Значи .. От известно време много се бави при включване и като цяло не е както преди ..

Ето лог от HijackThis като стане готов лог-а от Malwarebytes' Anti-Maware ще го побликувам и него !

Logfile of HijackThis v1.99.1

Scan saved at 12:47:02, on 21.08.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\VM_STI.EXE

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.2.183.7\GoogleCrashHandler.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe

C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Skype\Plugin Manager\SkypePM.exe

C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Documents and Settings\User\Desktop\Pr0grAm$\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.bg/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.16.41.9:8080

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [bigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC210NC Webcam

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [WT GameChannel] C:\Program Files\WildTangent\Apps\GameChannel.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: TrayMin210.exe.lnk = ?

O8 - Extra context menu item: &С&валяне &с BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &С&валяне на всички с BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: &С&валяне на всичкото видео с BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{D22BE32B-A6CB-4D55-B3CD-B15E2CA338F2}: NameServer = 192.168.0.1

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\WINDOWS\system32\dllhost.exe (file missing)

O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)

O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)

O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: MS Software Shadow Copy Provider (SwPrv) - Unknown owner - C:\WINDOWS\system32\dllhost.exe (file missing)

Колкото до програмата ATF Cleaner Незнам какво точно да правя защото съм със Google Chrome..

Благодаря предварително !

Подвеждащ коментар

В тази тема, а и във всяка една в подфорума участват само членове на HJT Team и "пациента".

mihnev_sz

Ето и от др-та програмка

Malwarebytes' Anti-Malware 1.40

Database version: 2551

Windows 5.1.2600 Service Pack 3

21.08.2009 13:34:31

mbam-log-2009-08-21 (13-34-31).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 339098

Time elapsed: 50 minute(s), 39 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 0

Registry Data Items Infected: 3

Folders Infected: 2

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\iyhflbzh1.qs (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\iyhflbzh1.qs.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

C:\WINDOWS\system32\append.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\xlib254.dll (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:

C:\Downloads\Avast! Anti Virus Professional v4.8.1335 Incl. 38 Skins + Keygen\Keygen\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

D:\Storage\DivX\DivX 6.7.0.18 Keymaker.exe (Malware.Packer) -> Quarantined and deleted successfully.

Здравейте hfu!

Аз съм Fixer и ще Ви помагам да почистите вашата система от зловреден софтуер. Анализа на логовете, както и премахването на зловредния софтуер, може да отнеме време, затова моля бъдете търпеливи. Моля, имайте предвид следното:

• Аз ще Ви помагам само за почистването на вашата система от зловреден софтуер. За всякакви други проблеми, моля създайте нова тема в съответния форум и опишете детайлно проблема Ви.
  
• Решението се отнася само за този проблем и само на този компютър.
  
• Следвайте инструкциите ми стриктно, докато не Ви кажа, че системата Ви е напълно чиста. Това, че симптомите са изчезнали, не значи че всичко е наред.
  
• Ако не разбирате нещо, моля Ви попитайте ме, а не рискувайте. По-добре е малко да се позабавим, отколкото да усложним нещата.
  
• Цялата кореспонденция минава през тази тема, не създавайте нова тема и не използвайте друга тема за тази цел.
  

Стъпка 1:

ATF-Cleaner все още не поддържа други браузъри, затова изпълнете само първата стъпка.

Стъпка 2:

Изтеглете RootRepeal от тук

Разархивирайте го на вашия десктоп.

• Кликнете два пъти върху RootRepeal.exe , за да стартирате програмата
  
• Кликнете на таба Report в долната част на прозореца
  
• Кликнете на бутона Scan
  
• Сложете отметки пред следното:
  

• 
  
• Drivers
  
  
• Processes
  
  
• SSDT
  
  
• Hidden Services
  
  

• Кликнете на бутона OK
  
• На следващия диалогов прозорец, сложете отметки преди всички дялове (C:\ , D:\ ....)
  
• Кликнете на OK, за да започне процеса на сканиране
  

Бележка: Процеса на сканиране може да отнеме време. Моля,

не стартирайте

никакви програми, докато програмата сканира.

• Когато сканирането завърши успешно ще се появи бутона Save Report
  
• Кликнете върху Save Report и запишете лог файла на вашия десктоп, с име RootRepeal.txt
  
• Отворете File, след което Exit , за да затворите програмата.
  

Копирайте и поставете съдържанието на RootRepeal.txt в следващия си пост.

Стъпка 3:

Изтеглете DDS от тук или тук. Запазете го на вашия десктоп.

Изключете Real-Time защитата на вашия антивирусен софтуер и всякакви скриптови блокери. Накрая, стартирайте инструмента.

• Когато DDS приключи успешно анализа на системата Ви ще отвори два лог файла.
  

1. 
   
   
2. DDS.txt
   
3. Attach.txt
   

• Запазете ги на вашия десктоп и след това ги прикачете към следващия си пост.
  

Attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 17.12.2008 09:36:28

System Uptime: 22.08.2009 10:45:38 (2 hours ago)

Motherboard: ASUSTeK Computer INC. | | P5GC-MX/1333

Processor: Intel® Pentium® Dual CPU E2200 @ 2.20GHz | LGA 775 | 2200/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 146 GiB total, 1.558 GiB free.

D: is FIXED (NTFS) - 152 GiB total, 38.725 GiB free.

E: is CDROM ()

F: is CDROM ()

G: is CDROM (CDFS)

H: is CDROM ()

R: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}

Description: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard

Device ID: ACPI\PNP0303\4&2C575ACB&0

Manufacturer: (Standard keyboards)

Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard

PNP Device ID: ACPI\PNP0303\4&2C575ACB&0

Service: i8042prt

==== System Restore Points ===================

RP137: 27.05.2009 00:26:04 - Removed 18 Wheels of Steel Big City Rigs

RP138: 27.05.2009 00:26:04 - Installed The Sims 3

RP139: 27.05.2009 00:26:04 - Installed USB Flash Disk Driver

RP140: 27.05.2009 00:26:04 - Removed OZ

RP141: 27.05.2009 00:26:04 - Removed Steam

RP142: 27.05.2009 00:26:04 - Installed Adobe Photoshop

RP143: 27.05.2009 00:26:04 - Removed Adobe Bridge 1.0

RP144: 27.05.2009 00:26:05 - Installed Adobe Bridge 1.0

RP145: 27.05.2009 00:26:05 - Installed AUM405Patch

RP146: 27.05.2009 00:26:08 - Last known good configuration

RP147: 30.05.2009 21:37:02 - ComboFix created restore point

RP148: 11.06.2009 12:56:35 - ComboFix created restore point

RP149: 12.06.2009 22:12:15 - Installed Google Earth.

