Премини към съдържанието
  • Добре дошли!

    Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

    Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

     

Моля прегледайте логовете


Препоръчан отговор


Моля прегледайте логовете-направете анализ.

Благодаря предварително!!! :)

Malwarebytes' Anti-Malware 1.41

Версия на базата от данни: 2790

Windows 5.1.2600 Service Pack 3

13.09.2009 17:15:50

mbam-log-2009-09-13 (17-15-50).txt

Тип сканиране: Бързо сканиране

Сканирани обекти: 79159

Изминало време: 4 minute(s), 33 second(s)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 0

Заразени стойности в регистратурата: 1

Заразени информационни обекти в регистратурата: 1

Заразени папки: 1

Заразени файлове: 37

Заразени процеси в паметта:

(Не бяха открити заплахи)

Заразени модули в паметта:

(Не бяха открити заплахи)

Заразени ключове в регистратурата:

(Не бяха открити заплахи)

Заразени стойности в регистратурата:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Заразени информационни обекти в регистратурата:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Заразени папки:

C:\WINDOWS\system32\kazaabackupfiles (Worm.Archive) -> Quarantined and deleted successfully.

Заразени файлове:

C:\WINDOWS\system32\kazaabackupfiles\administrator.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\angelina.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\AquaNox2 Crack.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\AVP_Crack.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\Battlefield1942_bloodpatch.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\britney_spears.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\C&C Generals_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\celeb.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\cracker_jack.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\cracking_tools.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\FIFA2003 crack.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\free_root.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\free_shell.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\get_admin.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\hacking.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\hotmail_hack.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\kazza_hack.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\McAfee.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\msn.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\NBA2003_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\norton.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\password_stealer.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\phreaking.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\phreaking_tools.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\Porn.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\remoter.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\root.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\serial.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\sms.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\soldier_of_fortune_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\Sygate_all_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\sygate_firawall_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\tiny_personal_firewall_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\Unreal2_bloodpatch.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\UT2003_bloodpatch.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\xxx.exe (Worm.Archive) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazaabackupfiles\zoneallarm_pro_crack.exe (Worm.Archive) -> Quarantined and deleted successfully.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:23:50, on 13.09.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Avast4\aswUpdSv.exe

C:\Program Files\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program FilesBlueSoleil\BlueSoleilCS.exe

C:\Program FilesBlueSoleil\BsMobileCS.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\VIA\RAID\vialogsv.exe

C:\Program Files\Avast4\ashMaiSv.exe

C:\Program Files\Avast4\ashWebSv.exe

C:\Program FilesBlueSoleil\BsHelpCS.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.abv.bg/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Send by Bluetooth - C:\Program FilesBlueSoleil\TransSend\IE\tsinfo.htm

O8 - Extra context menu item: Send via &Message... - C:\Program FilesBlueSoleil\TransSend\IE\tssms.htm

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{DE6EB81A-FE44-4152-9206-ED87F4F3FD06}: NameServer = 212.39.90.42,212.39.90.43

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\skype4com.dll

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe

O23 - Service: BlueSoleilCS - Unknown owner - C:\Program FilesBlueSoleil\BlueSoleilCS.exe

O23 - Service: BsHelpCS - Unknown owner - C:\Program FilesBlueSoleil\BsHelpCS.exe

O23 - Service: BsMobileCS - Unknown owner - C:\Program FilesBlueSoleil\BsMobileCS.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: VRAID Log Service - Unknown owner - C:\Program Files\VIA\RAID\vialogsv.exe

--

End of file - 5395 bytes

Редактирано от veni (преглед на промените)
Линк към този отговор
Сподели в други сайтове

Колегата, който беше помолен да Ви поеме, явно не прояви желание, така че ако все още се нуждаете от помощ, направете нов лог файл от HiJackThis и го публикувайте в следващия Ви коментар в тази тема.

Линк към този отговор
Сподели в други сайтове

Добавете отговор

Можете да публикувате отговор сега и да се регистрирате по-късно. Ако имате регистрация, влезте в профила си за да публикувате от него.
Бележка: Вашата публикация изисква одобрение от модератор, преди да стане видима за всички.

Гост
Напишете отговор в тази тема...

×   Вмъкнахте текст, който съдържа форматиране.   Премахни форматирането на текста

  Разрешени са само 75 емотикони.

×   Съдържанието от линка беше вградено автоматично.   Премахни съдържанието и покажи само линк

×   Съдържанието, което сте написали преди беше възстановено..   Изтрий всичко

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Добави ново...

Информация

Поставихме бисквитки на устройството ви за най-добро потребителско изживяване. Можете да промените настройките си за бисквитки, или в противен случай приемаме, че сте съгласни с нашите Условия за ползване