bg_fenka, необходимо е да заменим твоя инжектиран hosts файл с оригиналния от Microsoft. За целта:

1) Изтеглете: HostsXpert

2) Разархивирайте архива

3) Кликнете два пъти върху HostXpert.exe, за да стартирате приложението

4) Кликнете на бутона Make Writeable? (Ако е там)

5) Кликнете на бутона Restore MS Hosts File и от новопоявилия се прозорец потвърдете желанието си с OK

6) Накрая рестартирайте компютъра си

Накрая пуснете нов лог файл от HiJackThis, за да видя дали има промяна.

Scater, бихме могли да проверим за наличие на зловреден софтуер на вашия компютър, но от описаното силно се съмнявам, че проблемът е това. Все пак:

Сега, изтеглете ATF Cleaner

Запазете го на вашия десктоп.

• Кликнете два пъти върху ATF-Cleaner.exe , за да стартирате програмата.
  
• Кликнете на Select All, който се намира в най-долната част на списъка.
  
• Кликнете на бутона Empty Selected.
  

Ако използвате браузъра Mozilla Firefox, направете следното:

• Кликнете върху Firefox, който се намира в началото и изберете Select All от списъка.
  
• Кликнете на бутона Empty Selected.
  
• Бележка: Ако искате да съхраните запазените пароли, моля кликнете на No от новопоявилия се прозорец.
  

Ако използвате браузъра Opera, направете следното:

• Кликнете върху Opera който се намира в началото и изберете Select All от списъка.
  
• Кликнете на бутона Empty Selected.
  
• Бележка: Ако искате да съхраните запазените пароли, моля кликнете на No от новопоявилия се прозорец.
  

Кликнете на бутона Exit, който се намира в главното меню, за да затворите програмата.

Изтеглете Malwarebytes' Anti-Malware от тук

Кликнете два пъти върху mbam-setup.exe за да инсталирате програмата.

• * Уверете се, че има отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware, след това кликнете на Finish.
  * Ако има намерени по-нови обновления, тя ще ги изтегли и инсталира.
  * Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
  * Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
  * Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
  * Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
  * Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.
  

Бележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемите вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Моля, изтеглете HijackThis от тук.

Запазете инструмента в негова собствена папка (Например в: C:\HJT).

След това, отворете HijackThis, и изберете Do a system scan and save a logfile.

Ще Ви се отвори Notepad. Моля, поставете съдържанието на Notepad.

Редактирано 13 юни 200917 г. от Fixer (преглед на промените)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:33:54 PM, on 6/13/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\VTTimer.exe

C:\WINDOWS\system32\VTtrayp.exe

C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe

C:\Program Files\Softwin\BitDefender9\bdoesrv.exe

C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe

C:\PROGRA~1\Softwin\BITDEF~1\bdswitch.exe

C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\WINDOWS\FixCamera.exe

C:\WINDOWS\tsnp2std.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Skype\Phone\Skype.exe

D:\Program Files\Datecs\FlexType 2K\FType2K.exe

C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Teleca Shared\Generic.exe

C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Softwin\BitDefender9\vsserv.exe

C:\Program Files\Skype\Plugin Manager\SkypePM.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe

O4 - HKLM\..\Run: [bDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe

O4 - HKLM\..\Run: [bDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"

O4 - HKLM\..\Run: [bDNewsAgent] "C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe"

O4 - HKLM\..\Run: [bDSwitchAgent] "C:\PROGRA~1\Softwin\BITDEF~1\bdswitch.exe"

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe

O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: FlexType 2K.lnk = D:\Program Files\Datecs\FlexType 2K\FType2K.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: Make Mobile Logo - C:\PROGRA~1\MOBILE~1\MLogoContExt.html

O8 - Extra context menu item: Е&кспортирай в Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1173356073015

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

O23 - Service: SecureSrv - Unknown owner - D:\Program Files\Hide My IP 2008\SecureSrv.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe

O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--

End of file - 5624 bytes

Редактирано 13 юни 200917 г. от mihnev_sz
Избягвайте прекомерно дългите цитати (преглед на промените)

Готово! Вече сте чиста Препоръчвам Ви, както и mihnev_sz да смените антивирусния си софтуер. Платен вариант - ESET NOD32 Antivirus, а за безплатен mihnev_sz Ви препоръча - Avast! или Avira. И за трите продукта, можете да прочетете повече в форума.

Готово! Вече сте чиста Препоръчвам Ви, както и mihnev_sz да смените антивирусния си софтуер. Платен вариант - ESET NOD32 Antivirus, а за безплатен mihnev_sz Ви препоръча - Avast! или Avira. И за трите продукта, можете да прочетете повече в форума.

Ок,мерси много ! Можеш ли само да кажеш сега как да върна тая настройка на антивирусната Bitcomet , че нали като инсталирах една от програмите трябваше да : Изключете Real-Time защитата на вашия антивирусен софтуер.

Антивирусната ти програма е BitDefender и Real-Time защитата автоматично се включа след рестартиране на компютъра, така че не се притеснявай, стига да си го рестартирала вече.

