Системата ми е инфектирана [Решен]

23 септември 200916 г.

Здравейте реших да сканирам един компютър по описаните от Maniac начини ето и логовете.

Malwarebytes' Anti-Malware 1.41

Версия на базата от данни: 2775

Windows 5.1.2600 Service Pack 3


23.9.2009 15:32:27

mbam-log-2009-09-23 (15-32-27).txt


Тип сканиране: Пълно сканиране (C:\|D:\|E:\|)

Сканирани обекти: 193801

Изминало време: 24 minute(s), 34 second(s)


Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 3

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 1

Заразени файлове: 3


Заразени процеси в паметта:

(Не бяха открити заплахи)


Заразени модули в паметта:

(Не бяха открити заплахи)


Заразени ключове в регистратурата:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed 


Components\{9d71d88c-c598-4935-c5d1-43aa4db90836} (Trojan.Agent) -> Quarantined and deleted 


successfully.

HKEY_CURRENT_USER\SOFTWARE\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted 


successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted 


successfully.


Заразени стойности в регистратурата:

(Не бяха открити заплахи)


Заразени информационни обекти в регистратурата:

(Не бяха открити заплахи)


Заразени папки:

C:\Program Files\bifrost (Backdoor.Bifrose) -> Delete on reboot.


Заразени файлове:

C:\Keygen Nero 6.6.0.6.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\bifrost\server.exe (Trojan.BatDroppings) -> Quarantined and deleted 


successfully.

C:\Program Files\bifrost\logg.dat (Backdoor.Bifrose) -> Delete on reboot.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:58:34, on 23.9.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.21073)

Boot mode: Normal


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\vsnpstd3.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\eHome\ehSched.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\PC Tools Firewall Plus\FWService.exe

C:\Program Files\Search Settings\SearchSettings.exe

C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Utilities\True Transparency\TrueTransparency.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe

C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files\Styler\Styler.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\AutoGK\AutoGK.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\PROGRA~1\AutoGK\VDubMod\VIRTUA~1.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = 


http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 


http://mystart.incredimail.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 


http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 


http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 


http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 


http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = 


http://go.microsoft.com/fwlink/?LinkId=74005

R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - 


C:\Program Files\Search Settings\kb127\SearchSettings.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program 


Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program 


Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - 


C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program 


Files\Java\jre1.6.0_06\bin\ssv.dll

O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program 


Files\Search Settings\kb127\SearchSettings.dll

O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program 


Files\Styler\TB\StylerTB.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft 


Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE 


C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 


9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" 


/min

O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe

O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' 


Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [True Transparency] "C:\Program Files\Utilities\True 


Transparency\TrueTransparency.exe"

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"

O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 


11\SwHelper_1150600.exe -Update -1150600 


-"Mozilla/5.0_(Windows;_U;_Windows_NT_5.1;_en-US;_rv:1.9.0.13)_Gecko/2009073022_Firefox/3.0.


13_(.NET_CLR_3.5.30729)" 


-"http://209.85.129.132/translate_c?hl=bg&sl=en&tl=bg&u=http://www.miniclip.com/games/sveerz


/en/iframe.html&rurl=translate.google.bg&usg=ALkJrhibgHw1_WJhvCc5dQOB36IQvRGB-g"

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK 


SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [True Transparency] "C:\Program Files\Utilities\True 


Transparency\TrueTransparency.exe" (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [LClock] C:\Program Files\LClock\LClock.exe (User 'NETWORK 


SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx 


nLite.inf,C,,4,N (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx 


nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx 


nLite.inf,C,,4,N (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma 


Loader.exe

O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft 


Office\Office12\ONENOTEM.EXE

O4 - Startup: Styler.lnk = ?

O4 - Global Startup: McAfee Security Scan.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - 


res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program 


Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - 


C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - 


C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - 


C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program 


Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - 


C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network 


Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - 


C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{889AA017-750E-4A46-8B36-CB91153A0B4D}: NameServer = 


212.39.90.42,212.39.90.43

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - 


C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - 


C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe 


Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira 


GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - 


C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - 


C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC 


Tools Firewall Plus\FWService.exe


--

End of file - 8844 bytes

Ще бъда благодарен ако някой каже как да се оправя с тях

23 септември 200916 г.

Здравейте daniel1995!

Аз съм Maniac и ще Ви помагам да почистите вашата система от зловреден софтуер. Анализа на логовете, както и премахването на зловредния софтуер, може да отнеме време, затова моля бъдете търпеливи. Моля, имайте предвид следното:

Аз ще Ви помагам само за почистването на вашата система от зловреден софтуер. За всякакви други проблеми, моля създайте нова тема в съответния форум и опишете детайлно проблема Ви.
Решението се отнася само за този проблем и само на този компютър.
Следвайте инструкциите ми стриктно, докато не Ви кажа, че системата Ви е напълно чиста. Това, че симптомите са изчезнали, не значи че всичко е наред.
Ако не разбирате нещо, моля Ви попитайте ме, а не рискувайте. По-добре е малко да се позабавим, отколкото да усложним нещата.
При наличие на руткит, аз не гарантирам 100% почистване.
Проявете търпение, защото процедурата по почистването на вашата система може да отнеме известно време, в зависимост от вида на зловредния софтуер.
Цялата кореспонденция минава през тази тема, не създавайте нова тема и не използвайте друга тема за тази цел.

Стъпка 1:

Изтеглете Security Check от screen317 от тук или тук и го запаметете на вашия десктоп.

Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия Ви коментар в тази тема.

Стъпка 2:

Изтеглете RootRepeal от тук

Разархивирайте го на вашия десктоп.

Кликнете два пъти върху RootRepeal.exe , за да стартирате програмата
Кликнете на таба Report в долната част на прозореца
Кликнете на бутона Scan
Сложете отметки пред следното:

Drivers
Processes
SSDT
Hidden Services

Кликнете на бутона OK
На следващия диалогов прозорец, сложете отметки преди всички дялове (C:\ , D:\ ....)
Кликнете на OK, за да започне процеса на сканиране

Бележка: Процеса на сканиране може да отнеме време. Моля,

не стартирайте

никакви програми, докато програмата сканира.

Когато сканирането завърши успешно ще се появи бутона Save Report
Кликнете върху Save Report и запишете лог файла на вашия десктоп, с име RootRepeal.txt
Отворете File, след което Exit , за да затворите програмата.

Копирайте и поставете съдържанието на RootRepeal.txt в следващия си пост.

23 септември 200916 г.

Автор

 Results of screen317's Security Check version 0.99.0  

 Windows XP Service Pack 3  

[b]`````````````````````````````` 

[u]Antivirus/Firewall Check:[/u][/b] 

 [color=red][b]Windows Security Center service is not running! This report may not be accurate![/b][/color] 

 Avira AntiVir Personal - Free Antivirus 

 PC Tools Firewall Plus 6.0  

 McAfee Security Scan    

 Antivirus up to date!  

[b]`````````````````````````````` 

[u]Anti-malware/Other Utilities Check:[/u][/b] 

 CCleaner (remove only)   

 Java(TM) 6 Update 6  

 [color=red][b]Out of date Java installed![/b][/color] 

 Adobe Flash Player 10  

Adobe Reader 9 

[b]`````````````````````````````` 

Process Check:  

[u]objlist.exe by Laurent[/u][/b] 

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 

 PC Tools Firewall Plus FWService.exe   

 PC Tools Firewall Plus FirewallGUI.exe   

[b]``````````````````````````````

[u]DNS Vulnerability Check:[/u][/b]

 [color=red][b]Request Timed Out (Wireless Internet connection/Disconnected Internet/Proxy?)[/b][/color] 


[b]`````````End of Log```````````[/b]

ROOTREPEAL (c) AD, 2007-2009

==================================================

Scan Start Time:		2009/09/23 16:12

Program Version:		Version 1.3.5.0

Windows Version:		Windows XP Media Center Edition SP3

==================================================


Drivers

-------------------

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xB6B3E000	Size: 98304	File Visible: No	Signed: -

Status: -


Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xF79CB000	Size: 8192	File Visible: No	Signed: -

Status: -


Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xB58A7000	Size: 49152	File Visible: No	Signed: -