RP150: 29.06.2009 11:24:42 - Installed AUM405Patch

RP151: 01.08.2009 22:23:16 - Installed Adobe Reader 9.1.

RP152: 04.08.2009 19:21:25 - Installed Java 6 Update 14

==== Installed Programs ======================

A.I.M. Racing

AC3Filter (remove only)

Adobe Anchor Service CS4

Adobe Bridge 1.0

Adobe Bridge CS4

Adobe CMaps CS4

Adobe Color EU Extra Settings CS4

Adobe Color JA Extra Settings CS4

Adobe Color NA Recommended Settings CS4

Adobe Common File Installer

Adobe CSI CS4

Adobe Default Language CS4

Adobe Device Central CS4

Adobe Drive CS4

Adobe Dynamiclink Support

Adobe ExtendScript Toolkit CS4

Adobe Extension Manager CS4

Adobe Flash CS4

Adobe Flash CS4 Extension - Flash Lite STI en

Adobe Flash CS4 Professional

Adobe Flash CS4 STI-en

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Help Center 1.0

Adobe Linguistics CS4

Adobe Media Encoder CS4

Adobe Output Module

Adobe PDF Library Files CS4

Adobe Photoshop CS2

Adobe Reader 9.1.3

Adobe Search for Help

Adobe Service Manager Extension

Adobe Setup

Adobe Stock Photos 1.0

Adobe Type Support CS4

Adobe Update Manager CS4

Adobe WinSoft Linguistics Plugin

Adobe XMP Panels CS4

AdobeColorCommonSetCMYK

AdobeColorCommonSetRGB

AGEIA PhysX v7.11.13

AirHockey 3D 1.82

ASUS VGA Driver

Atheros Communications Inc.® L2 Fast Ethernet Driver

ATI - Software Uninstall Utility

ATI Catalyst Control Center

ATI Display Driver

ATI Parental Control & Encoder

AutoUpdate

AVIVO

Billiard Art

BitComet 1.07

BS.Player PRO

Catalyst Control Center - Branding

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Localization Chinese Standard

Catalyst Control Center Localization Chinese Traditional

Catalyst Control Center Localization Czech

Catalyst Control Center Localization Danish

Catalyst Control Center Localization Dutch

Catalyst Control Center Localization Finnish

Catalyst Control Center Localization French

Catalyst Control Center Localization German

Catalyst Control Center Localization Greek

Catalyst Control Center Localization Hungarian

Catalyst Control Center Localization Italian

Catalyst Control Center Localization Japanese

Catalyst Control Center Localization Korean

Catalyst Control Center Localization Norwegian

Catalyst Control Center Localization Polish

Catalyst Control Center Localization Portuguese

Catalyst Control Center Localization Russian

Catalyst Control Center Localization Spanish

Catalyst Control Center Localization Swedish

Catalyst Control Center Localization Thai

Catalyst Control Center Localization Turkish

ccc-core-preinstall

ccc-core-static

ccc-utility

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

Connect

Cyrilla Correct

Dekaron

Diablo II

DivX Codec

ESET NOD32 Antivirus

Fable - The Lost Chapters

FATE from WildGames (remove only)

Google Chrome

Google Earth

Hamachi 1.0.2.2

Hero Editor V0.96

HijackThis 1.99.1

Hotfix for Windows XP (KB952287)

Hunting Unlimited 2008 1.0

Icy Tower v1.3.1

ImTOO 3GP Video Converter

infnity

IrfanView (remove only)

Java 6 Update 14

kuler

Leisure Suit Larry - Box Office Bust

Leisure Suit Larry - Magna Cum Laude

Little Farm 1.00

Malwarebytes' Anti-Malware

Metin2.us

Microsoft .NET Framework 2.0

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

Microsoft National Language Support Downlevel APIs

Microsoft Office Professional Edition 2003

Microsoft Visual C++ 2005 Redistributable

Microsoft WSE 3.0 Runtime

Mozilla Firefox (3.0.12)

MP3 To Ringtone Gold 3.16

MSVC80_x86

Nero 6 Ultra Edition

Nokia Connectivity Cable Driver

Nokia PC Suite

OpenAL

PC Connectivity Solution

PDF Settings CS4

Philips SPC210NC Webcam

Photoshop Camera Raw

Pixel Bender Toolkit

PowerDVD

Pro Evolution Soccer 2009

Railroad Lines

Realtek High Definition Audio Driver

Replay Converter 2.8

SA Dictionary T4

Security Update for Windows Internet Explorer 7 (KB938127-v2)

Security Update for Windows Internet Explorer 7 (KB963027)

Security Update for Windows Media Player (KB952069)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB938464-v2)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950760)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB961373)

Serious Sam: The First Encounter

Skins

Skype 3.0

Skype Plugin Manager

Skype™ 4.0

Speaking Clock Deluxe 3.61

Suite Shared Configuration CS4

The KMPlayer (remove only)

The Sims™ 3

Top Chef

Update for Windows XP (KB898461)

Update for Windows XP (KB951978)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

WebFldrs XP

WildTangent GameChannel (remove only)

WildTangent Web Driver

Winamp

Windows Driver Package - Nokia Modem (05/22/2008 3.8)

Windows Driver Package - Nokia Modem (05/22/2008 7.00.0.1)

Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)

Windows Internet Explorer 7

WinRAR archiver

Xvid 1.2.1 final uninstall

==== Event Viewer Messages From Past Week ========

21.08.2009 13:38:10, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

15.08.2009 12:53:55, error: DCOM [10000] - Unable to start a DCOM Server: {4CB43D7F-7EEE-4906-8698-60DA1C38F2FE}. The error: "%2" Happened while starting this command: C:\WINDOWS\system32\DllHost.exe /Processid:{B366DEBE-645B-43A5-B865-DDD82C345492}

==== End Of File ===========================

DDS.txt

DDS (Ver_09-07-30.01) - NTFSx86

Run by User at 12:35:06.14 on 22.08.2009

Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_14

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2047.1367 [GMT 3:00]

AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\WINDOWS\system32\ctfmon.exe

svchost.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Skype\Plugin Manager\SkypePM.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\User\My Documents\Downloads\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.bg/

uInternet Settings,ProxyServer = 172.16.41.9:8080

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.2.8.7.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe

mRun: [DAEMON Tools] "c:\program files\daemon tools\daemon.exe" -lang 1033

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\traymi~1.lnk - c:\program files\philips\philips spc210nc webcam\TrayMin210.exe

IE: &С&валяне &с BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm

IE: &С&валяне на всички с BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm

IE: &С&валяне на всичкото видео с BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.2.8.7.dll/206