Malwarebytes' Anti-Malware

Версия на базата от данни: 2271

Windows 5.1.2600 Service Pack 2

13.6.2009 г. 18:35:02

mbam-log-2009-06-13 (18-35-02).txt

Тип сканиране: Пълно сканиране (C:\|D:\|)

Сканирани обекти: 234090

Изминало време: 57 minute(s), 4 second(s)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 3

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 2

Заразени файлове: 6

Заразени процеси в паметта:

(Не бяха открити заплахи)

Заразени модули в паметта:

(Не бяха открити заплахи)

Заразени ключове в регистратурата:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\seekapp (Adware.Seekapp) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Seekapp (Adware.Seekapp) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Seekapp Service (Adware.Seekapp) -> Quarantined and deleted successfully.

Заразени стойности в регистратурата:

(Не бяха открити заплахи)

Заразени информационни обекти в регистратурата:

(Не бяха открити заплахи)

Заразени папки:

C:\Program Files\Seekapp (Adware.Seekapp) -> Quarantined and deleted successfully.

c:\documents and settings\All Users\Application Data\Seekapp (Adware.Seekapp) -> Quarantined and deleted successfully.

Заразени файлове:

d:\Programs\EXE\Background Changer.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\program files\Seekapp\readme.html (Adware.Seekapp) -> Quarantined and deleted successfully.

c:\program files\Seekapp\seekapp.exe (Adware.Seekapp) -> Quarantined and deleted successfully.

c:\program files\Seekapp\uninstall.exe (Adware.Seekapp) -> Quarantined and deleted successfully.

c:\documents and settings\all users\application data\Seekapp\seekapp127.exe (Adware.Seekapp) -> Quarantined and deleted successfully.

c:\WINDOWS\explorer.backup (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis

Scan saved at 18:46:47, on 13.6.2009 г.

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\vsnpstd3.exe

C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Trend Micro\BM\TMBMSRV.exe

C:\Documents and Settings\Valentine\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe

C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Trend Micro\Internet Security\TmPfw.exe

C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe

C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe

C:\Program Files\Opera\opera.exe

C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe

O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

O4 - HKLM\..\Run: [ufSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Valentine\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe

O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1244571690703

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampp\apache\bin\apache.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe

O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

O23 - Service: XAMPP Service (XAMPP) - Unknown owner - C:\xampp\service.exe (file missing)

--

End of file - 6645 bytes

Моля, отворете HijackThis, и изберете Do a system scan only.

Сложете отметки на следните редове:

O23 - Service: XAMPP Service (XAMPP) - Unknown owner - C:\xampp\service.exe (file missing)

След това, затворете всички отворени прозорци, освен този на HiJackThis, и изберете Fix checked.

Моля, отидете на Start --> Settings --> Control Panel --> Add or Remove Programs, и деинсталирайте следните програми (Ако присъстват в списъка):

Adobe Reader

Ask Toolbar

Вашия Adobe Reader е много стара версия и уязвима, затова Ви съветвам да я деинсталирате. Ask Toolbar е ненужен и силно препоръчително е да го премахнете.

1) Изтеглете ComboFix от: тук

2) Запазете го на работния си плот (десктоп).

3) Изключете Real-Time защитата на вашия антивирусен софтуер.

4) Кликнете два пъти върху combofix.exe

5) ComboFix ще започне да сканира вашата система, докато трае сканирането не барайте нищо. Накрая ще се рестартира компютъра Ви.

6) След рестарта изчакайте да завърши сканирането на ComboFix и да генерира лог файл. Когато сканирането завърши ще Ви изскочи Notepad, копирайте съдържанието му и го публикувайте в следващия си пост тук. Ако не Ви изскочи, влезте в C:\ и намерете файл с името combofix.txt . Отворете го, копирайте съдържанието му и го публикувайте тук.

Редактирано 13 юни 200917 г. от Fixer (преглед на промените)

ComboFix 09-06-12.04 - Valentine 06.2009 г. 19:43.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.255.72 [GMT 3:00]

Running from: c:\documents and settings\Valentine\Desktop\ComboFix.exe

AV: Trend Micro Internet Security *On-access scanning disabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}

FW: Trend Micro Personal Firewall *enabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2009-05-13 to 2009-06-13 )))))))))))))))))))))))))))))))

.

2009-06-13 14:21 . 2009-06-13 14:21 -------- d-----w- c:\documents and settings\Valentine\Application Data\Malwarebytes

2009-06-13 14:21 . 2009-06-13 14:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-06-11 08:19 . 2009-06-11 08:19 -------- d-----w- c:\windows\system32\wbem\Repository

2009-06-11 08:18 . 2009-06-11 08:18 -------- d-----w- c:\documents and settings\Valentine\Application Data\GetRightToGo

2009-06-11 08:12 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2009-06-11 08:12 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2009-06-11 08:12 . 2009-04-30 21:22 1985024 -c----w- c:\windows\system32\dllcache\iertutil.dll

2009-06-11 08:12 . 2009-04-30 21:22 11064832 -c----w- c:\windows\system32\dllcache\ieframe.dll

2009-06-11 08:04 . 2009-06-11 08:17 -------- d-----w- c:\windows\LastGood(2)

2009-06-10 19:37 . 2005-05-10 15:54 258352 ----a-w- c:\windows\system32\unicows.dll

2009-06-10 07:54 . 2008-10-16 11:06 268648 ----a-w- c:\windows\system32\mucltui.dll

2009-06-09 07:45 . 2008-07-30 08:05 595208 ----a-w- c:\documents and settings\All Users\Application Data\Trend Micro\OL\tmaseng.dll