Status: -


SSDT

-------------------

#: 017	Function Name: NtAllocateVirtualMemory

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef7670


#: 019	Function Name: NtAssignProcessToJobObject

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef735e


#: 031	Function Name: NtConnectPort

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef73a0


#: 037	Function Name: NtCreateFile

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef744e


#: 047	Function Name: NtCreateProcess

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef7cf6


#: 048	Function Name: NtCreateProcessEx

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef7d82


#: 053	Function Name: NtCreateThread

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef7e12


#: 057	Function Name: NtDebugActiveProcess

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef749e


#: 068	Function Name: NtDuplicateObject

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef74e0


#: 097	Function Name: NtLoadDriver

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef7524


#: 119	Function Name: NtOpenKey

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef7566


#: 122	Function Name: NtOpenProcess

Status: Hooked by "<unknown>" at address 0xf7a8d908


#: 125	Function Name: NtOpenSection

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef75a8


#: 128	Function Name: NtOpenThread

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef75ea


#: 137	Function Name: NtProtectVirtualMemory

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef76b8


#: 200	Function Name: NtRequestWaitReplyPort

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef762c


#: 204	Function Name: NtRestoreKey

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef76fa


#: 206	Function Name: NtResumeThread

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef7742


#: 210	Function Name: NtSecureConnectPort

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef77d2


#: 247	Function Name: NtSetValueKey

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef7784


#: 253	Function Name: NtSuspendProcess

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef7876


#: 255	Function Name: NtSystemDebugControl

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef78b8


#: 257	Function Name: NtTerminateProcess

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef78fa


#: 277	Function Name: NtWriteVirtualMemory

Status: Hooked by "C:\WINDOWS\system32\drivers\PCTAppEvent.sys" at address 0xb5ef7948


==EOF==

На RootRepeal ми дава да маркирам дялове само ако преди това съм сложил отметка на Files а ти каза да не слагам така че не ми се появява този прозорец

Редактирано 23 септември 200916 г. от daniel1995 (преглед на промените)

23 септември 200916 г.

Ясно.... за всеки случай ще поискам и нов лог от GMER, за да се уверя, че наистина няма проблем.

Стъпка 1:

Моля, отидете на Start --> Settings --> Control Panel --> Add or Remove Programs, и деинсталирайте следните програми (Ако присъстват в списъка):

Java™ 6 Update 6

Search Settings

Стъпка 2:

Изтеглете GMER Rootkit Scanner. Разархивирайте го на вашия десктоп.

Преди да сканирате се уверете, че всички останали работещи програми в момента са изключени и вашия антивирусен софтуер няма да предприема никакви действия по време на сканирането на Gmer. Не използвайте компютъра си, докато трае сканирането.

Преименувайте GMER.exe на Tool.exe и кликнете два пъти пъти върху Tool.exe , за да стартирате програмата.

Внимание: Сканирането може да доведе до грешки, затова не предприемайте никакви действия върху редовете маркирани с "<--- ROOKIT" без да съм Ви посочил да го направите.

Ако е открита активност на rootkit ще бъдете попитани дали желаете да бъде направено пълно сканиране на системата.

Изберете NO.
В десния панел ще видите какво е било проверено, нека всичко си остане така. Необходимо е само да се уверите, че пред "Show All" няма отметка.
Сега кликнете върху бутона Scan .

След като сканирането приключи е възможно да получите информация за друга rootkit активност.

Изберете OK .
Gmer ще Ви отвори лог файла. Кликнете на бутона Save... и в полето за име на файла, напишете Gmer.txt .
Запишете лог файла на вашия десктоп.

Стъпка 3:

Изтеглете ComboFix от някой от следните линкове:

Линк 1

Линк 2

* ВАЖНО !!! Запазете ComboFix.exe на вашия десктоп

Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

Преименувайте ComboFix.exe на Tool.exe

Стартирайте Tool.exe и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го копирайте и поставете в следващия Ви коментар в тази тема.

23 септември 200916 г.

Автор

Съжалявам за закъснението

ComboFix 09-09-22.03 - Agel Peltekov 23.09.2009 17:27.1.2 - NTFSx86

Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.2047.1499 [GMT 3:00]

Running from: c:\documents and settings\Agel Peltekov\Desktop\tool.exe

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.


c:\documents and settings\Agel Peltekov\Application Data\addons.dat

c:\windows\sslzdlt.dll

c:\windows\system32\winitn.dll


.

(((((((((((((((((((((((((   Files Created from 2009-08-23 to 2009-09-23  )))))))))))))))))))))))))))))))

.


2009-09-23 12:58 . 2009-09-23 12:58	--------	d-----w-	c:\program files\Trend Micro

2009-09-23 11:30 . 2009-09-23 11:30	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\Malwarebytes

2009-09-23 11:30 . 2009-09-23 13:09	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware

2009-09-23 11:30 . 2009-09-23 11:30	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-23 11:23 . 2009-09-23 11:23	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\PCToolsFirewallPlus

2009-09-23 11:23 . 2009-08-24 11:05	206256	----a-w-	c:\windows\system32\drivers\PCTCore.sys

2009-09-23 11:23 . 2009-08-19 08:01	86888	----a-w-	c:\windows\system32\drivers\PCTAppEvent.sys

2009-09-23 11:23 . 2009-08-27 06:17	229176	----a-w-	c:\windows\system32\drivers\pctgntdi.sys

2009-09-23 11:23 . 2009-09-23 11:23	--------	d-----w-	c:\program files\Common Files\PC Tools

2009-09-23 11:23 . 2009-08-14 09:44	32552	----a-w-	c:\windows\system32\drivers\pctNdis-DNS.sys

2009-09-23 11:23 . 2009-08-14 09:44	70280	----a-w-	c:\windows\system32\drivers\pctNdis-PacketFilter.sys

2009-09-23 11:23 . 2009-07-29 06:54	46592	----a-w-	c:\windows\system32\drivers\pctNdis.sys

2009-09-23 11:23 . 2009-08-14 09:44	114832	----a-w-	c:\windows\system32\drivers\pctplfw.sys

2009-09-23 11:23 . 2009-09-23 11:24	--------	d-----w-	c:\program files\PC Tools Firewall Plus

2009-09-16 08:21 . 2009-09-16 08:21	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee

2009-09-14 08:21 . 2009-09-14 08:21	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee Security Scan

2009-09-14 08:21 . 2009-09-14 08:21	--------	d-----w-	c:\program files\McAfee Security Scan

2009-09-14 08:20 . 2009-09-14 08:20	--------	d-----w-	c:\documents and settings\Agel Peltekov\Local Settings\Application Data\Macromedia

2009-09-14 08:17 . 2009-09-14 08:17	--------	d-----w-	c:\windows\system32\QuickTime

2009-09-14 08:17 . 2009-09-14 08:18	--------	d-----w-	c:\program files\Common Files\Macromedia

2009-09-14 08:17 . 2009-09-14 08:17	--------	d-----w-	c:\program files\Macromedia

2009-09-14 08:16 . 2009-09-14 08:16	--------	d-----w-	c:\windows\Downloaded Installations

2009-09-09 07:34 . 2009-06-21 21:44	153088	------w-	c:\windows\system32\dllcache\triedit.dll

2009-09-07 12:00 . 2009-09-07 12:00	--------	d-----w-	c:\windows\6FF543AB99B34120902C70A38314ABD8.TMP

2009-09-07 11:30 . 2009-09-07 11:30	--------	d-----w-	c:\documents and settings\Agel Peltekov\Local Settings\Application Data\Adobe

2009-09-02 14:51 . 2009-09-02 15:56	--------	d-----w-	c:\program files\Super Audio Converter

2009-09-02 13:28 . 2009-09-02 13:29	--------	d-----w-	c:\program files\Adobe Photoshop CS4

2009-09-02 10:26 . 2009-09-02 10:26	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\Corel

2009-09-02 10:15 . 1999-02-17 08:49	368912	----a-w-	c:\windows\system32\VBAR332.DLL

2009-09-02 10:15 . 1999-02-17 08:49	1039360	----a-w-	c:\windows\system32\MSJET35.DLL

2009-08-31 08:19 . 2009-08-31 08:19	--------	d-----w-	c:\program files\FreeTime

2009-08-26 12:54 . 2008-04-04 18:00	147456	----a-w-	c:\windows\system32\hpcpn5r1.dll