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

TCP: {D22BE32B-A6CB-4D55-B3CD-B15E2CA338F2} = 192.168.0.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: AtiExtEvent - Ati2evxx.dll

SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digest32.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\user\applic~1\mozilla\firefox\profiles\kljuudty.default\

FF - prefs.js: browser.search.selectedEngine - DAEMON Search

FF - prefs.js: browser.startup.homepage - hxxp://bgmafia.com/

FF - component: c:\documents and settings\user\application data\mozilla\firefox\profiles\kljuudty.default\extensions\[email protected]\components\BkMrkExt.dll

FF - plugin: c:\documents and settings\user\local settings\application data\google\update\1.2.183.7\npGoogleOneClick8.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-4-9 107256]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-4-9 94360]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-4-9 731840]

R3 AtcL002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\system32\drivers\l251x86.sys [2008-12-17 30720]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 wip0204;Wippien Network Adapter 2.4;c:\windows\system32\drivers\wip0204.sys [2009-4-29 23480]

S3 XDva224;XDva224;\??\c:\windows\system32\xdva224.sys --> c:\windows\system32\XDva224.sys [?]

S3 XDva276;XDva276;\??\c:\windows\system32\xdva276.sys --> c:\windows\system32\XDva276.sys [?]

=============== Created Last 30 ================

2009-08-22 12:35 <DIR> --d----- c:\temp\RarSFX1

2009-08-22 12:34 <DIR> --d-h--- c:\windows\PIF

2009-08-22 10:46 16,384 a------t c:\temp\Perflib_Perfdata_304.dat

2009-08-19 14:59 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Hot Lava Games

2009-08-19 14:59 <DIR> --d----- c:\program files\PC-home

2009-08-18 11:22 16,384 a------t c:\temp\Perflib_Perfdata_4f4.dat

2009-08-04 19:21 410,984 a------- c:\windows\system32\deploytk.dll

2009-08-04 19:21 73,728 a------- c:\windows\system32\javacpl.cpl

==================== Find3M ====================

2009-08-03 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-03 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys

2009-06-14 15:24 8,992 a------- c:\windows\system32\kbdbph.dll

2009-06-11 13:22 233 a------- C:\Start_.cmd

2009-06-11 13:22 389,120 a------- c:\windows\system32\CF11354.exe

2009-06-11 12:56 389,120 a------- c:\windows\system32\CF6247.exe

2009-06-08 08:10 155,136 a------- c:\windows\PEV.exe

2007-03-09 10:12 27,648 a--sh--- c:\windows\system32\AVSredirect.dll

============= FINISH: 12:35:17.18 ===============

И от RootRepeal

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/08/22 12:33

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

Hidden/Locked Files

-------------------

Path: c:\documents and settings\user\desktop\metin2.us.lnk

Status: Size mismatch (API: 709, Raw: 677)

Path: C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\48OIMEKT\0.0.0.6[1].RTP

Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\WP8ET2ZU\SV1_ingame_notice_NW[1].jpg

Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\f_000868

Status: Locked to the Windows API!

Преименувайте RootRepeal.exe на Tool.exe и повторете процедурата. Защо сте използвали ComboFix?

Сега не съм... При предишни "поправяния" само ... може да не съм я деинсталирал правилно.

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/08/24 01:19

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

Hidden/Locked Files

-------------------

Path: c:\temp\etilqs_mp5puil82okojks0ib6z

Status: Allocation size mismatch (API: 16384, Raw: 0)

Path: C:\Temp\Perflib_Perfdata_4b4.dat

Status: Invisible to the Windows API!

Path: C:\Temp\_BSPST$_

Status: Invisible to the Windows API!

Path: c:\documents and settings\user\application data\skype\wes7_coas7\etilqs_trw6u8qufzvdcfc0sddn

Status: Allocation size mismatch (API: 20480, Raw: 32768)

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/08/24 02:43

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

Drivers

-------------------

Name: a87lnl9j.SYS

Image Path: C:\WINDOWS\System32\Drivers\a87lnl9j.SYS

Address: 0xBA148000 Size: 303104 File Visible: No Signed: -

Status: -

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xAD75B000 Size: 98304 File Visible: No Signed: -

Status: -

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xBADDC000 Size: 8192 File Visible: No Signed: -

Status: -

Name: PCI_PNP9668

Image Path: \Driver\PCI_PNP9668

Address: 0x00000000 Size: 0 File Visible: No Signed: -

Status: -

Name: sptd

Image Path: \Driver\sptd

Address: 0x00000000 Size: 0 File Visible: No Signed: -

Status: -

Name: spzi.sys

Image Path: spzi.sys

Address: 0xBA6A7000 Size: 1048576 File Visible: No Signed: -

Status: -

Name: tool.sys

Image Path: C:\WINDOWS\system32\drivers\tool.sys

Address: 0xAA4FB000 Size: 49152 File Visible: No Signed: -

Status: -

SSDT

-------------------

#: 019 Function Name: NtAssignProcessToJobObject

Status: Hooked by "<unknown>" at address 0x89648630

#: 041 Function Name: NtCreateKey

Status: Hooked by "spzi.sys" at address 0xba6a80e0

#: 071 Function Name: NtEnumerateKey

Status: Hooked by "spzi.sys" at address 0xba6c6ca2

#: 073 Function Name: NtEnumerateValueKey

Status: Hooked by "spzi.sys" at address 0xba6c7030

#: 119 Function Name: NtOpenKey

Status: Hooked by "spzi.sys" at address 0xba6a80c0

#: 122 Function Name: NtOpenProcess

Status: Hooked by "<unknown>" at address 0x89647a60

#: 128 Function Name: NtOpenThread

Status: Hooked by "<unknown>" at address 0x89647e80

#: 160 Function Name: NtQueryKey

Status: Hooked by "spzi.sys" at address 0xba6c7108

#: 177 Function Name: NtQueryValueKey

Status: Hooked by "spzi.sys" at address 0xba6c6f88

#: 247 Function Name: NtSetValueKey

Status: Hooked by "spzi.sys" at address 0xba6c719a

#: 253 Function Name: NtSuspendProcess

Status: Hooked by "<unknown>" at address 0x89648460

#: 254 Function Name: NtSuspendThread

Status: Hooked by "<unknown>" at address 0x89648280

#: 257 Function Name: NtTerminateProcess

Status: Hooked by "<unknown>" at address 0x89647c90

#: 258 Function Name: NtTerminateThread

Status: Hooked by "<unknown>" at address 0x896480b0

==EOF==

Редактирано 23 август 200917 г. от hfu (преглед на промените)

Здравей hfu,

СТЪПКА 1:

1. Спри временно защитата в реално време на антивирусната си програма.

