Стартирайте OTL.exe .

Под Custom Scans/Fixes поставете следния скрипт:

:Processes

explorer.exe


:files

C:\WINDOWS\System32\Drivers\3d0u04ym.sys

C:\WINDOWS\System32\Drivers\uzm3mtq4.sys

C:\WINDOWS\System32\DRIVERS\70309843.sys


:COMMANDS

[emptytemp]

[start explorer]

[Reboot]

След това, избери Run Fix . След това, публикувайте съдържанието на OTL2.txt

All processes killed

Error: Unable to interpret <:Processesexplorer.exe:filesC:\WINDOWS\System32\Drivers\3d0u04ym.sysC:\WINDOWS\System32\Drivers\uzm3mtq4.sysC:\WINDOWS\System32\DRIVERS\70309843.sys:COMMANDS[emptytemp][start explorer][Reboot]> in the current context!

OTL by OldTimer - Version 3.0.14.0 log created on 09272009_170918

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

СИН ЕКРАН С ТАЗИ ГРЕШКА ОТ ЛОГА.........!

Опитай така:

:files

C:\WINDOWS\System32\Drivers\3d0u04ym.sys

C:\WINDOWS\System32\Drivers\uzm3mtq4.sys

C:\WINDOWS\System32\DRIVERS\70309843.sys


:COMMANDS

[emptytemp]

[start explorer]

[Reboot]

Опитай така:

:files

C:\WINDOWS\System32\Drivers\3d0u04ym.sys

C:\WINDOWS\System32\Drivers\uzm3mtq4.sys

C:\WINDOWS\System32\DRIVERS\70309843.sys


:COMMANDS

[emptytemp]

[start explorer]

[Reboot]

All processes killed

========== FILES ==========

C:\WINDOWS\System32\Drivers\3d0u04ym.sys moved successfully.

C:\WINDOWS\System32\Drivers\uzm3mtq4.sys moved successfully.

C:\WINDOWS\System32\DRIVERS\70309843.sys moved successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: Hristo Tonev

->Temp folder emptied: 230418 bytes

->Temporary Internet Files folder emptied: 2930227 bytes

->Opera cache emptied: 24860734 bytes

User: LocalService

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.

->Temp folder emptied: 65748 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_3ac.dat scheduled to be deleted on reboot.

Windows Temp folder emptied: 49152 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 26,86 mb

OTL by OldTimer - Version 3.0.14.0 log created on 09272009_172441

Files\Folders moved on Reboot...

File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.

C:\WINDOWS\temp\Perflib_Perfdata_3ac.dat moved successfully.

Registry entries deleted on Reboot...

Пак със син екран....

Браво!

Пусни отново ComboFix, следвайки инструкциите, които вече ти дадох.

ComboFix 09-09-25.01 - Hristo Tonev 09.2009 г. 17:38.3.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.495.216 [GMT 3:00]

Running from: c:\documents and settings\Hristo Tonev\Desktop\tool.exe

AV: avast! antivirus 4.8.1351 [VPS 090926-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2009-08-27 to 2009-09-27 )))))))))))))))))))))))))))))))

.

2009-09-27 14:09 . 2009-09-27 14:09 -------- d-----w- C:\_OTL

2009-09-27 10:08 . 2009-09-27 10:30 -------- d--h--w- c:\windows\$hf_mig$

2009-09-27 09:04 . 2009-09-27 09:11 -------- d-----w- C:\tool

2009-09-19 08:52 . 2009-09-27 14:09 574240800 --sha-w- c:\windows\system32\drivers\fidbox.dat

2009-09-19 08:46 . 2009-09-19 08:46 -------- d-----w- c:\documents and settings\Administrator\Application Data\PCToolsFirewallPlus

2009-09-06 19:12 . 2009-09-14 12:36 -------- d-----w- C:\Temp

2009-09-06 19:12 . 2009-09-06 19:12 -------- d-----w- c:\temp\_Patche

2009-09-06 19:12 . 2009-09-06 19:12 -------- d-----w- c:\temp\_Log

2009-09-06 13:39 . 2009-08-17 16:04 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2009-09-06 13:39 . 2009-08-17 16:04 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2009-09-06 13:39 . 2009-08-17 16:03 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2009-09-06 13:39 . 2009-08-17 16:02 97480 ----a-w- c:\windows\system32\AvastSS.scr

2009-09-06 13:39 . 2009-08-17 16:06 93392 ----a-w- c:\windows\system32\drivers\aswmon.sys

2009-09-06 13:39 . 2009-08-17 16:06 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2009-09-06 13:39 . 2009-08-17 16:05 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys

2009-09-06 13:39 . 2009-08-17 16:05 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2009-09-06 13:38 . 2009-08-17 16:10 1279456 ----a-w- c:\windows\system32\aswBoot.exe