2009-06-05 20:08 . 2009-06-05 20:08 -------- d-----w- c:\documents and settings\Valentine\Application Data\ImTOO Software Studio

2009-06-05 20:06 . 2009-06-05 20:06 -------- d-----w- c:\program files\ImTOO

2009-06-03 06:31 . 2009-06-03 06:31 -------- d-----w- c:\documents and settings\Valentine\Application Data\AccurateRip

2009-06-03 06:31 . 2009-06-03 06:30 5433520 ----a-w- c:\windows\system32\SpoonUninstall.exe

2009-06-03 06:30 . 2009-06-03 06:30 -------- d-----w- c:\program files\Illustrate

2009-05-31 19:34 . 2009-05-31 19:34 -------- d-----w- c:\program files\Sony Ericsson

2009-05-25 15:59 . 2009-05-25 15:59 -------- d-----w- c:\documents and settings\Valentine\Application Data\SoundSpectrum

2009-05-25 15:58 . 2009-05-25 15:58 -------- d-----w- c:\program files\SoundSpectrum

2009-05-24 17:50 . 2009-05-24 17:50 -------- d-sh--w- c:\documents and settings\Valentine\IECompatCache

2009-05-24 17:48 . 2009-05-24 17:48 -------- d-sh--w- c:\documents and settings\Valentine\PrivacIE

2009-05-24 13:47 . 2009-05-24 13:47 0 ----a-w- c:\windows\nsreg.dat

2009-05-24 13:46 . 2009-05-24 13:46 -------- d-----w- c:\documents and settings\Valentine\Local Settings\Application Data\Mozilla

2009-05-24 12:02 . 2009-05-24 12:02 -------- d-sh--w- c:\documents and settings\Valentine\IETldCache

2009-05-24 09:25 . 2009-05-24 09:25 -------- d-----w- c:\windows\ie8updates

2009-05-24 09:25 . 2009-04-25 05:30 102400 -c----w- c:\windows\system32\dllcache\iecompat.dll

2009-05-24 09:22 . 2009-05-24 09:24 -------- dc-h--w- c:\windows\ie8

2009-05-24 09:22 . 2009-05-24 09:23 -------- d-----w- c:\windows\system32\bg-BG

2009-05-17 09:15 . 2002-01-05 12:37 344064 ----a-w- c:\windows\system32\msvcr70.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-06-13 16:27 . 2009-03-23 16:15 -------- d-----w- c:\program files\Common Files\Adobe

2009-06-13 16:23 . 2009-04-06 12:20 -------- d-----w- c:\program files\Trend Micro

2009-06-13 05:22 . 2009-03-23 15:45 -------- d-----w- c:\documents and settings\Valentine\Application Data\Skype

2009-06-12 20:45 . 2009-03-23 19:51 -------- d-----w- c:\documents and settings\Valentine\Application Data\skypePM

2009-06-11 08:25 . 2009-03-23 14:38 88344 ----a-w- c:\documents and settings\Valentine\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-06-11 08:18 . 2009-03-28 14:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2009-06-09 07:44 . 2009-04-06 12:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Trend Micro

2009-06-05 22:17 . 2009-03-23 15:58 -------- d-----w- c:\documents and settings\Valentine\Application Data\uTorrent

2009-06-03 20:58 . 2009-04-19 10:37 -------- d-----w- c:\program files\Common Files\Teleca Shared

2009-05-19 16:57 . 2009-03-23 15:45 -------- d-----w- c:\documents and settings\Valentine\Application Data\Media Player Classic

2009-05-18 20:53 . 2009-03-23 15:38 -------- d-----w- c:\program files\vloader

2009-05-15 18:21 . 2009-03-31 14:56 -------- d-----w- c:\documents and settings\Valentine\Application Data\ZoomBrowser EX

2009-05-15 18:20 . 2009-03-31 14:46 -------- d-----w- c:\documents and settings\All Users\Application Data\ZoomBrowser

2009-05-13 05:15 . 2004-08-03 22:56 915456 ----a-w- c:\windows\system32\wininet.dll

2009-05-07 15:44 . 2004-08-03 22:56 344064 ----a-w- c:\windows\system32\localspl.dll

2009-05-01 22:21 . 2009-03-23 15:57 -------- d-----w- c:\documents and settings\Valentine\Application Data\BSplayer

2009-04-26 20:18 . 2009-03-25 14:26 -------- d-----w- c:\documents and settings\Valentine\Application Data\Nokia

2009-04-25 15:01 . 2009-04-25 09:43 -------- d-----w- c:\documents and settings\Valentine\Application Data\Auslogics

2009-04-25 14:04 . 2009-03-23 15:50 684032 ----a-w- c:\windows\system32\divx.dll

2009-04-25 14:04 . 2009-03-25 14:13 61440 ----a-w- c:\windows\system32\csnpstd3.dll

2009-04-25 14:04 . 2004-08-03 22:56 28672 ----a-w- c:\windows\system32\dbnmpntw.dll

2009-04-25 14:04 . 2004-08-03 22:56 24576 ----a-w- c:\windows\system32\dbmsrpcn.dll

2009-04-25 14:04 . 2004-08-03 22:56 20480 ----a-w- c:\windows\system32\cliconfg.exe