2009-08-25 09:13 . 2009-08-25 09:22	--------	d-----w-	c:\windows\SxsCaPendDel


.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-23 14:24 . 2009-02-09 15:44	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\Skype

2009-09-23 13:05 . 2009-02-09 15:45	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\skypePM

2009-09-23 12:34 . 2009-07-12 06:52	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP

2009-09-15 09:44 . 2009-02-07 18:24	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\uTorrent

2009-09-14 08:27 . 2009-02-09 08:11	--------	d-----w-	c:\documents and settings\All Users\Application Data\NOS

2009-09-09 11:22 . 2009-02-09 15:35	75608	----a-w-	c:\documents and settings\Agel Peltekov\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-09-07 10:31 . 2009-02-07 18:53	--------	d-----w-	c:\program files\Common Files\Adobe

2009-09-03 07:55 . 2009-02-07 18:00	--------	d-----w-	c:\program files\Windows Media Connect 2

2009-09-02 14:56 . 2009-07-12 06:52	--------	d-----w-	c:\program files\AoA DVD Ripper

2009-09-02 14:48 . 2009-03-18 14:28	--------	d-----w-	c:\program files\Witcobber

2009-09-02 10:14 . 2009-09-02 10:14	--------	d-----w-	c:\program files\Corel

2009-08-14 03:58 . 2009-09-23 11:23	7396	----a-w-	c:\windows\system32\drivers\pctcore.cat

2009-08-06 12:31 . 2009-02-13 15:30	--------	d-----w-	c:\program files\DVD Audio Extractor

2009-08-05 09:01 . 2008-04-14 04:42	204800	----a-w-	c:\windows\system32\mswebdvd.dll

2009-07-28 13:21 . 2009-02-07 18:19	--------	d-----w-	c:\program files\LClock

2009-07-17 19:01 . 2008-04-14 04:41	58880	----a-w-	c:\windows\system32\atl.dll

2009-07-13 20:43 . 2008-04-26 14:08	286208	----a-w-	c:\windows\system32\wmpdxm.dll

2009-07-12 06:53 . 2009-07-12 06:53	90112	----a-w-	c:\windows\system32\agsaami.dll

2009-07-12 06:53 . 2009-07-12 06:53	610304	----a-w-	c:\windows\system32\agsaamg.dll

2009-07-12 06:53 . 2009-07-12 06:53	372736	----a-w-	c:\windows\system32\agsaamc.dll

2009-07-12 06:53 . 2009-07-12 06:53	2535424	----a-w-	c:\windows\system32\agsaamj.dll

2009-06-29 16:23 . 2008-04-26 14:38	828928	----a-w-	c:\windows\system32\wininet.dll

2009-06-29 16:23 . 2008-04-26 14:37	78336	----a-w-	c:\windows\system32\ieencode.dll

2009-06-29 16:23 . 2008-04-26 14:37	17408	----a-w-	c:\windows\system32\corpol.dll

.


------- Sigcheck -------


[-] 2008-04-26 14:08 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"True Transparency"="c:\program files\Utilities\True Transparency\TrueTransparency.exe" [2007-10-28 133120]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-16 24264488]

"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe" [2009-06-05 468408]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-08-27 2971608]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-01-15 1657376]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"True Transparency"="c:\program files\Utilities\True Transparency\TrueTransparency.exe" [2007-10-28 133120]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ShowDeskFix"="shell32" [X]

"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-06-29 124928]


c:\documents and settings\All Users\Start Menu\Programs\Startup\

McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=


R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [23.9.2009 14:23 229176]

R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [23.9.2009 14:23 86888]

R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [07.2.2009 22:51 36864]

R3 PCTFW-DNS;PCTools Firewall - DNS driver;c:\windows\system32\drivers\pctNdis-DNS.sys [23.9.2009 14:23 32552]

R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [23.9.2009 14:23 70280]

R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [23.9.2009 14:23 46592]

R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [23.9.2009 14:23 114832]


--- Other Services/Drivers In Memory ---


*NewlyCreated* - PWTDQPOB

*NewlyCreated* - SRSERVICE

*Deregistered* - pwtdqpob


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12

.

Contents of the 'Scheduled Tasks' folder

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://mystart.incredimail.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

TCP: {889AA017-750E-4A46-8B36-CB91153A0B4D} = 212.39.90.42,212.39.90.43

FF - ProfilePath - c:\documents and settings\Agel Peltekov\Application Data\Mozilla\Firefox\Profiles\dg3z21by.default\

FF - prefs.js: browser.search.selectedEngine - MyStart Search

FF - prefs.js: browser.startup.homepage - hxxp://google.bg/

FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

- - - - ORPHANS REMOVED - - - -


HKLM-Run-UnlockerAssistant - c:\program files\Unlocker\UnlockerAssistant.exe

HKLM-Run-Malwarebytes Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe

HKU-Default-Run-LClock - c:\program files\LClock\LClock.exe

AddRemove-Quadro Racing_is1 - c:\documents and settings\Agel Peltekov\Desktop\FVR\ATV\unins000.exe




**************************************************************************


catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-23 17:30

Windows 5.1.2600 Service Pack 3 NTFS


scanning hidden processes ...  


scanning hidden autostart entries ... 


scanning hidden files ...  


scan completed successfully

hidden files: 0


**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------


[HKEY_USERS\S-1-5-21-1390067357-746137067-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\Clsid]

@Denied: (Full) (LocalSystem)

.

Completion time: 2009-09-23 17:31

ComboFix-quarantined-files.txt  2009-09-23 14:31


Pre-Run: 32 966 160 384 bytes free

Post-Run: 33 190 977 536 bytes free


168	--- E O F ---	2009-09-09 17:30

23 септември 200916 г.

Отворете Notepad и чрез комбинацията copy/paste поставете следния текст:

http://www.kaldata.com/forums/index.php?showtopic=136933&pid=1518939&st=0&#entry1518939


Killall::


Driver::

PWTDQPOB

pwtdqpob


Collect::

c:\windows\system32\agsaami.dll

c:\windows\system32\agsaamg.dll

c:\windows\system32\agsaamc.dll

c:\windows\system32\agsaamj.dll


DDS::

FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След като, програмата приключи ще Ви изведе лог файла. Отново чрез комбинацията от Copy/Paste поставете информацията тук.

23 септември 200916 г.

Автор

само рестартира компа да го направя ли отново?

23 септември 200916 г.

Не, вижте в C:\ файла на име combofix.txt . Ако го има, публикувайте съдържанието му. Ако се е получил някакъв проблем, би трябвало да генерира файла на име bug.txt . Който файл имате, неговото съдържание публикувайте

23 септември 200916 г.

Автор

Не, вижте в C:\ файла на име combofix.txt . Ако го има, публикувайте съдържанието му. Ако се е получил някакъв проблем, би трябвало да генерира файла на име bug.txt . Който файл имате, неговото съдържание публикувайте

Нищо няма ще опитам да го направя пак.

ComboFix 09-09-22.03 - Agel Peltekov 23.09.2009 19:46.2.2 - NTFSx86

Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.2047.1471 [GMT 3:00]

Running from: c:\documents and settings\Agel Peltekov\Desktop\tool.exe

Command switches used :: c:\documents and settings\Agel Peltekov\Desktop\CFScript.txt

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.


(((((((((((((((((((((((((   Files Created from 2009-08-23 to 2009-09-23  )))))))))))))))))))))))))))))))

.