2009-09-06 13:38 . 2009-09-06 13:38 -------- d-----w- c:\program files\Alwil Software

2009-09-06 11:44 . 2009-08-14 09:44 32552 ----a-w- c:\windows\system32\drivers\pctNdis-DNS.sys

2009-09-06 11:44 . 2009-08-14 09:44 70280 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.sys

2009-09-06 11:44 . 2009-07-29 06:54 46592 ----a-w- c:\windows\system32\drivers\pctNdis.sys

2009-09-06 09:13 . 2009-09-06 09:13 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-09-06 08:42 . 2009-09-06 08:42 -------- d-----w- c:\program files\CCleaner

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-27 14:27 . 2009-08-15 11:46 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-09-27 13:07 . 2009-09-19 08:52 6713288 --sha-w- c:\windows\system32\drivers\fidbox.idx

2009-09-22 21:30 . 2009-03-02 08:11 -------- d-----w- c:\documents and settings\Hristo Tonev\Application Data\Skype

2009-09-22 21:09 . 2009-03-02 08:12 -------- d-----w- c:\documents and settings\Hristo Tonev\Application Data\skypePM

2009-09-19 21:42 . 2009-04-25 15:11 -------- d-----w- c:\program files\SUPERAntiSpyware

2009-09-14 09:06 . 2009-04-21 11:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-09-10 11:54 . 2009-04-21 11:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-09-10 11:53 . 2009-04-21 11:22 19160 -c--a-w- c:\windows\system32\drivers\mbam.sys

2009-09-06 11:47 . 2009-08-15 11:45 -------- d-----w- c:\program files\PC Tools Firewall Plus

2009-09-06 11:47 . 2009-08-15 11:48 -------- d-----w- c:\documents and settings\Hristo Tonev\Application Data\PCToolsFirewallPlus

2009-09-06 09:14 . 2009-04-25 15:11 -------- d-----w- c:\documents and settings\Hristo Tonev\Application Data\SUPERAntiSpyware.com

2009-08-27 06:17 . 2009-08-15 11:46 229176 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2009-08-24 11:05 . 2009-08-15 11:46 206256 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2009-08-19 08:01 . 2009-08-15 11:46 86888 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2009-08-15 11:46 . 2009-08-15 11:46 -------- d-----w- c:\program files\Common Files\PC Tools

2009-08-14 09:44 . 2009-08-15 11:46 114832 ----a-w- c:\windows\system32\drivers\pctplfw.sys

2009-08-14 03:58 . 2009-09-06 11:44 7396 ----a-w- c:\windows\system32\drivers\pctcore.cat

2009-08-09 16:08 . 2009-08-09 15:24 -------- d-----w- c:\program files\Panda USB Vaccine

2009-08-03 15:28 . 2009-08-03 15:28 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2009-08-03 15:25 . 2009-08-03 15:25 63904 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-07-03 13:57 . 2009-07-03 13:57 720896 ----a-w- c:\windows\iun6002.exe

.

((((((((((((((((((((((((((((( SnapShot@2009-09-27_09.09.00 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-09-27 14:26 . 2009-09-27 14:26 16384 c:\windows\Temp\Perflib_Perfdata_39c.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]

"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]

"ComWin-Frame"="c:\program files\Siemens\ComWin\ComWinSvr.exe" [2003-12-11 322048]

"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-08-27 2971608]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

SAGEM Wi-Fi 11g USB adapter LAN Utility.lnk - c:\program files\SAGEM Wi-Fi 11g USB adapter LAN Utility\WLANUTL.exe [2009-2-19 835584]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^EDUP WLan Utility.lnk]

backup=c:\windows\pss\EDUP WLan Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe"

"InCD"=c:\program files\Ahead\InCD\InCD.exe

"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe

"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe"

"SoundMAXPnP"=c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe

"SoundMAX"="c:\program files\Analog Devices\SoundMAX\smax4.exe" /tray

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"FirewallOverride"=dword:00000001

"AntiVirusOverride"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [9/6/2009 4:39 PM 114768]

R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [8/15/2009 2:46 PM 229176]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [3/23/2009 2:07 PM 9968]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [9/4/2009 2:49 PM 74480]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [9/6/2009 4:39 PM 20560]

R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [8/15/2009 2:46 PM 86888]

R3 PCTFW-DNS;PCTools Firewall - DNS driver;c:\windows\system32\drivers\pctNdis-DNS.sys [9/6/2009 2:44 PM 32552]

R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [9/6/2009 2:44 PM 70280]

R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [9/6/2009 2:44 PM 46592]

R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [8/15/2009 2:46 PM 114832]

R3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;c:\windows\system32\drivers\WlanUZXP.sys [2/19/2009 6:48 PM 260608]

S0 3d0u04ym;Vba32 Armour Driver;c:\windows\system32\Drivers\3d0u04ym.sys --> c:\windows\system32\Drivers\3d0u04ym.sys [?]