2009-04-25 14:04 . 2004-08-03 22:56 77824 ----a-w- c:\windows\system32\cliconfg.dll

2009-04-25 14:04 . 2009-03-23 15:08 65536 ----a-w- c:\windows\system32\Audio3D.dll

2009-04-25 14:01 . 2009-03-23 17:52 49152 ----a-w- c:\windows\rebuild.exe

2009-04-25 14:01 . 2009-03-23 15:53 737280 ----a-w- c:\windows\iun6002.exe

2009-04-25 13:59 . 2009-04-01 13:50 143360 ----a-r- c:\windows\apptune1020.exe

2009-04-25 13:59 . 2009-03-25 14:13 94208 ----a-w- c:\windows\amcap.exe

2009-04-25 13:59 . 2009-03-23 15:05 208896 ----a-w- c:\windows\alcupd.exe

2009-04-25 13:59 . 2009-03-23 15:05 139264 ----a-w- c:\windows\alcrmv.exe

2009-04-25 13:39 . 2009-03-23 15:57 892928 ----a-w- c:\documents and settings\Valentine\Application Data\BSplayer\AC3 Filter\iconv.dll

2009-04-25 13:39 . 2009-03-23 15:57 16384 ----a-w- c:\documents and settings\Valentine\Application Data\BSplayer\AC3 Filter\dialog_patch.exe

2009-04-25 13:39 . 2009-03-23 15:57 20480 ----a-w- c:\documents and settings\Valentine\Application Data\BSplayer\AC3 Filter\ac3config.exe

2009-04-25 13:38 . 2009-04-24 18:11 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstCCD.exe

2009-04-25 13:38 . 2009-04-24 18:11 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstPCSFEMsi.exe

2009-04-25 13:38 . 2009-03-25 14:24 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstCCD.exe

2009-04-25 13:38 . 2009-03-25 14:24 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCSFEMsi.exe

2009-04-24 18:16 . 2009-04-24 18:16 -------- d-----w- c:\program files\Common Files\PCSuite

2009-04-24 18:16 . 2009-04-24 18:16 -------- d-----w- c:\program files\Common Files\Nokia

2009-04-24 18:16 . 2009-03-25 14:25 -------- d-----w- c:\program files\Nokia

2009-04-24 18:13 . 2009-04-24 18:13 -------- d-----w- c:\program files\PC Connectivity Solution

2009-04-24 18:11 . 2009-04-24 18:11 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstPCS.exe

2009-04-24 18:10 . 2009-03-25 14:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations

2009-04-24 18:09 . 2009-04-24 18:11 34396584 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Nokia_PC_Suite_7_1_26_0_eng.exe

2009-04-20 10:30 . 2009-03-23 16:33 -------- d-----w- c:\program files\Nero

2009-04-17 09:58 . 2004-08-03 21:17 1846656 ----a-w- c:\windows\system32\win32k.sys

2009-04-15 15:11 . 2004-08-03 22:56 584192 ----a-w- c:\windows\system32\rpcrt4.dll

2009-04-12 18:19 . 2009-04-12 18:05 138512 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2009-04-12 18:19 . 2009-04-12 18:03 201440 ----a-w- c:\windows\system32\PnkBstrB.exe

2009-04-12 18:02 . 2009-04-12 18:02 66872 ----a-w- c:\windows\system32\PnkBstrA.exe

2009-04-02 23:08 . 2009-04-06 12:22 50192 ----a-w- c:\windows\system32\drivers\tmactmon.sys

2009-04-02 23:08 . 2009-04-06 12:22 50192 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys

2009-04-02 23:08 . 2009-04-06 12:22 153104 ----a-w- c:\windows\system32\drivers\tmcomm.sys

2009-03-25 14:24 . 2009-03-25 14:24 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCS.exe

2009-03-25 14:23 . 2009-03-25 14:24 33642704 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Nokia_PC_Suite_7_1_18_0_eng_web.exe

2009-03-24 19:35 . 2009-03-24 19:35 552 ----a-w- c:\windows\system32\d3d8caps.dat

2009-03-24 19:31 . 2009-03-23 14:29 89783 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-03-23 19:51 . 2009-03-23 19:51 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2009-03-23 17:14 . 2009-03-23 17:14 -------- d-----w- c:\windows\Fonts\iTunes

2009-03-23 15:27 . 2009-03-23 15:27 717296 ----a-w- c:\windows\system32\drivers\sptd.sys

2009-03-23 14:40 . 2009-03-23 14:40 625 ----a-w- c:\windows\unins000.dat

2009-03-23 14:27 . 2009-03-23 14:27 21640 ----a-w- c:\windows\system32\emptyregdb.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

"Google Update"="c:\documents and settings\Valentine\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-23 133104]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-03 94208]

"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

"OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2008-07-30 497008]

"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-03-20 1312256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-25 4620288]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-10-29 86016]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2009-04-25 155648]

"snpstd3"="c:\windows\vsnpstd3.exe" [2004-07-30 286720]

"OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-21 98304]

"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2009-04-01 995528]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-04-25 921600]

"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-06-18 67584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

"OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2008-07-30 497008]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Opera\\opera.exe"=

"d:\\Games\\Counter - strike's\\Counter - Strike 1.6\\hl.exe"=

"d:\\Programs\\HandyCasch\\HandyCache.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3306:TCP"= 3306:TCP:MySQL

R1 tvtool;tvtool;c:\program files\TVTool\TVTOOL.SYS [03.4.1996 г. 21:33 5248]

R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [06.4.2009 г. 15:22 50192]

R2 TmPfw;Trend Micro Personal Firewall;c:\program files\Trend Micro\Internet Security\TmPfw.exe [06.4.2009 г. 15:22 497008]

R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [30.7.2008 г. 11:05 36368]

R2 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [06.4.2009 г. 15:23 677128]

R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [30.7.2008 г. 11:05 335376]

S2 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [14.6.2008 г. 20:02 17408]

S2 XAMPP;XAMPP Service;c:\xampp\service.exe --> c:\xampp\service.exe [?]