2009-09-23 16:05 . 2009-09-23 16:05	--------	d-----w-	c:\windows\system32\xircom

2009-09-23 16:05 . 2009-09-23 16:05	--------	d-----w-	c:\windows\system32\wbem\snmp

2009-09-23 16:05 . 2009-09-23 16:05	--------	d-----w-	c:\program files\microsoft frontpage

2009-09-23 14:27 . 2009-09-23 14:31	--------	d-----w-	C:\tool

2009-09-23 12:58 . 2009-09-23 12:58	--------	d-----w-	c:\program files\Trend Micro

2009-09-23 11:30 . 2009-09-23 11:30	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\Malwarebytes

2009-09-23 11:30 . 2009-09-23 11:30	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-23 11:23 . 2009-09-23 11:23	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\PCToolsFirewallPlus

2009-09-23 11:23 . 2009-08-24 11:05	206256	----a-w-	c:\windows\system32\drivers\PCTCore.sys

2009-09-23 11:23 . 2009-08-19 08:01	86888	----a-w-	c:\windows\system32\drivers\PCTAppEvent.sys

2009-09-23 11:23 . 2009-08-27 06:17	229176	----a-w-	c:\windows\system32\drivers\pctgntdi.sys

2009-09-23 11:23 . 2009-09-23 11:23	--------	d-----w-	c:\program files\Common Files\PC Tools

2009-09-23 11:23 . 2009-08-14 09:44	32552	----a-w-	c:\windows\system32\drivers\pctNdis-DNS.sys

2009-09-23 11:23 . 2009-08-14 09:44	70280	----a-w-	c:\windows\system32\drivers\pctNdis-PacketFilter.sys

2009-09-23 11:23 . 2009-07-29 06:54	46592	----a-w-	c:\windows\system32\drivers\pctNdis.sys

2009-09-23 11:23 . 2009-08-14 09:44	114832	----a-w-	c:\windows\system32\drivers\pctplfw.sys

2009-09-23 11:23 . 2009-09-23 11:24	--------	d-----w-	c:\program files\PC Tools Firewall Plus

2009-09-16 08:21 . 2009-09-16 08:21	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee

2009-09-14 08:21 . 2009-09-14 08:21	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee Security Scan

2009-09-14 08:21 . 2009-09-14 08:21	--------	d-----w-	c:\program files\McAfee Security Scan

2009-09-14 08:20 . 2009-09-14 08:20	--------	d-----w-	c:\documents and settings\Agel Peltekov\Local Settings\Application Data\Macromedia

2009-09-14 08:17 . 2009-09-14 08:17	--------	d-----w-	c:\windows\system32\QuickTime

2009-09-14 08:17 . 2009-09-14 08:18	--------	d-----w-	c:\program files\Common Files\Macromedia

2009-09-14 08:17 . 2009-09-14 08:17	--------	d-----w-	c:\program files\Macromedia

2009-09-14 08:16 . 2009-09-14 08:16	--------	d-----w-	c:\windows\Downloaded Installations

2009-09-09 07:34 . 2009-06-21 21:44	153088	------w-	c:\windows\system32\dllcache\triedit.dll

2009-09-07 12:00 . 2009-09-07 12:00	--------	d-----w-	c:\windows\6FF543AB99B34120902C70A38314ABD8.TMP

2009-09-07 11:30 . 2009-09-07 11:30	--------	d-----w-	c:\documents and settings\Agel Peltekov\Local Settings\Application Data\Adobe

2009-09-02 14:51 . 2009-09-02 15:56	--------	d-----w-	c:\program files\Super Audio Converter

2009-09-02 13:28 . 2009-09-02 13:29	--------	d-----w-	c:\program files\Adobe Photoshop CS4

2009-09-02 10:26 . 2009-09-02 10:26	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\Corel

2009-09-02 10:15 . 1999-02-17 08:49	368912	----a-w-	c:\windows\system32\VBAR332.DLL

2009-09-02 10:15 . 1999-02-17 08:49	1039360	----a-w-	c:\windows\system32\MSJET35.DLL

2009-08-31 08:19 . 2009-08-31 08:19	--------	d-----w-	c:\program files\FreeTime

2009-08-26 12:54 . 2008-04-04 18:00	147456	----a-w-	c:\windows\system32\hpcpn5r1.dll

2009-08-25 09:13 . 2009-08-25 09:22	--------	d-----w-	c:\windows\SxsCaPendDel


.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-23 16:50 . 2009-07-12 06:52	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP

2009-09-23 16:42 . 2009-02-09 15:44	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\Skype

2009-09-23 13:05 . 2009-02-09 15:45	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\skypePM

2009-09-15 09:44 . 2009-02-07 18:24	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\uTorrent

2009-09-14 08:27 . 2009-02-09 08:11	--------	d-----w-	c:\documents and settings\All Users\Application Data\NOS

2009-09-09 11:22 . 2009-02-09 15:35	75608	----a-w-	c:\documents and settings\Agel Peltekov\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-09-07 10:31 . 2009-02-07 18:53	--------	d-----w-	c:\program files\Common Files\Adobe

2009-09-03 07:55 . 2009-02-07 18:00	--------	d-----w-	c:\program files\Windows Media Connect 2

2009-09-02 14:56 . 2009-07-12 06:52	--------	d-----w-	c:\program files\AoA DVD Ripper

2009-09-02 14:48 . 2009-03-18 14:28	--------	d-----w-	c:\program files\Witcobber

2009-09-02 10:14 . 2009-09-02 10:14	--------	d-----w-	c:\program files\Corel

2009-08-14 03:58 . 2009-09-23 11:23	7396	----a-w-	c:\windows\system32\drivers\pctcore.cat

2009-08-06 12:31 . 2009-02-13 15:30	--------	d-----w-	c:\program files\DVD Audio Extractor

2009-08-05 09:01 . 2008-04-14 04:42	204800	----a-w-	c:\windows\system32\mswebdvd.dll

2009-07-28 13:21 . 2009-02-07 18:19	--------	d-----w-	c:\program files\LClock

2009-07-17 19:01 . 2008-04-14 04:41	58880	----a-w-	c:\windows\system32\atl.dll

2009-07-13 20:43 . 2008-04-26 14:08	286208	----a-w-	c:\windows\system32\wmpdxm.dll

2009-07-12 06:53 . 2009-07-12 06:53	90112	----a-w-	c:\windows\system32\agsaami.dll

2009-07-12 06:53 . 2009-07-12 06:53	610304	----a-w-	c:\windows\system32\agsaamg.dll

2009-07-12 06:53 . 2009-07-12 06:53	372736	----a-w-	c:\windows\system32\agsaamc.dll

2009-07-12 06:53 . 2009-07-12 06:53	2535424	----a-w-	c:\windows\system32\agsaamj.dll

2009-06-29 16:23 . 2008-04-26 14:38	828928	------w-	c:\windows\system32\wininet.dll

2009-06-29 16:23 . 2008-04-26 14:37	78336	----a-w-	c:\windows\system32\ieencode.dll

2009-06-29 16:23 . 2008-04-26 14:37	17408	----a-w-	c:\windows\system32\corpol.dll

.


------- Sigcheck -------


[-] 2008-04-26 14:08 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll

.

(((((((((((((((((((((((((((((   SnapShot@2009-09-23_14.30.19   )))))))))))))))))))))))))))))))))))))))))

.

- 2001-08-23 12:00 . 2009-08-25 09:16	71196              c:\windows\system32\perfc009.dat

+ 2001-08-23 12:00 . 2009-09-23 16:09	71196              c:\windows\system32\perfc009.dat

+ 2001-08-23 12:00 . 2009-09-23 16:09	441260              c:\windows\system32\perfh009.dat

- 2001-08-23 12:00 . 2009-08-25 09:16	441260              c:\windows\system32\perfh009.dat

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"True Transparency"="c:\program files\Utilities\True Transparency\TrueTransparency.exe" [2007-10-28 133120]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-16 24264488]

"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe" [2009-06-05 468408]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-08-27 2971608]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-01-15 1657376]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"True Transparency"="c:\program files\Utilities\True Transparency\TrueTransparency.exe" [2007-10-28 133120]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ShowDeskFix"="shell32" [X]

"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-06-29 124928]


c:\documents and settings\All Users\Start Menu\Programs\Startup\

McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=


R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [23.9.2009 14:23 229176]

R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [23.9.2009 14:23 86888]

R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [07.2.2009 22:51 36864]

R3 PCTFW-DNS;PCTools Firewall - DNS driver;c:\windows\system32\drivers\pctNdis-DNS.sys [23.9.2009 14:23 32552]

R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [23.9.2009 14:23 70280]

R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [23.9.2009 14:23 46592]

S3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [23.9.2009 14:23 114832]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://mystart.incredimail.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

TCP: {889AA017-750E-4A46-8B36-CB91153A0B4D} = 212.39.90.42,212.39.90.43

FF - ProfilePath - c:\documents and settings\Agel Peltekov\Application Data\Mozilla\Firefox\Profiles\dg3z21by.default\

FF - prefs.js: browser.search.selectedEngine - MyStart Search

FF - prefs.js: browser.startup.homepage - hxxp://google.bg/

FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.


