Не мисля, че ще е голям проблем, но все пак се надявам да не е някаква "самоделка".

Все още съм на работа и инструкциите ще ги публикувам след (+ -)30 мин.

Поздрави.

Вариант 1

Сложете инсталационния диск на Windows XP SP2 в оптичното устройство.

Копирайте папката i386 на дял C:\

Отворете notepad и с сopy/paste въведете следната информация:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]

"Installation Sources"=hex(7):43,00,3a,00,5c,00,49,00,33,00,38,00,36,00,00,00,\

00,00

"SourcePath"="C:"

"ServicePackSourcePath"="C:"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]

"SourcePath"="C:\\I386"

Запазете файла с име fix.reg и го стартирайте.

Рестартирайте компютъра.

След това отворете до болка познатия ви Task Manager => File => Net Task (run...) и въведете следната команда:

sfc /scannow => натиснете ОК.

Рестартирайте машината отново и кажете дали вече имате десктоп за да продължим с почистването.

' date='04 октомври 2009 - 02:20 ' timestamp='1254612053' post='1525847']

Вариант 1

Сложете инсталационния диск на Windows XP SP2 в оптичното устройство.

Копирайте папката i386 на дял C:\

Отворете notepad и с сopy/paste въведете следната информация:

Запазете файла с име fix.reg и го стартирайте.

Рестартирайте компютъра.

След това отворете до болка познатия ви Task Manager => File => Net Task (run...) и въведете следната команда:

sfc /scannow => натиснете ОК.

Рестартирайте машината отново и кажете дали вече имате десктоп за да продължим с почистването.

Свалих нужната папка но не ми даде да я сваля в C:\ успях да я сваля в Мойте документи предполагам че сега съдържанието на файла дето трябва да се записва ще е изменено чакам понататачни инструкции по създалата се ситуация

Вариант 2

Какво съобщение изписва като се опитвате да я свалите на дял C:\ ?

Както и да е...ще пробваме по друг начин...в My Documents не ни върши никаква работа...

Принтирайте си (или си препишете инструкциите) и пробвайте следния начин:

Вкарайте инсталационния диск на Windows XP SP2 в оптичното устройство.

Рестартирайте компютъра, като се уверите, че в БИОС-а е направено CD/DVD да е boot-ващото устройство.

Заредете от диска на Windows и натиснете "R"

Ще бъдете подканен да изберете коя Windows инсталация ще възстановявате:

Ако имате само една инсталация просто избирате "1"

След това се изисква и администраторската парола.

Ако не сте въвеждали такава просто натиснете "ENTER".

В появилия се command prompt вече можете да напишете всяка валидна команда.

Въведете следната:

expand X:\I386\explorer.ex_ c:\windows\explorer.exe

(където X:\ - е буквата на оптичното устройство, сменете я според тази за вашия компютър).

Натиснете Enter.

Сега така и така сте тук, да възстановим и моднатите файлове.

Веведете следната команда:

expand X:\i386\lsass.ex_ c:\windows\system32\lsass.exe

(където X:\ - е буквата на оптичното устройство, сменете я според тази за вашия компютър).

Натиснете Enter.

Веведете следната команда:

expand X:\i386\services.ex_ c:\windows\system32\services.exe

(където X:\ - е буквата на оптичното устройство, сменете я според тази за вашия компютър).

Натиснете Enter.

Веведете следната команда:

expand X:\i386\svchost.ex_ c:\windows\system32\svchost.exe

(където X:\ - е буквата на оптичното устройство, сменете я според тази за вашия компютър).

Натиснете Enter.

Веведете следната команда:

expand X:\i386\spoolsv.ex_ c:\windows\system32\spoolsv.exe

(където X:\ - е буквата на оптичното устройство, сменете я според тази за вашия компютър).

Натиснете Enter.

Веведете следната команда:

expand X:\i386\winlogon.ex_ c:\windows\system32\winlogon.exe

(където X:\ - е буквата на оптичното устройство, сменете я според тази за вашия компютър).

Натиснете Enter.

След като командите бъдат изпълнени успешно напишете - "Exit" за да рестартирате машината.

' date='05 октомври 2009 - 12:22 ' timestamp='1254734558' post='1526748']

Вариант 2

Какво съобщение изписва като се опитвате да я свалите на дял C:\ ?

Както и да е...ще пробваме по друг начин...в My Documents не ни върши никаква работа...

Принтирайте си (или си препишете инструкциите) и пробвайте следния начин:

Вкарайте инсталационния диск на Windows XP SP2 в оптичното устройство.

Рестартирайте компютъра, като се уверите, че в БИОС-а е направено CD/DVD да е boot-ващото устройство.

Заредете от диска на Windows и натиснете "R"

Ще бъдете подканен да изберете коя Windows инсталация ще възстановявате:

Ако имате само една инсталация просто избирате "1"

След това се изисква и администраторската парола.

Ако не сте въвеждали такава просто натиснете "ENTER".

В появилия се command prompt вече можете да напишете всяка валидна команда.

Въведете следната:

expand X:\I386\explorer.ex_ c:\windows\explorer.exe

(където X:\ - е буквата на оптичното устройство, сменете я според тази за вашия компютър).

Натиснете Enter.

Сега така и така сте тук, да възстановим и моднатите файлове.