S3 usb2vcom;USB Data Cable;c:\windows\system32\drivers\usb2vcom.sys [19.4.2009 г. 13:52 28704]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-06-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-1220945662-839522115-1003.job

- c:\documents and settings\Valentine\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-23 16:42]

2009-06-13 c:\windows\Tasks\User_Feed_Synchronization-{C2F0C0A6-5E5A-4951-B664-A279789566C8}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 01:31]

.

.

------- Supplementary Scan -------

.

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyServer = 127.0.0.1:8080

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-06-13 19:50

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(252)

c:\windows\system32\WININET.dll

c:\program files\RocketDock\RocketDock.dll

c:\windows\system32\nview.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\nvwddi.dll

c:\windows\system32\webcheck.dll

.

Completion time: 2009-06-13 19:52

ComboFix-quarantined-files.txt 2009-06-13 16:52

Pre-Run: 4 925 505 536 bytes free

Post-Run: 4 919 107 584 bytes free

199 --- E O F --- 2009-06-12 11:22

Отворете Start -> Run... и напиши ComboFix /u и накрая изберете OK.

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

• 
  
• Remove found threats
  
• Scan archives
  
• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
  
• Enable Anti-Stealth technology
  

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост тук.

ESETSmartInstaller@High as downloader log:

all ok

esets_scanner_update returned -1 esets_gle=53251

# version=6

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.5863

# api_version=3.0.2

# api_version=3.0.2

# EOSSerial=db970a1a63b7b24f94f66e789b58e217

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2009-06-13 10:08:33

# local_time=2009-06-14 01:08:33 (+0200, FLE Standard Time)

# country="Bulgaria"

# lang=1033

# osver=5.1.2600 NT Service Pack 2

# compatibility_mode=0 0 0 0 0

# scanned=148608

# found=7

# cleaned=7

# scan_time=10473

C:\Documents and Settings\Valentine\Application Data\Auslogics\Rescue\One Button Checkup\090425124518656.rsc Win32/Adware.OneStep application (deleted - quarantined) 00000000000000000000000000000000

C:\WINDOWS\icon_TMP\Process.exe Win32/PrcView application (cleaned by deleting - quarantined) 00000000000000000000000000000000

C:\System Volume Information\_restore{19417231-C54A-466F-8F76-57B4E927E224}\RP95\A0064361.exe Win32/PrcView application (cleaned by deleting - quarantined) 00000000000000000000000000000000

C:\System Volume Information\_restore{19417231-C54A-466F-8F76-57B4E927E224}\RP95\A0064362.exe Win32/PrcView application (cleaned by deleting - quarantined) 00000000000000000000000000000000

D:\System Volume Information\_restore{19417231-C54A-466F-8F76-57B4E927E224}\RP95\A0064363.exe probably unknown NewHeur_PE virus (deleted - quarantined) 00000000000000000000000000000000

D:\Programs\EXE\HandyCasch.exe probably unknown NewHeur_PE virus (deleted - quarantined) 00000000000000000000000000000000

D:\Programs\EXE\Vista icon pack.exe Win32/PrcView application (deleted - quarantined) 00000000000000000000000000000000

ESETSmartInstaller@High as downloader log:

all ok

Направи следното:

Спрете System Restore преди да сканирате с каквото и да е било:

Десен бутон на My Computer => Properties => System Restore => слагаш отметка пред Turn Off System Restore

Изчистете точките на възстановяване освен последната ------- Start => run => cleanmgr => More Options => System Restore => Clean UP

Няма нужда от друго. Това е!

Ако проблемът е все още на лице, пиши тук:

http://www.kaldata.com/forums/index.php?showforum=4

Мерси за помощта ! Мисля че се оправи проблема, но ще наблюдавам тука известно време.

Моля! Успех!

Значи вируса е следния след извествно време след като си цъкна компютара след 10-20 минути стила на компютара ( с обикновенния за XP съм ) става бежаво сичко за 3-4 сек след това като си цъкна примерно WINAMP, browsera някой клип или BSplayera просто НЯМА ЗВУК как да го премахна ....

Значи вируса е следния след извествно време след като си цъкна компютара след 10-20 минути стила на компютара ( с обикновенния за XP съм ) става бежаво сичко за 3-4 сек след това като си цъкна примерно WINAMP, browsera някой клип или BSplayera просто НЯМА ЗВУК как да го премахна ....

Може да е последици от много неща не е задължително да е вирус,изтеглете този инструмент и го запазете на дектопа,след което го стартирайте:

TaskbarRepairToolPlus!

Пишете дали има промяна ,след като рестартирате.