**************************************************************************


catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-23 19:50

Windows 5.1.2600 Service Pack 3 NTFS


scanning hidden processes ...  


scanning hidden autostart entries ... 


scanning hidden files ...  


scan completed successfully

hidden files: 0


**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------


[HKEY_USERS\S-1-5-21-1390067357-746137067-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\Clsid]

@Denied: (Full) (LocalSystem)

.

--------------------- DLLs Loaded Under Running Processes ---------------------


- - - - - - - > 'explorer.exe'(3600)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe

c:\windows\system32\rundll32.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe

c:\windows\ehome\ehRecvr.exe

c:\windows\ehome\ehSched.exe

c:\windows\system32\nvsvc32.exe

c:\program files\Microsoft Office\Office12\ONENOTEM.EXE

c:\program files\Styler\Styler.exe

c:\windows\ehome\mcrdsvc.exe

c:\windows\system32\dllhost.exe

c:\windows\system32\wscntfy.exe

c:\windows\ehome\ehmsas.exe

.

**************************************************************************

.

Completion time: 2009-09-23 19:52 - machine was rebooted

ComboFix-quarantined-files.txt  2009-09-23 16:52

ComboFix2.txt  2009-09-23 14:31


Pre-Run: 33 132 875 776 bytes free

Post-Run: 33 106 026 496 bytes free


189	--- E O F ---	2009-09-09 17:30

23 септември 200916 г.

Не се е получило, но нека направим нещо преди това.

Стъпка 1:

1) Изтеглете този файл: mspmsnsv.dll

2) Запазете го на вашия десктоп.

3) Влезте в Safe Mode:

За да влезете в Safe Mode , натискайте продължително F8 от клавиатурата докато компютъра се стартира преди логото на Windows да се е появило .
Ще се отвори Windows Advanced Menu с доста опции , откъдето изберете някое от "Safe ... " опциите , в случая Safe Mode

4) Копирайте и поставете изтегления файл в:

c:\windows\system32

По този начин ще заместите вашия инфектиран файл с този, чистия.

Стъпка 2:

Опитайте със скрипта отново.

23 септември 200916 г.

Автор

Когато натискам F8 ми излиза "Select Boot Device" и са ми избтоени CD USB FLOPPY и HDD след няколко рестарта от копчето :speak: успях да си избера Safe Mode ми излиза черен екран с надписи

disk()multi........... сещаш се надявам се и стоят така и не мърдат кфо да праа

23 септември 200916 г.

Винаги имам алтернативен вариант

Стъпка 1:

Изтеглете The Avenger от тук и го разархивирайте на вашия десктоп.

Стартирайте The Avenger и копирайте следния скрипт и го поставете в текстовото поле на програмата:

Drivers to disable:

PWTDQPOB

pwtdqpob


Drivers to delete:

PWTDQPOB

pwtdqpob


Files to delete:

c:\windows\system32\agsaami.dll

c:\windows\system32\agsaamg.dll

c:\windows\system32\agsaamc.dll

c:\windows\system32\agsaamj.dll

Накрая избери Execute и при въпрос от страна на програмата, посочи Yes. Така компютъра ще се рестартира. След рестартирането, копирайте и поставете тук, съдържанието на лог файла от програмата, намиращ се в C:\avenger.txt

Стъпка 2:

Изтрийте ръчно Tool.exe (ComboFix) и изтеглете ново копие. Следвайте инструкциите, които вече по-горе съм дал за ComboFix. Накрая публикувайте новия лог файл.

23 септември 200916 г.

Автор

//////////////////////////////////////////

  Avenger Pre-Processor log

//////////////////////////////////////////


Platform: Windows XP (build 2600, Service Pack 3)

Wed Sep 23 20:27:31 2009


20:27:31: Error: Invalid script.  A valid script must begin with a command directive.

Aborting execution!



//////////////////////////////////////////



//////////////////////////////////////////

  Avenger Pre-Processor log

//////////////////////////////////////////


Platform: Windows XP (build 2600, Service Pack 3)

Wed Sep 23 20:28:13 2009


20:28:13: Error: Invalid script.  A valid script must begin with a command directive.

Aborting execution!



//////////////////////////////////////////



Logfile of The Avenger Version 2.0, (c) by Swandog46

http://swandog46.geekstogo.com


Platform:  Windows XP


*******************


Script file opened successfully.

Script file read successfully.


Backups directory opened successfully at C:\Avenger


*******************


Beginning to process script file:


Rootkit scan active.

No rootkits found!



Error:  could not open driver "PWTDQPOB"

Disablement of driver "PWTDQPOB" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist



Error:  could not open driver "pwtdqpob"

Disablement of driver "pwtdqpob" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist



Error:  registry key "\Registry\Machine\System\CurrentControlSet\Services\PWTDQPOB" not found!

Deletion of driver "PWTDQPOB" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist



Error:  registry key "\Registry\Machine\System\CurrentControlSet\Services\pwtdqpob" not found!

Deletion of driver "pwtdqpob" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist


File "c:\windows\system32\agsaami.dll" deleted successfully.

File "c:\windows\system32\agsaamg.dll" deleted successfully.

File "c:\windows\system32\agsaamc.dll" deleted successfully.

File "c:\windows\system32\agsaamj.dll" deleted successfully.


Completed script processing.


*******************


Finished!  Terminate.

ComboFix 09-09-22.03 - Agel Peltekov 23.09.2009 20:36.3.2 - NTFSx86

Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.2047.1418 [GMT 3:00]

Running from: c:\documents and settings\Agel Peltekov\Desktop\tool.exe

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.


C:\cleanup.exe


.

(((((((((((((((((((((((((   Files Created from 2009-08-23 to 2009-09-23  )))))))))))))))))))))))))))))))

.


2009-09-23 17:28 . 2009-09-23 17:28	0	----a-w-	C:\backup.reg

2009-09-23 16:05 . 2009-09-23 16:05	--------	d-----w-	c:\windows\system32\xircom

2009-09-23 16:05 . 2009-09-23 16:05	--------	d-----w-	c:\windows\system32\wbem\snmp

2009-09-23 16:05 . 2009-09-23 16:05	--------	d-----w-	c:\program files\microsoft frontpage

2009-09-23 14:27 . 2009-09-23 14:31	--------	d-----w-	C:\tool

2009-09-23 12:58 . 2009-09-23 12:58	--------	d-----w-	c:\program files\Trend Micro

2009-09-23 11:30 . 2009-09-23 11:30	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\Malwarebytes

2009-09-23 11:30 . 2009-09-23 11:30	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-23 11:23 . 2009-09-23 11:23	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\PCToolsFirewallPlus

2009-09-23 11:23 . 2009-08-24 11:05	206256	----a-w-	c:\windows\system32\drivers\PCTCore.sys

2009-09-23 11:23 . 2009-08-19 08:01	86888	----a-w-	c:\windows\system32\drivers\PCTAppEvent.sys

2009-09-23 11:23 . 2009-08-27 06:17	229176	----a-w-	c:\windows\system32\drivers\pctgntdi.sys

2009-09-23 11:23 . 2009-09-23 11:23	--------	d-----w-	c:\program files\Common Files\PC Tools

2009-09-23 11:23 . 2009-08-14 09:44	32552	----a-w-	c:\windows\system32\drivers\pctNdis-DNS.sys

2009-09-23 11:23 . 2009-08-14 09:44	70280	----a-w-	c:\windows\system32\drivers\pctNdis-PacketFilter.sys

2009-09-23 11:23 . 2009-07-29 06:54	46592	----a-w-	c:\windows\system32\drivers\pctNdis.sys

2009-09-23 11:23 . 2009-08-14 09:44	114832	----a-w-	c:\windows\system32\drivers\pctplfw.sys

2009-09-23 11:23 . 2009-09-23 11:24	--------	d-----w-	c:\program files\PC Tools Firewall Plus

2009-09-16 08:21 . 2009-09-16 08:21	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee

2009-09-14 08:21 . 2009-09-14 08:21	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee Security Scan