2. Изтегли Combofix и го запази на десктопа.

3. Отвори Notepad и с copy/paste въведи:

KILLALL::

Driver::

XDva224

XDva276

File::

c:\windows\system32\xdva224.sys

c:\windows\system32\xdva276.sys

c:\temp\Perflib_Perfdata_4f4.dat

C:\Start_.cmd

c:\windows\system32\CF11354.exe

c:\windows\system32\CF6247.exe

c:\windows\PEV.exe

c:\temp\etilqs_mp5puil82okojks0ib6z

Folder::

c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

C:\Temp\_BSPST$_

c:\temp\etilqs_mp5puil82okojks0ib6z

Firefox::

FF - prefs.js: browser.search.selectedEngine - DAEMON Search

Запази файла с име CFScript.txt и с drag/drop го пусни в Combofix.

Публикувай лог файла в следващия си пост.

СТЪПКА 2:

Изтегли => StartupLite и премахни излишните програми стартиращи се с Операционната Система. (Само сложи отметка - NO ACTION за CFTMON.exe !!!)

Само незнам защо трябваше да чакам около половин час след като ми се рестартира компа и заби, за да ми излезе тоз лог

kComboFix 09-08-23.01 - User 24.08.2009 12:45.6.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2047.1507 [GMT 3:00]

Running from: c:\documents and settings\User\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\User\Desktop\CFScript.txt

AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_NDISRD

((((((((((((((((((((((((( Files Created from 2009-07-24 to 2009-08-24 )))))))))))))))))))))))))))))))

.

2009-08-24 09:52 . 2009-08-24 09:52 53248 ----a-w- c:\temp\catchme.dll

2009-08-24 09:51 . 2009-08-24 09:51 16384 ----atw- c:\temp\Perflib_Perfdata_554.dat

2009-08-22 09:35 . 2009-08-22 09:35 -------- d-----w- c:\temp\RarSFX2

2009-08-22 09:35 . 2009-08-22 09:35 -------- d-----w- c:\temp\RarSFX1

2009-08-22 09:34 . 2009-08-22 09:34 -------- d--h--w- c:\windows\PIF

2009-08-21 09:42 . 2009-08-21 09:42 3942047 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-08-19 11:59 . 2009-08-19 11:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Hot Lava Games

2009-08-19 11:59 . 2009-08-19 11:59 -------- d-----w- c:\program files\PC-home

2009-08-04 16:24 . 2009-08-04 16:24 -------- d-----w- c:\windows\Sun

2009-08-04 16:21 . 2009-08-04 16:21 410984 ----a-w- c:\windows\system32\deploytk.dll

2009-08-04 16:21 . 2009-08-04 16:21 -------- d-----w- c:\program files\Java

2009-08-04 16:21 . 2009-08-04 16:21 152576 ----a-w- c:\documents and settings\User\Application Data\Sun\Java\jre1.6.0_14\lzma.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-24 09:53 . 2008-12-17 08:45 -------- d-----w- c:\documents and settings\User\Application Data\Skype

2009-08-24 09:44 . 2009-01-19 10:43 -------- d-----w- c:\program files\Metin2.us

2009-08-24 09:32 . 2008-12-18 15:28 -------- d-----w- c:\documents and settings\User\Application Data\skypePM

2009-08-22 20:52 . 2008-12-18 15:30 -------- d-----w- c:\program files\BitComet

2009-08-21 09:42 . 2009-05-03 21:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-03 10:36 . 2009-05-03 21:51 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-03 10:36 . 2009-05-03 21:52 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-01 19:23 . 2008-12-17 08:19 -------- d-----w- c:\program files\Common Files\Adobe

2009-07-07 15:36 . 2009-05-23 15:08 -------- d-----w- c:\program files\Chrysler West Coast Rally

2009-07-07 15:08 . 2009-07-07 15:08 -------- d-----w- c:\program files\1C

2009-06-30 06:49 . 2009-06-05 21:21 -------- d-----w- c:\program files\Counter-Strike 1.6

2009-06-14 12:24 . 2009-06-14 12:24 8992 ----a-w- c:\windows\system32\kbdbph.dll

2007-03-09 07:12 . 2007-03-09 07:12 27648 --sha-w- c:\windows\system32\AVSredirect.dll

.

------- Sigcheck -------

[-] 2005-11-03 00:43 578560 7818B69A3A5EC4588B155374EBDE2ED1 c:\windows\system32\user32.dll

[-] 2005-11-03 00:43 578560 7818B69A3A5EC4588B155374EBDE2ED1 c:\windows\system32\dllcache\user32.dll

.

((((((((((((((((((((((((((((( SnapShot@2009-05-30_18.42.04 )))))))))))))))))))))))))))))))))))))))))

.

+ 2003-09-04 23:14 . 2003-09-04 23:14 24576 c:\windows\wt\wtDRM\rDRM0302.dll

+ 2003-09-04 23:13 . 2003-09-04 23:13 24576 c:\windows\wt\wtDRM\jDRM0302.dll

+ 2003-09-04 23:12 . 2003-09-04 23:12 21504 c:\windows\wt\wtDRM\DRM0302.dll

+ 2001-08-23 12:00 . 2009-08-24 09:35 59576 c:\windows\system32\perfc009.dat

- 2001-08-23 12:00 . 2009-05-30 09:40 59576 c:\windows\system32\perfc009.dat

+ 2009-06-12 19:12 . 2009-06-12 19:12 26694 c:\windows\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\UNINST_Uninstall_G_3DE5E7D47B88403CA3FD2017A8240C5B.exe

+ 2009-06-12 19:12 . 2009-06-12 19:12 65536 c:\windows\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut2_407B9B5CDAC54F44A756B57CAB4E6A8B.exe

+ 2009-06-12 19:12 . 2009-06-12 19:12 65536 c:\windows\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe

+ 2009-06-12 19:12 . 2009-06-12 19:12 26694 c:\windows\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe

+ 2009-06-12 19:12 . 2009-06-12 19:12 26694 c:\windows\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe

+ 2009-06-12 19:12 . 2009-06-12 19:12 26694 c:\windows\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\ARPPRODUCTICON.exe