Ако положението е същото един лог HiJackThis/ в темата там,НО след като спазите ==Препоръчителни действия, преди да анализирате с HiJackThis ==

Редактирано 17 юни 200917 г. от mihnev_sz (преглед на промените)

mihnev sz пуснах моя лог след като направих сички неща обаче сега забелязах тва svhost що е толкова пати изписано

mihnev sz пуснах моя лог след като направих сички неща обаче сега забелязах тва svhost що е толкова пати изписано

Не разбрах,този инструмент TaskbarRepairToolPlus на който дадох линк за изтеглянето му по-горе, свърши ли работа или,не?

И още повече е svchost , това ли ви е проблема,че за него се хванахте?Определено проблема ви е решен в този случай!

Редактирано 16 юни 200917 г. от mihnev_sz (преглед на промените)

Здравейте! Ползвам AVAST. Не мога да хвана откъде постоянно се генерират в system32 папката

някакви вируси, от рода на 02.scr 43.scr. Свързано е с опцията (когато е разрешена) в Windows Firewoll - Printer and files sharing. Ако споделянето е спряно тези SCR не се генерират.

Защо като пуснах ComboFix ми изтри msconfig.exe?

ComboFix 09-06-17.04 - Peter 06.2009 г. 15:45.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1023.361 [GMT 3:00]

Running from: c:\documents and settings\Peter\Desktop\ComboFix.exe

AV: avast! antivirus 4.8.1335 [VPS 090617-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\ATIODCLI.exe

c:\windows\system32\ATIODE.exe

c:\windows\system32\msconfig.exe

.

((((((((((((((((((((((((( Files Created from 2009-05-18 to 2009-06-18 )))))))))))))))))))))))))))))))

.

2009-06-18 12:11 . 2009-06-18 12:11 -------- d-----w- c:\documents and settings\Peter\Application Data\Malwarebytes

2009-06-18 12:11 . 2009-06-17 08:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-06-18 12:11 . 2009-06-18 12:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-06-18 12:11 . 2009-06-18 12:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-06-18 12:11 . 2009-06-17 08:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-06-18 10:25 . 2008-12-12 15:05 23984 ----a-w- c:\windows\system32\drivers\pnarp.sys

2009-06-18 10:25 . 2009-06-18 10:25 -------- d-----w- c:\windows\LastGood

2009-06-18 10:25 . 2008-12-12 15:05 25264 ----a-w- c:\windows\system32\drivers\purendis.sys

2009-06-18 10:25 . 2009-06-18 10:25 -------- d-----w- c:\program files\Common Files\Pure Networks Shared

2009-06-18 10:25 . 2009-03-04 06:26 30418736 ----a-w- c:\documents and settings\All Users\Application Data\Pure Networks\Setup\nmsetup.exe

2009-06-18 10:25 . 2009-06-18 10:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Pure Networks

2009-06-17 09:25 . 2009-06-17 09:25 -------- d-----w- c:\documents and settings\Peter\Local Settings\Application Data\Ahead

2009-06-16 19:35 . 2009-06-16 19:51 -------- d-----w- c:\documents and settings\Peter\Application Data\FileZilla

2009-06-16 05:01 . 2009-06-16 05:01 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google

2009-06-15 15:34 . 2009-06-15 15:34 -------- d-----w- c:\program files\MPC HomeCinema

2009-06-15 15:25 . 2009-06-15 15:26 -------- d-----w- c:\documents and settings\Peter\Application Data\Media Player Classic

2009-06-15 14:57 . 2009-06-15 14:57 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

2009-06-15 14:57 . 2009-06-15 14:58 -------- d-----w- c:\documents and settings\Peter\Local Settings\Application Data\Google

2009-06-15 14:57 . 2009-06-15 14:57 -------- d-----w- c:\program files\Google

2009-06-15 14:12 . 2009-06-15 14:12 -------- d-----w- c:\program files\CCleaner

2009-06-15 13:29 . 2009-06-15 13:29 -------- d-----w- c:\documents and settings\Peter\Application Data\vlc

2009-06-15 12:15 . 2009-06-15 12:15 -------- d-----w- c:\program files\MediaInfo

2009-06-15 11:58 . 2009-06-15 11:58 -------- d-----w- c:\windows\system32\LogFiles

2009-06-14 15:08 . 2009-06-14 15:08 -------- d-----w- c:\program files\Pure Networks

2009-06-14 15:07 . 2009-06-14 15:08 -------- d-----w- c:\program files\WebEx

2009-06-14 10:03 . 2009-06-14 10:03 -------- d-----w- c:\windows\Downloaded Installations

2009-06-14 07:24 . 2009-06-14 07:24 -------- d-----w- c:\documents and settings\Peter\Application Data\Stellarium

2009-06-14 07:23 . 2009-06-14 07:23 -------- d-----w- c:\program files\Stellarium

2009-06-14 06:58 . 2009-06-14 07:01 -------- d-----w- c:\documents and settings\Peter\Application Data\ICQ

2009-06-14 06:58 . 2009-06-14 07:01 -------- d-----w- c:\program files\ICQ6.5

2009-06-12 07:44 . 2009-06-16 08:36 22168 ---ha-w- c:\windows\system32\mlfcache.dat