2009-09-14 08:21 . 2009-09-14 08:21	--------	d-----w-	c:\program files\McAfee Security Scan

2009-09-14 08:20 . 2009-09-14 08:20	--------	d-----w-	c:\documents and settings\Agel Peltekov\Local Settings\Application Data\Macromedia

2009-09-14 08:17 . 2009-09-14 08:17	--------	d-----w-	c:\windows\system32\QuickTime

2009-09-14 08:17 . 2009-09-14 08:18	--------	d-----w-	c:\program files\Common Files\Macromedia

2009-09-14 08:17 . 2009-09-14 08:17	--------	d-----w-	c:\program files\Macromedia

2009-09-14 08:16 . 2009-09-14 08:16	--------	d-----w-	c:\windows\Downloaded Installations

2009-09-09 07:34 . 2009-06-21 21:44	153088	------w-	c:\windows\system32\dllcache\triedit.dll

2009-09-07 12:00 . 2009-09-07 12:00	--------	d-----w-	c:\windows\6FF543AB99B34120902C70A38314ABD8.TMP

2009-09-07 11:30 . 2009-09-07 11:30	--------	d-----w-	c:\documents and settings\Agel Peltekov\Local Settings\Application Data\Adobe

2009-09-02 14:51 . 2009-09-02 15:56	--------	d-----w-	c:\program files\Super Audio Converter

2009-09-02 13:28 . 2009-09-02 13:29	--------	d-----w-	c:\program files\Adobe Photoshop CS4

2009-09-02 10:26 . 2009-09-02 10:26	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\Corel

2009-09-02 10:15 . 1999-02-17 08:49	368912	----a-w-	c:\windows\system32\VBAR332.DLL

2009-09-02 10:15 . 1999-02-17 08:49	1039360	----a-w-	c:\windows\system32\MSJET35.DLL

2009-08-31 08:19 . 2009-08-31 08:19	--------	d-----w-	c:\program files\FreeTime

2009-08-26 12:54 . 2008-04-04 18:00	147456	----a-w-	c:\windows\system32\hpcpn5r1.dll

2009-08-25 09:13 . 2009-08-25 09:22	--------	d-----w-	c:\windows\SxsCaPendDel


.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-23 17:34 . 2009-02-09 15:44	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\Skype

2009-09-23 17:32 . 2009-07-12 06:52	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP

2009-09-23 13:05 . 2009-02-09 15:45	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\skypePM

2009-09-15 09:44 . 2009-02-07 18:24	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\uTorrent

2009-09-14 08:27 . 2009-02-09 08:11	--------	d-----w-	c:\documents and settings\All Users\Application Data\NOS

2009-09-09 11:22 . 2009-02-09 15:35	75608	----a-w-	c:\documents and settings\Agel Peltekov\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-09-07 10:31 . 2009-02-07 18:53	--------	d-----w-	c:\program files\Common Files\Adobe

2009-09-03 07:55 . 2009-02-07 18:00	--------	d-----w-	c:\program files\Windows Media Connect 2

2009-09-02 14:56 . 2009-07-12 06:52	--------	d-----w-	c:\program files\AoA DVD Ripper

2009-09-02 14:48 . 2009-03-18 14:28	--------	d-----w-	c:\program files\Witcobber

2009-09-02 10:14 . 2009-09-02 10:14	--------	d-----w-	c:\program files\Corel

2009-08-14 03:58 . 2009-09-23 11:23	7396	----a-w-	c:\windows\system32\drivers\pctcore.cat

2009-08-06 12:31 . 2009-02-13 15:30	--------	d-----w-	c:\program files\DVD Audio Extractor

2009-08-05 09:01 . 2008-04-14 04:42	204800	----a-w-	c:\windows\system32\mswebdvd.dll

2009-07-28 13:21 . 2009-02-07 18:19	--------	d-----w-	c:\program files\LClock

2009-07-17 19:01 . 2008-04-14 04:41	58880	----a-w-	c:\windows\system32\atl.dll

2009-07-13 20:43 . 2008-04-26 14:08	286208	----a-w-	c:\windows\system32\wmpdxm.dll

2009-06-29 16:23 . 2008-04-26 14:38	828928	------w-	c:\windows\system32\wininet.dll

2009-06-29 16:23 . 2008-04-26 14:37	78336	----a-w-	c:\windows\system32\ieencode.dll

2009-06-29 16:23 . 2008-04-26 14:37	17408	----a-w-	c:\windows\system32\corpol.dll

.


------- Sigcheck -------


[-] 2008-04-26 14:08 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll

.

(((((((((((((((((((((((((((((   SnapShot@2009-09-23_14.30.19   )))))))))))))))))))))))))))))))))))))))))

.

- 2001-08-23 12:00 . 2009-08-25 09:16	71196              c:\windows\system32\perfc009.dat

+ 2001-08-23 12:00 . 2009-09-23 16:09	71196              c:\windows\system32\perfc009.dat

+ 2001-08-23 12:00 . 2009-09-23 16:09	441260              c:\windows\system32\perfh009.dat

- 2001-08-23 12:00 . 2009-08-25 09:16	441260              c:\windows\system32\perfh009.dat

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"True Transparency"="c:\program files\Utilities\True Transparency\TrueTransparency.exe" [2007-10-28 133120]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-16 24264488]

"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe" [2009-06-05 468408]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-08-27 2971608]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-01-15 1657376]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"True Transparency"="c:\program files\Utilities\True Transparency\TrueTransparency.exe" [2007-10-28 133120]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ShowDeskFix"="shell32" [X]

"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-06-29 124928]


c:\documents and settings\All Users\Start Menu\Programs\Startup\

McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=


R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [23.9.2009 14:23 229176]

R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [23.9.2009 14:23 86888]

R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [07.2.2009 22:51 36864]

R3 PCTFW-DNS;PCTools Firewall - DNS driver;c:\windows\system32\drivers\pctNdis-DNS.sys [23.9.2009 14:23 32552]

R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [23.9.2009 14:23 70280]

R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [23.9.2009 14:23 46592]

R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [23.9.2009 14:23 114832]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://mystart.incredimail.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

TCP: {889AA017-750E-4A46-8B36-CB91153A0B4D} = 212.39.90.42,212.39.90.43

FF - ProfilePath - c:\documents and settings\Agel Peltekov\Application Data\Mozilla\Firefox\Profiles\dg3z21by.default\

FF - prefs.js: browser.search.selectedEngine - MyStart Search

FF - prefs.js: browser.startup.homepage - hxxp://google.bg/

FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.


**************************************************************************


catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-23 20:38

Windows 5.1.2600 Service Pack 3 NTFS


scanning hidden processes ...  


scanning hidden autostart entries ... 


scanning hidden files ...  


scan completed successfully

hidden files: 0


**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------


[HKEY_USERS\S-1-5-21-1390067357-746137067-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\Clsid]

@Denied: (Full) (LocalSystem)

.

Completion time: 2009-09-23 20:39

ComboFix-quarantined-files.txt  2009-09-23 17:39

ComboFix2.txt  2009-09-23 16:52

ComboFix3.txt  2009-09-23 14:31


Pre-Run: 33 111 085 056 bytes free

Post-Run: 33 105 481 728 bytes free


165	--- E O F ---	2009-09-09 17:30

23 септември 200916 г.

Това е добре. Заместихте ли вашия mspmsnsv.dll с този, който Ви дадох?

1

23 септември 200916 г.

Автор

Неможах да влезна през Safe Mode както казах по-горе да го заместя ли в нормален режим или отново имаш алтернативен вариант

23 септември 200916 г.

Разбира се!

Изтеглете по-горе посочения файл и го запазете в диск C:\ . След това:

Отворете Notepad и чрез комбинацията copy/paste поставете следния текст:

Killall::


FMove::

C:\mspmsnsv.dll | c:\windows\system32\mspmsnsv.dll

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След като, програмата приключи ще Ви изведе лог файла. Отново чрез комбинацията от Copy/Paste поставете информацията тук.

1

23 септември 200916 г.

Автор

Изтеглете по-горе посочения файл и го запазете в диск C:\ . След това:

Кой файл?

Схванах

Редактирано 23 септември 200916 г. от daniel1995 (преглед на промените)

23 септември 200916 г.