+ 2003-09-25 16:47 . 2003-09-25 16:47 176195 c:\windows\wt\bgmtat.exe

- 2001-08-23 12:00 . 2009-05-30 09:40 395336 c:\windows\system32\perfh009.dat

+ 2001-08-23 12:00 . 2009-08-24 09:35 395336 c:\windows\system32\perfh009.dat

+ 2009-08-04 16:21 . 2009-08-04 16:21 148888 c:\windows\system32\javaws.exe

+ 2009-08-04 16:21 . 2009-08-04 16:21 144792 c:\windows\system32\javaw.exe

+ 2009-08-04 16:21 . 2009-08-04 16:21 144792 c:\windows\system32\java.exe

+ 2009-01-04 18:59 . 2009-01-04 18:59 464896 c:\windows\Installer\e400f7.msi

+ 2009-01-04 18:59 . 2009-01-04 18:59 163840 c:\windows\Installer\e400eb.msi

+ 2009-01-05 20:15 . 2009-01-05 20:15 537600 c:\windows\Installer\a35838.msi

+ 2009-01-04 19:33 . 2009-01-04 19:33 335360 c:\windows\Installer\8e242.msi

+ 2009-08-04 16:21 . 2009-08-04 16:21 536576 c:\windows\Installer\71ddb28.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 694272 c:\windows\Installer\5dbc1.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 194048 c:\windows\Installer\5dbbb.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 248832 c:\windows\Installer\5dbb5.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 248832 c:\windows\Installer\5dbaf.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 251392 c:\windows\Installer\5dba9.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 251392 c:\windows\Installer\5dba3.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 251392 c:\windows\Installer\5db9d.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 251392 c:\windows\Installer\5db97.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 251392 c:\windows\Installer\5db91.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 251392 c:\windows\Installer\5db8b.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 251392 c:\windows\Installer\5db85.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 251392 c:\windows\Installer\5db7f.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 248320 c:\windows\Installer\5db79.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 248832 c:\windows\Installer\5db73.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 248832 c:\windows\Installer\5db6d.msi

+ 2008-12-17 08:08 . 2008-12-17 08:08 251392 c:\windows\Installer\5db67.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 249344 c:\windows\Installer\5db61.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 251392 c:\windows\Installer\5db5b.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 249344 c:\windows\Installer\5db55.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 252928 c:\windows\Installer\5db4f.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 251904 c:\windows\Installer\5db49.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 249344 c:\windows\Installer\5db43.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 251904 c:\windows\Installer\5db3d.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 251392 c:\windows\Installer\5db37.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 269312 c:\windows\Installer\5db31.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 269312 c:\windows\Installer\5db2b.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 268288 c:\windows\Installer\5db25.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 268288 c:\windows\Installer\5db1f.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 268288 c:\windows\Installer\5db19.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 268800 c:\windows\Installer\5db13.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 268800 c:\windows\Installer\5db0d.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 268288 c:\windows\Installer\5db07.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 268288 c:\windows\Installer\5db01.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 268288 c:\windows\Installer\5dafb.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 186880 c:\windows\Installer\5daf5.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 186880 c:\windows\Installer\5daef.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 265216 c:\windows\Installer\5dae9.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 265216 c:\windows\Installer\5dae3.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 187904 c:\windows\Installer\5dadd.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 263680 c:\windows\Installer\5dad7.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 266240 c:\windows\Installer\5dad1.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 265216 c:\windows\Installer\5dacb.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 265728 c:\windows\Installer\5dac5.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 265216 c:\windows\Installer\5dabf.msi

+ 2008-12-17 08:07 . 2008-12-17 08:07 265216 c:\windows\Installer\5dab9.msi

+ 2008-12-17 08:06 . 2008-12-17 08:06 210944 c:\windows\Installer\5dab3.msi

+ 2008-12-17 08:06 . 2008-12-17 08:06 179712 c:\windows\Installer\5daad.msi

+ 2008-12-17 08:06 . 2008-12-17 08:06 283136 c:\windows\Installer\5daa7.msi

+ 2008-12-17 08:06 . 2008-12-17 08:06 182272 c:\windows\Installer\5daa1.msi

+ 2008-12-17 08:06 . 2008-12-17 08:06 266752 c:\windows\Installer\5da9b.msi

+ 2008-12-17 08:06 . 2008-12-17 08:06 317952 c:\windows\Installer\5da95.msi

+ 2008-12-17 08:06 . 2008-12-17 08:06 257536 c:\windows\Installer\5da8f.msi

+ 2008-12-17 08:06 . 2008-12-17 08:06 774144 c:\windows\Installer\5da89.msi

+ 2008-12-17 07:40 . 2008-12-17 07:40 264704 c:\windows\Installer\28f3b.msi

+ 2008-12-18 19:13 . 2008-12-18 19:13 928768 c:\windows\Installer\27202.msi

+ 2009-02-16 20:33 . 2009-02-16 20:33 577024 c:\windows\Installer\1ff1d49.msi

+ 2009-04-02 05:31 . 2009-04-02 05:31 331264 c:\windows\Installer\1e5482.msi

+ 2009-02-24 17:26 . 2009-02-24 17:26 144384 c:\windows\Installer\149ec7a.msi

+ 2008-12-17 08:42 . 2008-12-17 08:42 660480 c:\windows\Installer\10fdbe.msi

+ 2009-01-18 13:05 . 2009-01-18 13:05 675840 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0100000010\9.1.0\JP2KLib.dll