2009-06-12 07:43 . 2009-06-12 07:43 -------- d-----w- c:\program files\Safari

2009-06-12 07:31 . 2009-06-12 07:31 -------- d-----w- c:\program files\iPod

2009-06-12 07:31 . 2009-06-12 07:32 -------- d-----w- c:\program files\iTunes

2009-06-12 07:31 . 2009-06-12 07:32 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

2009-06-12 07:30 . 2009-06-12 07:30 -------- d-----w- c:\program files\QuickTime

2009-06-10 19:41 . 2009-06-10 19:42 -------- d-----w- c:\documents and settings\Peter\.VirtualBox

2009-06-10 19:40 . 2009-05-29 17:13 79888 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys

2009-06-10 19:40 . 2009-05-29 17:13 100944 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys

2009-06-10 19:40 . 2009-05-29 17:13 31952 ----a-w- c:\windows\system32\drivers\VBoxUSB.sys

2009-06-10 19:40 . 2009-05-29 17:13 41424 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys

2009-06-10 19:40 . 2009-06-10 19:40 -------- d-----w- c:\program files\Sun

2009-06-10 19:10 . 2009-06-10 19:37 -------- d-----w- c:\program files\nLite

2009-06-10 18:20 . 2009-06-10 18:20 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2009-06-10 18:20 . 2009-06-18 09:36 -------- d-----w- c:\documents and settings\Peter\Application Data\skypePM

2009-06-10 14:19 . 2009-06-10 14:19 -------- d-----w- C:\Intel

2009-06-10 14:19 . 2009-06-10 19:02 -------- d-----w- c:\program files\Intel

2009-06-10 14:19 . 2009-06-10 14:19 -------- d-----w- c:\documents and settings\Peter\Application Data\InstallShield

2009-06-10 13:54 . 2009-06-10 19:16 -------- d-----w- c:\documents and settings\Peter\Local Settings\Application Data\Adobe

2009-06-10 13:54 . 2009-06-10 13:54 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet

2009-06-08 12:12 . 2009-06-08 12:12 69632 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 4.30.17.0\SetupAdmin.exe

2009-06-05 10:57 . 2009-06-05 10:57 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe

2009-05-29 17:12 . 2009-05-29 17:12 133648 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll

2009-05-29 17:12 . 2009-05-29 17:12 87760 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-06-18 12:48 . 2009-02-24 15:29 -------- d-----w- c:\documents and settings\Peter\Application Data\Skype

2009-06-18 12:45 . 2009-02-24 15:21 -------- d-----w- c:\documents and settings\Peter\Application Data\uTorrent

2009-06-17 09:32 . 2009-02-24 14:54 -------- d-----w- c:\documents and settings\Peter\Application Data\AIMP

2009-06-17 09:26 . 2009-02-24 15:04 -------- d-----w- c:\program files\The KMPlayer

2009-06-14 06:58 . 2009-02-24 14:32 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-06-12 07:44 . 2009-02-24 15:02 -------- d-----w- c:\documents and settings\Peter\Application Data\Apple Computer

2009-06-12 07:31 . 2009-02-24 15:01 -------- d-----w- c:\program files\Common Files\Apple

2009-06-12 07:30 . 2009-02-24 15:02 -------- d-----w- c:\program files\Bonjour

2009-06-10 19:17 . 2009-02-24 14:52 -------- d-----w- c:\program files\Common Files\Adobe

2009-06-10 19:11 . 2009-02-24 15:11 -------- d-----w- c:\documents and settings\Peter\Application Data\DAEMON Tools Lite

.

------- Sigcheck -------

[-] 2008-07-01 16:49 361344 68F06FE0021B01E670AF37B8C5964FDF c:\windows\system32\drivers\tcpip.sys

[-] 2008-07-01 16:51 1614848 CE347B2B8C7DDA0D8A5E16B346F0CA28 c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]

"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2009-06-18 467240]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_2"="shell32" [X]

"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-07-01 123904]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoSMHelp"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"NoSMHelp"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Zend\\ZendStudio-5.5.1\\jre\\bin\\javaw.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\ICQ6.5\\ICQ.exe"=

"e:\\Games\\CS.V.33\\instalirana\\hl2.exe"=

"e:\\Games\\csv34\\Counter-Strike Source v34\\Counter-Strike Source v34\\hl2.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"67:UDP"= 67:UDP:0.0.0.0/255.255.255.255:Enabled:DHCP Discovery Service

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2/24/2009 5:55 PM 114768]

R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [6/10/2009 10:40 PM 100944]

R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [6/10/2009 10:40 PM 41424]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2/24/2009 5:55 PM 20560]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [6/18/2009 3:11 PM 38160]

R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [6/10/2009 10:40 PM 79888]

R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\drivers\VBoxNetFlt.sys [5/29/2009 8:12 PM 87760]

S2 gupdate1c9edc99c439dfa;Google Update Service (gupdate1c9edc99c439dfa);c:\program files\Google\Update\GoogleUpdate.exe [6/15/2009 5:57 PM 133104]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2/24/2009 5:38 PM 1684736]

S3 VBoxUSB;VirtualBox USB;c:\windows\system32\drivers\VBoxUSB.sys [6/10/2009 10:40 PM 31952]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MBAMSWISSARMY

*NewlyCreated* - NMSERVICE

*NewlyCreated* - PNARP

*NewlyCreated* - PURENDIS

.