S1 is-6DQ60drv;is-6DQ60drv;c:\windows\system32\DRIVERS\70309843.sys --> c:\windows\system32\DRIVERS\70309843.sys [?]

S1 uzm3mtq4;AVZ-RK Kernel Driver;\??\c:\windows\system32\Drivers\uzm3mtq4.sys --> c:\windows\system32\Drivers\uzm3mtq4.sys [?]

S3 CH341SER;CH341SER;c:\windows\system32\Drivers\CH341SER.SYS --> c:\windows\system32\Drivers\CH341SER.SYS [?]

S3 esihdrv;esihdrv;\??\c:\docume~1\HRISTO~1\LOCALS~1\Temp\esihdrv.sys --> c:\docume~1\HRISTO~1\LOCALS~1\Temp\esihdrv.sys [?]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [5/28/2007 10:29 AM 20856]

S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [3/23/2009 2:07 PM 7408]

S3 ZD1211BU(EDUP);EDUP IEEE 802.11 b+g Wireless LAN Driver (USB)(EDUP);c:\windows\system32\drivers\ZD1211BU.sys [2/23/2009 1:32 PM 477696]

S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\System32\ZDCndis5.SYS --> c:\windows\System32\ZDCndis5.SYS [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-09-27 c:\windows\Tasks\PandaUSBVaccine.job

- c:\program files\Panda USB Vaccine\RunInteractiveWin.exe [2009-08-09 09:30]

.

.

------- Supplementary Scan -------

.

uStart Page = about:blank

uDefault_Search_URL =

mStart Page = about:blank

mSearch Bar =

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

DPF: DirectAnimation Java Classes

DPF: Microsoft XML Parser for Java

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-27 17:41

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]

"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1516)

c:\windows\system32\webcheck.dll

c:\windows\system32\IEFRAME.dll

c:\windows\system32\OneX.DLL

c:\windows\system32\eappprxy.dll

.

Completion time: 2009-09-27 17:43

ComboFix-quarantined-files.txt 2009-09-27 14:43

ComboFix2.txt 2009-09-27 09:11

Pre-Run: 12 809 498 624 bytes free

Post-Run: 12 782 120 960 bytes free

160 --- E O F --- 2009-09-27 10:08

Как е положението сега?

Видимия проблем го няма ....системата е ок.....в общи линии СУПЕР ДОБРА РАБОТА.....сега ако махнем и всичко което качихме ,логове ,папки.....нещата ще са още по супер

браво!!!!!!

Редактирано 27 септември 200916 г. от icotonev (преглед на промените)

Сега, това което ми необходимо са две неща:

1. Архивирана папка Qoobox, която се намира в C:\

2. Архивирана папката MiniDump, която се намира в C:\WINDOWS (необходимо е да влезеш в Safe Mode)

След ги качи в www.rapidshare.com и накрая публикувай линк тук.

Накрая ще премахнем приложенията, които използвахме.

Архивирана папката MiniDump.....отново не мога да вляза под Safe Mode.....системата увисва....по друг начин мога ли да я намеря тази папка..?

Опитай в нормален режим да я архивираш.

Не я намирам в C:\WINDOWS......?

А файл MiniDump? Можеш ли да виждаш скрити файлове и папки?

Да виждам скрити файлове и папки....но въпросната не откривам..изтекоха ми очите да я търся...

Добре, остави, пусни ми само Qoobox.

http://rapidshare.com/files/285701581/Qoobox.rar.html

Стъпка 1:

За да деинсталирате ComboFix и всички резервни копия на файлове, които той премахва:

• * Кликнете върху бутона Start и изберете Run
  * Въведете ComboFix /u в полето и изберете OK

Бележка: Забележете, че има разстояние между ComboFix и /u, което задължително трябва да има.

Тази процедура ще:

Изтрие следното:

• ComboFix и всички свързани с нея файлове и папки.
  
• Backup на VundoFix (ако съществува).
  
• Папката Deckard (ако съществува).
  
• Папката _OtMoveIt (ако съществува).
  

• Нулира настройките на часовника.
  
  
• Скрива файлови разширения, ако е необходимо.
  
  
• Скрива системни файлове, ако е необходимо.
  
  
• Нулира
  System Restore
  .

  
  

Стъпка 2:

Ръчно изтрий, останалите програми.

Готово.......имаш от мен едно голямо благодаря ........

Моля!

Съжалявам, че отне толкова време, но решавах и задачи и....

Честно казано не знам от къде и как ме извъртя.....но ефекта е налице....добра работа....още веднъж благодаря!!!