+ 2007-01-01 17:14 . 2007-01-01 17:14 1326080 c:\windows\system32\webfldrs.msi

+ 2009-04-18 13:35 . 2009-04-18 13:35 1681408 c:\windows\Installer\a8b8f2.msi

+ 2009-01-05 20:16 . 2009-01-05 20:16 1453568 c:\windows\Installer\a35844.msi

+ 2009-01-05 20:15 . 2009-01-05 20:15 1868800 c:\windows\Installer\a3583e.msi

+ 2009-01-05 20:13 . 2009-01-05 20:13 5091840 c:\windows\Installer\a3582c.msi

+ 2009-01-04 19:33 . 2009-01-04 19:33 2212864 c:\windows\Installer\8e248.msi

+ 2009-01-08 20:11 . 2009-01-08 20:11 3180544 c:\windows\Installer\7eca3a.msi

+ 2009-01-08 20:03 . 2009-01-08 20:03 3568640 c:\windows\Installer\7ec84f.msi

+ 2009-01-08 20:02 . 2009-01-08 20:02 3291648 c:\windows\Installer\7ec848.msi

+ 2009-01-08 20:02 . 2009-01-08 20:02 3521536 c:\windows\Installer\7ec842.msi

+ 2009-01-08 20:01 . 2009-01-08 20:01 3180032 c:\windows\Installer\7ec83b.msi

+ 2009-01-08 20:01 . 2009-01-08 20:01 4038656 c:\windows\Installer\7ec835.msi

+ 2009-01-08 20:01 . 2009-01-08 20:01 3102208 c:\windows\Installer\7ec82e.msi

+ 2009-01-08 20:01 . 2009-01-08 20:01 4914176 c:\windows\Installer\7ec827.msi

+ 2009-01-08 20:00 . 2009-01-08 20:00 4922880 c:\windows\Installer\7ec81c.msi

+ 2009-01-08 20:00 . 2009-01-08 20:00 3082752 c:\windows\Installer\7ec816.msi

+ 2009-01-08 20:00 . 2009-01-08 20:00 3122688 c:\windows\Installer\7ec810.msi

+ 2009-01-08 20:00 . 2009-01-08 20:00 1021952 c:\windows\Installer\7ec80a.msi

+ 2009-01-08 20:00 . 2009-01-08 20:00 1022464 c:\windows\Installer\7ec804.msi

+ 2009-01-08 20:00 . 2009-01-08 20:00 3837440 c:\windows\Installer\7ec7fe.msi

+ 2009-01-08 19:59 . 2009-01-08 19:59 3079168 c:\windows\Installer\7ec7f7.msi

+ 2009-01-08 19:59 . 2009-01-08 19:59 3079680 c:\windows\Installer\7ec7f0.msi

+ 2009-01-08 19:59 . 2009-01-08 19:59 3078656 c:\windows\Installer\7ec7e9.msi

+ 2009-01-08 19:59 . 2009-01-08 19:59 3099648 c:\windows\Installer\7ec7e2.msi

+ 2009-01-08 19:59 . 2009-01-08 19:59 3184128 c:\windows\Installer\7ec7dc.msi

+ 2009-01-08 19:58 . 2009-01-08 19:58 3080704 c:\windows\Installer\7ec7d6.msi

+ 2009-01-08 19:58 . 2009-01-08 19:58 3095040 c:\windows\Installer\7ec7d0.msi

+ 2009-01-08 19:58 . 2009-01-08 19:58 3085312 c:\windows\Installer\7ec7ca.msi

+ 2009-01-08 19:58 . 2009-01-08 19:58 3089408 c:\windows\Installer\7ec7c4.msi

+ 2009-01-08 19:58 . 2009-01-08 19:58 3082752 c:\windows\Installer\7ec7be.msi

+ 2009-01-08 19:58 . 2009-01-08 19:58 3085824 c:\windows\Installer\7ec7b8.msi

+ 2009-01-08 19:58 . 2009-01-08 19:58 3092992 c:\windows\Installer\7ec7b2.msi

+ 2009-01-08 19:57 . 2009-01-08 19:57 3279360 c:\windows\Installer\7ec7ac.msi

+ 2009-01-08 19:57 . 2009-01-08 19:57 3191808 c:\windows\Installer\7ec7a6.msi

+ 2009-01-08 19:57 . 2009-01-08 19:57 3078656 c:\windows\Installer\7ec7a0.msi

+ 2009-01-08 19:57 . 2009-01-08 19:57 3116544 c:\windows\Installer\7ec799.msi

+ 2009-01-08 19:57 . 2009-01-08 19:57 3156480 c:\windows\Installer\7ec793.msi

+ 2009-01-08 19:56 . 2009-01-08 19:56 3346432 c:\windows\Installer\7ec78d.msi

+ 2009-01-08 19:56 . 2009-01-08 19:56 3084288 c:\windows\Installer\7ec786.msi

+ 2009-01-08 19:56 . 2009-01-08 19:56 3233792 c:\windows\Installer\7ec77f.msi

+ 2009-01-08 19:56 . 2009-01-08 19:56 3211776 c:\windows\Installer\7ec779.msi

+ 2009-01-08 19:55 . 2009-01-08 19:55 3152896 c:\windows\Installer\7ec773.msi

+ 2009-01-08 19:55 . 2009-01-08 19:55 3076608 c:\windows\Installer\7ec76d.msi

+ 2008-12-17 08:09 . 2008-12-17 08:09 7258112 c:\windows\Installer\5dbcf.msi

+ 2008-12-17 08:09 . 2008-12-17 08:09 3650048 c:\windows\Installer\5dbc9.msi

+ 2008-12-17 08:04 . 2008-12-17 08:04 2109440 c:\windows\Installer\5da83.msi

+ 2009-05-12 12:09 . 2009-05-12 12:09 1163264 c:\windows\Installer\5b218f.msi

+ 2008-12-17 09:38 . 2008-12-17 09:38 2238464 c:\windows\Installer\45038.msi

+ 2008-12-17 08:55 . 2008-12-17 08:55 5922816 c:\windows\Installer\4502d.msi

+ 2009-05-25 00:21 . 2009-05-25 00:21 2130432 c:\windows\Installer\3c8ebd8.msi

+ 2009-05-14 12:38 . 2009-05-14 12:38 1602048 c:\windows\Installer\2fff8.msi

+ 2009-05-04 10:51 . 2009-05-04 10:51 1129472 c:\windows\Installer\2b7ab0.msi

+ 2009-08-01 19:24 . 2009-08-01 19:24 6653952 c:\windows\Installer\24e24af.msp

+ 2009-08-01 19:24 . 2009-08-01 19:24 1697792 c:\windows\Installer\24e24ae.msp

+ 2009-08-01 19:23 . 2009-08-01 19:23 3938816 c:\windows\Installer\21498af.msi

+ 2009-04-02 05:30 . 2009-04-02 05:30 1799168 c:\windows\Installer\1e547c.msi

+ 2009-06-12 19:12 . 2009-06-12 19:12 7641088 c:\windows\Installer\190993d.msi

+ 2009-05-18 18:50 . 2009-05-18 18:50 1013248 c:\windows\Installer\18cc49b.msi

+ 2008-12-18 13:48 . 2008-12-18 13:48 3645440 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0100000010\9.1.0\authplay.dll

+ 2009-05-21 19:23 . 2009-05-21 19:23 1414144 c:\windows\Downloaded Installations\{2FA3C24F-A28A-48D7-8A27-4E2ED3D44B80}\USB Flash Disk Driver.msi

+ 2005-09-23 05:48 . 2005-09-23 05:48 24863744 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\netfx.msi

+ 2009-04-24 16:15 . 2009-04-24 16:15 21359104 c:\windows\Installer\2b6edb6.msp

+ 2009-02-27 13:37 . 2009-02-27 13:37 20403568 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0100000010\9.1.0\AcroRd32.dll

.