Contents of the 'Scheduled Tasks' folder

2009-06-18 c:\windows\Tasks\GoogleUpdateTaskMachine.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-15 14:57]

.

.

------- Supplementary Scan -------

.

uStart Page = about:blank

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: {0BEBFACA-F606-4B84-BC13-2139934752A2} = 195.24.94.65,195.24.90.1

FF - ProfilePath -

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-06-18 15:47

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1244)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(1300)

c:\windows\system32\relog_ap.dll

.

Completion time: 2009-06-18 15:48

ComboFix-quarantined-files.txt 2009-06-18 12:48

Pre-Run: 15 519 342 592 bytes free

Post-Run: 15 687 303 168 bytes free

171

Редактирано 18 юни 200917 г. от peterstamov (преглед на промените)

Откъде си сигурен, че ти е изтрил msconfig.exe ?

Я виж тази тема:

http://www.kaldata.com/forums/index.php?s=...st&p=671529

Ще ми трябва малко време да анализирам лога.

Аз се чудя защо си е харесал драйверите на видеокартата ти...

Ако се наложи ги преинсталирай.

Деинсталирай Combofix с командата:

Start => Run => combofix /u

Такива инструменти не се пускат просто ей така...

Прегледай тази тема и изпълни препоръките преди изготвяне на лог файл (проверка с Malwarebytes, SUPERAntispyware, Dr.Web) и пусни лог от HijackThis в нея.

Уф там горе 3-тото като съм писал съм го делнал msconfig.exe е ? С тази команда в темата която ми прати стана работата - върна се и работи - ама що го изтри...? Благодаря - почвам и ще пиша после!

Редактирано 18 юни 200917 г. от peterstamov (преглед на промените)

Уф там горе 3-тото като съм писал съм го делнал msconfig.exe е ? С тази команда в темата която ми прати стана работата - върна се и работи - ама що го изтри...? Благодаря - почвам и ще пиша после!

Наскоро имаше случай, когато затри един файл на Авира в една тема в Malwarebytes.

The removal of c:\program files\Avira\AntiVir Desktop\avsda.dll may have been a false positive from Combofix. You can restore it.

http://www.malwarebytes.org/forums/index.p...ost&p=88611

Но така или иначе msconfig.exe трябва да се намира в C:\WINDOWS\PCHealth\HelpCtr\Binaries\, а не в C:\Windows\system32 !

Докладвано е на sUBs за другите два изтрити файлове свързани с драйверите на Ati...Ако се наложи ги преинсталирай.

c:\windows\system32\ATIODCLI.exe

c:\windows\system32\ATIODE.exe

Редактирано 18 юни 200917 г. от B-boy[StyLe] (преглед на промените)

Но така или иначе msconfig.exe трябва да се намира в C:\WINDOWS\PCHealth\HelpCtr\Binaries\, а не в C:\Windows\system32 !

Ако се намира system32,възможно е да има и процес с името msconfig.exe в Task Manager ,това не е добре,както спомена,най-често това е тип червей от семейство Winur.

Имам backup на тази инсталация направена с Acronis. Отворих backup-па и наистина се оказа, че има такъв файл msconfig.exe в system32. Извлякох файла на работния плот и го сканирах с AVAST, Malwarebytes и накрая го пратих на virustotal - никаква заплаха не засече никъде. Във същия този архив във тази директория C:\WINDOWS\PCHealth\HelpCtr\Binaries такъв файл липсва. Не знам какво става, доста сканирах и онези 3-те поправих. Сега вече около 50 минути Avast не е пищяла. Преди scr се генерираха през 5-10 минути. Мисълта ми е, че проблема май е свързан с споделянето - когато са отворени 137,138,139 и 445 порт. Възможно ли е нещо по LAN да шари и генерира тези SCR през отворените портове?

Добавено: Около 1 час го оставих и хоп пок генирирани 3 вируса!!!

Редактирано 18 юни 200917 г. от peterstamov (преглед на промените)

Имам backup на тази инсталация направена с Acronis. Отворих backup-па и наистина се оказа, че има такъв файл msconfig.exe в system32. Извлякох файла на работния плот и го сканирах с AVAST, Malwarebytes и накрая го пратих на virustotal - никаква заплаха не засече никъде. Във същия този архив във тази директория C:\WINDOWS\PCHealth\HelpCtr\Binaries такъв файл липсва. Не знам какво става, доста сканирах и онези 3-те поправих. Сега вече около 50 минути Avast не е пищяла. Преди scr се генерираха през 5-10 минути. Мисълта ми е, че проблема май е свързан с споделянето - когато са отворени 137,138,139 и 445 порт. Възможно ли е нещо по LAN да шари и генерира тези SCR през отворените портове?

Добавено: Около 1 час го оставих и хоп пок генирирани 3 вируса!!!

Според мен, най-добре форматирай и преинсталирай начисто. Нещо ме съмнява, че снимката на Acronis-a е била инфектирана.

Може да става въпрос и за бот-мрежа. Инсталирай всички актуализации за Windows, качи някаква защитна стена и ако се наложи говори с доставчика си на интернет.

Ако проблемите продължат ще го борим с още инструменти.

Когато някой се опитва да отвори сайта му излиза,че има вирус- червей някой да знае как да го премахна,но ако може да обясни по подробно.Ето снимка:

Мерси предварително!!!