514-4654-AA2D-4C0932F5EFFE} = 88.87.0.2,88.87.10.2

FF - ProfilePath - c:\documents and settings\stefan ivanov\Application Data\Mozilla\Firefox\Profiles\ov77sk71.default\

FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-28 23:52:13

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SM_SUGE1_FUService]

"ImagePath"="\"c:\program files\SAMSUNG\Samsung SCX-4200 Series\SPanel\ssmsrvc /Service"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1244)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(1332)

c:\windows\system32\relog_ap.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\program files\Common Files\Acronis\Schedule2\schedul2.exe

c:\program files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

c:\progra~1\AVG\AVG8\avgam.exe

c:\program files\AVG\AVG8\avgrsx.exe

c:\progra~1\AVG\AVG8\avgnsx.exe

c:\program files\Autorun Eater\billy.exe

c:\program files\AVG\AVG8\avgcsrvx.exe

c:\windows\system32\wbem\unsecapp.exe

c:\windows\system32\wpabaln.exe

.

**************************************************************************

.

Completion time: 2009-03-28 23:55:22 - machine was rebooted

ComboFix-quarantined-files.txt 2009-03-28 21:55:05

Pre-Run: 2 508 603 392 bytes free

Post-Run: 2,447,921,152 bytes free

286 --- E O F --- 2009-03-17 14:12:26

28 март 200917 г.

Отворете Notepad и чрез copy/paste поставете следното:

Killall::


File::

c:\windows\system32\10003.sks

c:\windows\system32\10004.sks

c:\windows\system32\10001.sks

c:\windows\system32\10002.sks

C:\WINDOWS\ativpsrm.bin

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След, като програмата приключи ще Ви изведе лог файла. Чрез Copy/Paste поставете информацията тук.

28 март 200917 г.

ComboFix 09-03-27.02 - stefan ivanov 2009-03-29 0:20:16.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.511.116 [GMT 2:00]

Running from: c:\documents and settings\stefan ivanov\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\stefan ivanov\Desktop\CFScript.txt

AV: AVG Internet Security *On-access scanning enabled* (Updated)

FW: AVG Firewall *enabled*

* Created a new restore point

* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

c:\windows\ativpsrm.bin

c:\windows\system32\10001.sks

c:\windows\system32\10002.sks

c:\windows\system32\10003.sks

c:\windows\system32\10004.sks