-- Snapshot reset to current date --

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-16 24264488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]

"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-04-09 2029640]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

TrayMin210.exe.lnk - c:\program files\Philips\Philips SPC210NC Webcam\TrayMin210.exe [2009-2-24 278528]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digest32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\BitComet\\BitComet.exe"=

"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=

"c:\\Program Files\\Saints Row 2\\SR2_pc.exe"=

"%windir%\\system32\\ShellExt\\Sys\\NvCpi.exe"=

"c:\\Program Files\\Diablo II\\Diablo II.exe"=

"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"=

"c:\\WINDOWS\\system32\\svchost.exe"=

"c:\\WINDOWS\\system32\\Ati2evxx.exe"=

"c:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"11576:TCP"= 11576:TCP:BitComet 11576 TCP

"11576:UDP"= 11576:UDP:BitComet 11576 UDP

"5353:TCP"= 5353:TCP:Adobe CSI CS4

"1700:TCP"= 1700:TCP:MioNet Remote Drive Access

"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

"4719:TCP"= 4719:TCP:4719

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [09.04.2009 15:18 107256]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [09.04.2009 15:21 94360]

R2 ekrn;ESET Service;c:\program files\Eset\ESET NOD32 Antivirus\ekrn.exe [09.04.2009 15:19 731840]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 wip0204;Wippien Network Adapter 2.4;c:\windows\system32\drivers\wip0204.sys [29.04.2009 19:57 23480]

S3 XDva224;XDva224;\??\c:\windows\system32\XDva224.sys --> c:\windows\system32\XDva224.sys [?]

S3 XDva276;XDva276;\??\c:\windows\system32\XDva276.sys --> c:\windows\system32\XDva276.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3171c025-ce96-11dd-90d8-001fc6b653df}]

\Shell\AutoRun\command - G:\autorun.exe

.

Contents of the 'Scheduled Tasks' folder

2009-06-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1637723038-1417001333-1003Core.job

- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-07 12:20]

2009-05-14 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2009-05-06 19:18]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.bg/

uInternet Settings,ProxyServer = 172.16.41.9:8080

IE: &С&валяне &с BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

IE: &С&валяне на всички с BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

IE: &С&валяне на всичкото видео с BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: {D22BE32B-A6CB-4D55-B3CD-B15E2CA338F2} = 192.168.0.1

FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\kljuudty.default\

FF - prefs.js: browser.search.selectedEngine - DAEMON Search

FF - prefs.js: browser.startup.homepage - hxxp://bgmafia.com/

FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\kljuudty.default\extensions\[email protected]\components\BkMrkExt.dll

FF - plugin: c:\documents and settings\User\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-24 12:52

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(832)

c:\windows\system32\Ati2evxx.dll

c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\windows\system32\ati2evxx.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\Skype\Plugin Manager\skypePM.exe

.

**************************************************************************

.

Completion time: 2009-08-24 12:59 - machine was rebooted

ComboFix-quarantined-files.txt 2009-08-24 09:59

ComboFix2.txt 2009-06-11 10:06

ComboFix3.txt 2009-05-30 18:45

ComboFix4.txt 2009-05-03 23:09

Pre-Run: 5 427 544 064 bytes free

Post-Run: 5 451 788 288 bytes free

309 --- E O F --- 2009-05-14 17:48

Тази другата програма като я отворих ми излезе само неро..нямаше CFTMON.exe

СТЪПКА 1

Изтеглете JavaRa и го разархивирайте на Вашия десктоп.

***! Преди да започнете с процедурата, затворете Internet Explorer !***

Кликнете два пъти върху JavaRa.exe, за да стартирате програмата

От падащото меню, изберете English ...и изберете Select.

JavaRa ще се стартира; Изберете Remove Older Versions, за да премахнете по-старата версия от компютъра.

Посочете Yes, когато бъдете попитан. Когато JavaRa приключи успешно премахването на старата версия, ще получите съобщение, че лог файла от извършената процедура е създаден. Изберете OK.

Лог файлът ще появи. Запазете го на десктопа.

Копирайте съдържанито му в следващия си пост.

Може да изтеглите актуална версия на JAVA оттук => Java SE Runtime Environment 6 Update 16

СТЪПКА 2

Отворете notepad и чрез copy/paste въведете:

KILALL::


Driver::

XDva224

XDva276


File::

c:\windows\system32\KB905474\wgasetup.exe


Registry::

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders]

"SecurityProviders"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders]

"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\ShellExt\\Sys\\NvCpi.exe"=-

"c:\\WINDOWS\\system32\\Ati2evxx.exe"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"4719:TCP"=-

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3171c025-ce96-11dd-90d8-001fc6b653df}]


Firefox::

FF - prefs.js: browser.search.selectedEngine - DAEMON Search

Запазете файла с име CFScript.txt и чрез copy/paste го провлачете в ComboFix.exe

Публикувайте лог файла в следващия си пост.

JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Wed Aug 26 11:34:28 2009

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

------------------------------------

Finished reporting.

JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Wed Aug 26 11:34:38 2009

------------------------------------

Finished reporting.

Ето го и ComboFix-a

ComboFix 09-08-25.04 - User 26.08.2009 11:49.7.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2047.1482 [GMT 3:00]

Running from: c:\documents and settings\User\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\User\Desktop\CFScript.txt

AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

"c:\windows\system32\KB905474\wgasetup.exe"

.

PEV Error: CacheFolder

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\KB905474\wgasetup.exe

c:\windows\system32\nerocheck.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_XDVA224

-------\Legacy_XDVA276

-------\Service_XDva224

-------\Service_XDva276

((((((((((((((((((((((((( Files Created from 2009-07-26 to 2009-08-26 )))))))))))))))))))))))))))))))

.

2009-08-26 08:56 . 2009-08-26 08:56 53248 ----a-w- c:\temp\catchme.dll

2009-08-26 08:55 . 2009-08-26 08:55 16384 ----atw- c:\temp\Perflib_Perfdata_574.dat

2009-08-26 08:44 . 2009-08-26 08:44 -------- d-----w- C:\Sun

2009-08-22 09:35 . 2009-08-22 09:35 -------- d-----w- c:\temp\RarSFX2

2009-08-22 09:35 . 2009-08-22 09:35 -------- d-----w- c:\temp\RarSFX1

2009-08-22 09:34 . 2009-08-22 09:34 -------- d--h--w- c:\windows\PIF

2009-08-21 09:42 . 2009-08-21 09:42 3942047 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-08-19 11:59 . 2009-08-19 11:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Hot Lava Games

2009-08-19 11:59 . 2009-08-19 11:59 -------- d-----w- c:\program files\PC-home

2009-08-04 16:24 . 2009-08-04 16:24 -------- d-----w- c:\windows\Sun

2009-08-04 16:21 . 2009-08-04 16:21 410984 ----a-w- c:\windows\system32\deploytk.dll

2009-08-04 16:21 . 2009-08-04 16:21 -------- d-----w- c:\program files\Java

2009-08-04 16:21 . 2009-08-04 16:21 152576 ----a-w- c:\documents and settings\User\Application Data\Sun\Java\jre1.6.0_14\lzma.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-26 08:58 . 2008-12-17 08:45 -------- d-----w- c:\documents and settings\User\Application Data\Skype