Ето този:

http://rapidshare.com/files/283999834/mspmsnsv.dll.html

1

23 септември 200916 г.

Автор

ComboFix 09-09-22.03 - Agel Peltekov 23.09.2009 21:07.4.2 - NTFSx86

Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.2047.1490 [GMT 3:00]

Running from: c:\documents and settings\Agel Peltekov\Desktop\tool.exe

Command switches used :: c:\documents and settings\Agel Peltekov\Desktop\CFScript.txt

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.


.

--------------- FMove ---------------


c:\mspmsnsv.dll --> c:\windows\system32\mspmsnsv.dll

.

(((((((((((((((((((((((((   Files Created from 2009-08-23 to 2009-09-23  )))))))))))))))))))))))))))))))

.


2009-09-23 17:35 . 2009-09-23 17:39	--------	d-----w-	C:\tool5524t

2009-09-23 17:28 . 2009-09-23 17:28	0	----a-w-	C:\backup.reg

2009-09-23 16:05 . 2009-09-23 16:05	--------	d-----w-	c:\windows\system32\xircom

2009-09-23 16:05 . 2009-09-23 16:05	--------	d-----w-	c:\windows\system32\wbem\snmp

2009-09-23 16:05 . 2009-09-23 16:05	--------	d-----w-	c:\program files\microsoft frontpage

2009-09-23 14:27 . 2009-09-23 14:31	--------	d-----w-	C:\tool

2009-09-23 12:58 . 2009-09-23 12:58	--------	d-----w-	c:\program files\Trend Micro

2009-09-23 11:30 . 2009-09-23 11:30	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\Malwarebytes

2009-09-23 11:30 . 2009-09-23 11:30	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-23 11:23 . 2009-09-23 11:23	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\PCToolsFirewallPlus

2009-09-23 11:23 . 2009-08-24 11:05	206256	----a-w-	c:\windows\system32\drivers\PCTCore.sys

2009-09-23 11:23 . 2009-08-19 08:01	86888	----a-w-	c:\windows\system32\drivers\PCTAppEvent.sys

2009-09-23 11:23 . 2009-08-27 06:17	229176	----a-w-	c:\windows\system32\drivers\pctgntdi.sys

2009-09-23 11:23 . 2009-09-23 11:23	--------	d-----w-	c:\program files\Common Files\PC Tools

2009-09-23 11:23 . 2009-08-14 09:44	32552	----a-w-	c:\windows\system32\drivers\pctNdis-DNS.sys

2009-09-23 11:23 . 2009-08-14 09:44	70280	----a-w-	c:\windows\system32\drivers\pctNdis-PacketFilter.sys

2009-09-23 11:23 . 2009-07-29 06:54	46592	----a-w-	c:\windows\system32\drivers\pctNdis.sys

2009-09-23 11:23 . 2009-08-14 09:44	114832	----a-w-	c:\windows\system32\drivers\pctplfw.sys

2009-09-23 11:23 . 2009-09-23 11:24	--------	d-----w-	c:\program files\PC Tools Firewall Plus

2009-09-16 08:21 . 2009-09-16 08:21	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee

2009-09-14 08:21 . 2009-09-14 08:21	--------	d-----w-	c:\documents and settings\All Users\Application Data\McAfee Security Scan

2009-09-14 08:21 . 2009-09-14 08:21	--------	d-----w-	c:\program files\McAfee Security Scan

2009-09-14 08:20 . 2009-09-14 08:20	--------	d-----w-	c:\documents and settings\Agel Peltekov\Local Settings\Application Data\Macromedia

2009-09-14 08:17 . 2009-09-14 08:17	--------	d-----w-	c:\windows\system32\QuickTime

2009-09-14 08:17 . 2009-09-14 08:18	--------	d-----w-	c:\program files\Common Files\Macromedia

2009-09-14 08:17 . 2009-09-14 08:17	--------	d-----w-	c:\program files\Macromedia

2009-09-14 08:16 . 2009-09-14 08:16	--------	d-----w-	c:\windows\Downloaded Installations

2009-09-09 07:34 . 2009-06-21 21:44	153088	------w-	c:\windows\system32\dllcache\triedit.dll

2009-09-07 12:00 . 2009-09-07 12:00	--------	d-----w-	c:\windows\6FF543AB99B34120902C70A38314ABD8.TMP

2009-09-07 11:30 . 2009-09-07 11:30	--------	d-----w-	c:\documents and settings\Agel Peltekov\Local Settings\Application Data\Adobe

2009-09-02 14:51 . 2009-09-02 15:56	--------	d-----w-	c:\program files\Super Audio Converter

2009-09-02 13:28 . 2009-09-02 13:29	--------	d-----w-	c:\program files\Adobe Photoshop CS4

2009-09-02 10:26 . 2009-09-02 10:26	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\Corel

2009-09-02 10:15 . 1999-02-17 08:49	368912	----a-w-	c:\windows\system32\VBAR332.DLL

2009-09-02 10:15 . 1999-02-17 08:49	1039360	----a-w-	c:\windows\system32\MSJET35.DLL

2009-08-31 08:19 . 2009-08-31 08:19	--------	d-----w-	c:\program files\FreeTime

2009-08-26 12:54 . 2008-04-04 18:00	147456	----a-w-	c:\windows\system32\hpcpn5r1.dll

2009-08-25 09:13 . 2009-08-25 09:22	--------	d-----w-	c:\windows\SxsCaPendDel


.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-23 18:12 . 2009-02-09 15:44	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\Skype

2009-09-23 18:11 . 2009-07-12 06:52	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP

2009-09-23 17:59 . 2008-04-26 14:08	27136	----a-w-	c:\windows\system32\mspmsnsv.dll

2009-09-23 17:44 . 2009-02-07 18:00	--------	d-----w-	c:\program files\Styler

2009-09-23 13:05 . 2009-02-09 15:45	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\skypePM

2009-09-15 09:44 . 2009-02-07 18:24	--------	d-----w-	c:\documents and settings\Agel Peltekov\Application Data\uTorrent

2009-09-14 08:27 . 2009-02-09 08:11	--------	d-----w-	c:\documents and settings\All Users\Application Data\NOS

2009-09-09 11:22 . 2009-02-09 15:35	75608	----a-w-	c:\documents and settings\Agel Peltekov\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-09-07 10:31 . 2009-02-07 18:53	--------	d-----w-	c:\program files\Common Files\Adobe

2009-09-03 07:55 . 2009-02-07 18:00	--------	d-----w-	c:\program files\Windows Media Connect 2

2009-09-02 14:56 . 2009-07-12 06:52	--------	d-----w-	c:\program files\AoA DVD Ripper

2009-09-02 14:48 . 2009-03-18 14:28	--------	d-----w-	c:\program files\Witcobber

2009-09-02 10:14 . 2009-09-02 10:14	--------	d-----w-	c:\program files\Corel

2009-08-14 03:58 . 2009-09-23 11:23	7396	----a-w-	c:\windows\system32\drivers\pctcore.cat

2009-08-06 12:31 . 2009-02-13 15:30	--------	d-----w-	c:\program files\DVD Audio Extractor

2009-08-05 09:01 . 2008-04-14 04:42	204800	----a-w-	c:\windows\system32\mswebdvd.dll

2009-07-28 13:21 . 2009-02-07 18:19	--------	d-----w-	c:\program files\LClock

2009-07-17 19:01 . 2008-04-14 04:41	58880	----a-w-	c:\windows\system32\atl.dll

2009-07-13 20:43 . 2008-04-26 14:08	286208	----a-w-	c:\windows\system32\wmpdxm.dll

2009-06-29 16:23 . 2008-04-26 14:38	828928	------w-	c:\windows\system32\wininet.dll

2009-06-29 16:23 . 2008-04-26 14:37	78336	----a-w-	c:\windows\system32\ieencode.dll

2009-06-29 16:23 . 2008-04-26 14:37	17408	----a-w-	c:\windows\system32\corpol.dll

.


------- Sigcheck -------


[-] 2009-09-23 17:59 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll

.

(((((((((((((((((((((((((((((   SnapShot@2009-09-23_14.30.19   )))))))))))))))))))))))))))))))))))))))))

.