2009-08-26 08:28 . 2008-12-18 15:28 -------- d-----w- c:\documents and settings\User\Application Data\skypePM

2009-08-26 08:26 . 2009-01-19 10:43 -------- d-----w- c:\program files\Metin2.us

2009-08-25 17:16 . 2008-12-18 15:30 -------- d-----w- c:\program files\BitComet

2009-08-21 09:42 . 2009-05-03 21:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-03 10:36 . 2009-05-03 21:51 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-03 10:36 . 2009-05-03 21:52 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-01 19:23 . 2008-12-17 08:19 -------- d-----w- c:\program files\Common Files\Adobe

2009-07-07 15:36 . 2009-05-23 15:08 -------- d-----w- c:\program files\Chrysler West Coast Rally

2009-07-07 15:08 . 2009-07-07 15:08 -------- d-----w- c:\program files\1C

2009-06-30 06:49 . 2009-06-05 21:21 -------- d-----w- c:\program files\Counter-Strike 1.6

2009-06-14 12:24 . 2009-06-14 12:24 8992 ----a-w- c:\windows\system32\kbdbph.dll

2007-03-09 07:12 . 2007-03-09 07:12 27648 --sha-w- c:\windows\system32\AVSredirect.dll

.

------- Sigcheck -------

[-] 2005-11-03 00:43 578560 7818B69A3A5EC4588B155374EBDE2ED1 c:\windows\system32\user32.dll

[-] 2005-11-03 00:43 578560 7818B69A3A5EC4588B155374EBDE2ED1 c:\windows\system32\dllcache\user32.dll

.

((((((((((((((((((((((((((((( SnapShot_2009-08-24_09.52.22 )))))))))))))))))))))))))))))))))))))))))

.

- 2001-08-23 12:00 . 2009-08-24 09:35 59576 c:\windows\system32\perfc009.dat

+ 2001-08-23 12:00 . 2009-08-26 08:31 59576 c:\windows\system32\perfc009.dat

+ 2001-08-23 12:00 . 2009-08-26 08:31 395336 c:\windows\system32\perfh009.dat

- 2001-08-23 12:00 . 2009-08-24 09:35 395336 c:\windows\system32\perfh009.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-16 24264488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-04-09 2029640]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\User\Start Menu\Programs\Startup\

SDK Tray Menu.lnk - c:\sun\SDK\jdk\bin\javaw.exe [2009-8-26 139264]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TrayMin210.exe.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\TrayMin210.exe.lnk

backup=c:\windows\pss\TrayMin210.exe.lnkCommon Startup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\BitComet\\BitComet.exe"=

"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=

"c:\\Program Files\\Saints Row 2\\SR2_pc.exe"=

"c:\\Program Files\\Diablo II\\Diablo II.exe"=

"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"=

"c:\\WINDOWS\\system32\\svchost.exe"=

"c:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"11576:TCP"= 11576:TCP:BitComet 11576 TCP

"11576:UDP"= 11576:UDP:BitComet 11576 UDP

"5353:TCP"= 5353:TCP:Adobe CSI CS4

"1700:TCP"= 1700:TCP:MioNet Remote Drive Access

"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [09.04.2009 15:18 107256]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [09.04.2009 15:21 94360]

R2 ekrn;ESET Service;c:\program files\Eset\ESET NOD32 Antivirus\ekrn.exe [09.04.2009 15:19 731840]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 wip0204;Wippien Network Adapter 2.4;c:\windows\system32\drivers\wip0204.sys [29.04.2009 19:57 23480]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{10a38954-cd37-11dd-90d4-001fc6b653df}]

\Shell\AutoRun\command - E:\autoplay.exe

.

Contents of the 'Scheduled Tasks' folder

2009-06-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1637723038-1417001333-1003Core.job

- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-07 12:20]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.bg/

uInternet Settings,ProxyServer = 172.16.41.9:8080

IE: &С&валяне &с BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

IE: &С&валяне на всички с BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

IE: &С&валяне на всичкото видео с BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: {D22BE32B-A6CB-4D55-B3CD-B15E2CA338F2} = 192.168.0.1

FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\kljuudty.default\

FF - prefs.js: browser.search.selectedEngine - DAEMON Search

FF - prefs.js: browser.startup.homepage - hxxp://bgmafia.com/

FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\kljuudty.default\extensions\[email protected]\components\BkMrkExt.dll

FF - plugin: c:\documents and settings\User\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-26 11:56

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(828)

c:\windows\system32\Ati2evxx.dll

c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\windows\system32\ati2evxx.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\Skype\Plugin Manager\skypePM.exe

.

**************************************************************************

.

Completion time: 2009-08-26 12:03 - machine was rebooted

ComboFix-quarantined-files.txt 2009-08-26 09:03

ComboFix2.txt 2009-08-24 09:59

ComboFix3.txt 2009-06-11 10:06

ComboFix4.txt 2009-05-30 18:45

ComboFix5.txt 2009-08-26 08:48

Pre-Run: 36 211 417 088 bytes free

Post-Run: 36 160 991 232 bytes free

170 --- E O F --- 2009-05-14 17:48

Стъпка 1:

Изтрийте следната папка:

c:\documents and settings\User\Application Data\Sun\Java\jre1.6.0_14

За да видите директориите ще трябва да направите скритите файлове видими.

Това става по-следния начин:

*Мy Computer => Folder Options => View =>

[*]Сложете радиобутона пред => Show hidden files and folders

[*]Премахнете отметката от Hide protected operaring system files (recommended)

[*]Потвърдете с Apply

След това инсталирайте обновлението за Java 1.6.0.16. Линк ще намерите в горните постове.

Стъпка 2:

Натиснете Start => Run => msconfig => отидете до Startup и премахнете отметката от - javaw.exe

Стъпка 3:

Отворете notepad и въведете:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{10a38954-cd37-11dd-90d4-001fc6b653df}]

Запазете файла с име reg.fix

Файла ще изглежда по този начин -

Стартирайте го с двукратен клик и натиснете YES за да влезнат промените в сила.

Стъпка 4:

Деинсталирайте ComboFix с командата Start => Run => въведете

combofix /u

Забележка : Има празно място между x и /

Стъпка 5:

Тъй като имате променен системен файл

c:\windows\system32\user32.dll

и командата sfc /scannow също няма да помогне, защото съдържанието и на папката

c:\windows\system32\dllcache\user32.dll

е променено, моя съвет е да преинсталирате пакета Service Pack 3.

Можете да го изтеглите оттук - Windows XP Service Pack 3 RTM Build 5512