- 2001-08-23 12:00 . 2009-08-25 09:16	71196              c:\windows\system32\perfc009.dat

+ 2001-08-23 12:00 . 2009-09-23 16:09	71196              c:\windows\system32\perfc009.dat

+ 2001-08-23 12:00 . 2009-09-23 16:09	441260              c:\windows\system32\perfh009.dat

- 2001-08-23 12:00 . 2009-08-25 09:16	441260              c:\windows\system32\perfh009.dat

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"True Transparency"="c:\program files\Utilities\True Transparency\TrueTransparency.exe" [2007-10-28 133120]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-16 24264488]

"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe" [2009-06-05 468408]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-08-27 2971608]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-01-15 1657376]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"True Transparency"="c:\program files\Utilities\True Transparency\TrueTransparency.exe" [2007-10-28 133120]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ShowDeskFix"="shell32" [X]

"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-06-29 124928]


c:\documents and settings\All Users\Start Menu\Programs\Startup\

McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=


R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [23.9.2009 14:23 229176]

R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [23.9.2009 14:23 86888]

R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [07.2.2009 22:51 36864]

R3 PCTFW-DNS;PCTools Firewall - DNS driver;c:\windows\system32\drivers\pctNdis-DNS.sys [23.9.2009 14:23 32552]

R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [23.9.2009 14:23 70280]

R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [23.9.2009 14:23 46592]

R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [23.9.2009 14:23 114832]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://mystart.incredimail.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

TCP: {889AA017-750E-4A46-8B36-CB91153A0B4D} = 212.39.90.42,212.39.90.43

FF - ProfilePath - c:\documents and settings\Agel Peltekov\Application Data\Mozilla\Firefox\Profiles\dg3z21by.default\

FF - prefs.js: browser.search.selectedEngine - MyStart Search

FF - prefs.js: browser.startup.homepage - hxxp://google.bg/

FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.


**************************************************************************


catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-23 21:11

Windows 5.1.2600 Service Pack 3 NTFS


scanning hidden processes ...  


scanning hidden autostart entries ... 


scanning hidden files ...  


scan completed successfully

hidden files: 0


**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------


[HKEY_USERS\S-1-5-21-1390067357-746137067-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\Clsid]

@Denied: (Full) (LocalSystem)

.

--------------------- DLLs Loaded Under Running Processes ---------------------


- - - - - - - > 'explorer.exe'(3808)

c:\windows\system32\WININET.dll

c:\program files\Utilities\True Transparency\TrueTransparencyHook.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe

c:\windows\system32\rundll32.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe

c:\windows\ehome\ehRecvr.exe

c:\windows\ehome\ehSched.exe

c:\program files\Microsoft Office\Office12\ONENOTEM.EXE

c:\windows\system32\nvsvc32.exe

c:\program files\PC Tools Firewall Plus\FWService.exe

c:\windows\ehome\mcrdsvc.exe

c:\windows\ehome\ehmsas.exe

c:\windows\system32\dllhost.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-09-23 21:13 - machine was rebooted

ComboFix-quarantined-files.txt  2009-09-23 18:13

ComboFix2.txt  2009-09-23 17:39

ComboFix3.txt  2009-09-23 16:52

ComboFix4.txt  2009-09-23 14:31


Pre-Run: 33 101 680 640 bytes free

Post-Run: 33 064 886 272 bytes free


199	--- E O F ---	2009-09-09 17:30

Сега трябва да стана от този компютър довечера ще влезна от къщи. Напиши ми пост ако сме приключили ако не утре ще довършим. Чао за днес и мерси за омощта.

23 септември 200916 г.

Архивирайте папката Qoobox, която се намира в C:\ и я качете в www.rapidshare.com . Накрая пуснете линк за изтегляне. Освен това, напишете и как чувствате системата в момента.

24 септември 200916 г.

Автор

Qoobox Мисля че е малко по-бърза системата но имам един проблем който ще опиша в следващия си пост

Ето го и проблема

Ето това се показва като влезна в сайта през Firefox така е откакто изчистих с ATF Cleaner другите сайтове също имат някой проблеми но при IE всички си е както трябва

Редактирано 24 септември 200916 г. от daniel1995 (преглед на промените)

24 септември 200916 г.

Това е добре, но ето нещо и за финал. Относно проблема Ви, аз го имам същия при Opera и Firefox без да съм ползвал ATF-Cleaner. Накрая отнесете проблема си към отдел Софтуер, там биха могли да Ви помогнат с нещо. Аз от моя страна Ви препоръчвам да се уверите, че използвате актуална версия на Firefox и Adobe Flash Player. Това е втория подобен проблем с програма и затова възнамерявам временно да я махна от списъка с програми.

Стъпка 1:

За да деинсталирате ComboFix и всички резервни копия на файлове, които той премахва:

* Кликнете върху бутона Start и изберете Run
* Въведете ComboFix /u в полето и изберете OK

Бележка: Забележете, че има разстояние между ComboFix и /u, което задължително трябва да има.

Тази процедура ще:

Изтрие следното:

ComboFix и всички свързани с нея файлове и папки.
Backup на VundoFix (ако съществува).
Папката Deckard (ако съществува).
Папката _OtMoveIt (ако съществува).
Нулира настройките на часовника.
Скрива файлови разширения, ако е необходимо.
Скрива системни файлове, ако е необходимо.
Нулира

System Restore

.

Стъпка 2:

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

Remove found threats
Scan archives
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth technology

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост тук.

24 септември 200916 г.

Автор

А защо от вчера като влезна в My Network Places и не ми излиза нищо, а там имам много важна информация която ми трябва.

24 септември 200916 г.

Нито аз, нито програмите са правили нещо там. Нали имаш представа какво има в тази папка? За какви важни неща става въпрос? Ако искаш преразгледай логовете и ще видиш, че нищо не е барано.

24 септември 200916 г.

Автор

Добре но от вчера е така имам много важно документи които ми трябват още днес най-късно утре. След малко като приключи сканирането ще дам лога.

ПС: Network Places тръгна

Ето и лога

ESETSmartInstaller@High as downloader log:

all ok

# version=6

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6050

# api_version=3.0.2

# EOSSerial=048d0eaf4150dc41b2222c0609327cf9

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2009-09-24 11:53:53

# local_time=2009-09-24 02:53:53 (+0200, FLE Daylight Time)

# country="Bulgaria"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=1793 37 100 100 891019062500

# scanned=83157

# found=9

# cleaned=9

# scan_time=2965

C:\Documents and Settings\Agel Peltekov\7zS29B3.tmp\unlocker1.8.6.exe	a variant of Win32/Adware.ADON application (deleted - quarantined)	00000000000000000000000000000000	C

C:\Documents and Settings\Agel Peltekov\Application Data\Desktopicon\eBayShortcuts.exe	a variant of Win32/Adware.ADON application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C

C:\Documents and Settings\Default User\7zS29B3.tmp\unlocker1.8.6.exe	a variant of Win32/Adware.ADON application (deleted - quarantined)	00000000000000000000000000000000	C

C:\Documents and Settings\Default User\Application Data\Desktopicon\eBayShortcuts.exe	a variant of Win32/Adware.ADON application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C

C:\Documents and Settings\Guest\7zS29B3.tmp\unlocker1.8.6.exe	a variant of Win32/Adware.ADON application (deleted - quarantined)	00000000000000000000000000000000	C

C:\Documents and Settings\Guest\Application Data\Desktopicon\eBayShortcuts.exe	a variant of Win32/Adware.ADON application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C

C:\Program Files\Unlocker\eBay_shortcuts_1016.exe	a variant of Win32/Adware.ADON application (deleted - quarantined)	00000000000000000000000000000000	C

C:\WINDOWS\system32\config\systemprofile\7zS29B3.tmp\unlocker1.8.6.exe	a variant of Win32/Adware.ADON application (deleted - quarantined)	00000000000000000000000000000000	C

C:\WINDOWS\system32\config\systemprofile\Application Data\Desktopicon\eBayShortcuts.exe	a variant of Win32/Adware.ADON application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C

Редактирано 24 септември 200916 г. от daniel1995 (преглед на промените)

Добре дошли!

Системата ми е инфектирана [Решен]

Featured Replies

Регистрирайте се или влезете в профила си за да коментирате

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)