Веведете следната команда:

expand X:\i386\lsass.ex_ c:\windows\system32\lsass.exe

(където X:\ - е буквата на оптичното устройство, сменете я според тази за вашия компютър).

Натиснете Enter.

Веведете следната команда:

expand X:\i386\services.ex_ c:\windows\system32\services.exe

(където X:\ - е буквата на оптичното устройство, сменете я според тази за вашия компютър).

Натиснете Enter.

Веведете следната команда:

expand X:\i386\svchost.ex_ c:\windows\system32\svchost.exe

(където X:\ - е буквата на оптичното устройство, сменете я според тази за вашия компютър).

Натиснете Enter.

Веведете следната команда:

expand X:\i386\spoolsv.ex_ c:\windows\system32\spoolsv.exe

(където X:\ - е буквата на оптичното устройство, сменете я според тази за вашия компютър).

Натиснете Enter.

Веведете следната команда:

expand X:\i386\winlogon.ex_ c:\windows\system32\winlogon.exe

(където X:\ - е буквата на оптичното устройство, сменете я според тази за вашия компютър).

Натиснете Enter.

След като командите бъдат изпълнени успешно напишете - "Exit" за да рестартирате машината.

Изпълних първата част от инструкцията натиснах R и Enter дади ми само C :\windows като избор аз си натиснах все едно едно и Ентер после написах първата команда и ми изписа ето това The system cannot find the file or directory specified

Да разбирам ли, че сте изпълнили тази част:

и сте стигнали до менюто Command Prompt ?

Сменихте ли букчивката X:\ с тази за вашата система ?

expand x:\I386\explorer.ex_ c:\windows\explorer.exe

също така има празно място между червения участък... explorer.ex_ c:\windows\explorer.exe

папката i386 трябва да е с главна буква (за всеки случай) - I386

Пробвайте отново.

или след като се появи command prompt менюто въведете:

cd X:\I386 => натиснете Enter

Където буквичаката X трябва да смените с тази за вашето DVD устройство ?

ако DVD-то ви е с буква D:\ или E:\ (и т.н.) трябва там където пише X:\ да го замените с буквата на DVD устройството.

След това въведете командата:

expand explorer.ex_ C:\windows\explorer.exe

и тук има празно място между червения участък.

' date='05 октомври 2009 - 15:06 ' timestamp='1254744415' post='1526874']

Да разбирам ли, че сте изпълнили тази част:

и сте стигнали до менюто Command Prompt ?

Сменихте ли букчивката X:\ с тази за вашата система ?

expand x:\I386\explorer.ex_ c:\windows\explorer.exe

също така има празно място между червения участък... explorer.ex_ c:\windows\explorer.exe

папката i386 трябва да е с главна буква (за всеки случай) - I386

Пробвайте отново.

или след като се появи command prompt менюто въведете:

cd X:\I386 => натиснете Enter

Където буквичаката X трябва да смените с тази за вашето DVD устройство ?

ако DVD-то ви е с буква D:\ или E:\ (и т.н.) трябва там където пише X:\ да го замените с буквата на DVD устройството.

След това въведете командата:

expand explorer.ex_ C:\windows\explorer.exe

и тук има празно място между червения участък.

Всичко изпълнявам по указанията след като напиша 1 и натисна ентер и след това пак тъй като няма парола се изписва следния команден ред C:\windows> пиша командата и с долна черта на червеното място и просто с интервал без долна черта и резултата е горе описания от мен надпис написах cd E:\I386 и ентер но без да дава някакви забележки пак изписа като команден ред C:\windows> пробвах и с малко i пиша с големи букви С и Е и пак същата отметка

Незнам аз ли не обясних добре или вие някъде грешите с процедурата, но ни остана само едно нещо преди да преинсталираме начисто. => REPAIR INSTALL (да, може би трябваше да го препоръчам по-рано, но не обичам за най-малката дреболия да го използвам, какво повечето правят пък дори и да е по-лесно). Чистата преинсталация би била най-доброто решение, но и отнема повече време...с REPAIR INSTALL-a, ще се възстановят файловете, които липсват или са повредени и ще се запазят поне повечето ви настройки и инсталирани програми. Да, сигурно някои програми ще се наложи да ги преинсталирате отново, но е трудно да се предскаже кои ще са те. Затова да пристъпим към действия:

Заредете пак от диска с Windows XP SP2, но този път не натискайте "R", а натиснете "Enter"

Там вече по-стандартната процедура натиснете "F8" за да се съгласите с лицензионното споразумение.

След като се появи това меню тук вече натиснете "R"

Продължете все едно правите стандартна преинсталация...

За финал, когато вече имате десктоп, направете нова проверка с Combofix и публикувайте резултата.

' date='05 октомври 2009 - 17:21 ' timestamp='1254752468' post='1526986']

Незнам аз ли не обясних добре или вие някъде грешите с процедурата, но ни остана само едно нещо преди да преинсталираме начисто. => REPAIR INSTALL (да, може би трябваше да го препоръчам по-рано, но не обичам за най-малката дреболия да го използвам, какво повечето правят пък дори и да е по-лесно). Чистата преинсталация би била най-доброто решение, но и отнема повече време...с REPAIR INSTALL-a, ще се възстановят файловете, които липсват или са повредени и ще се запазят поне повечето ви настройки и инсталирани програми. Да, сигурно някои програми ще се наложи да ги преинсталирате отново, но е трудно да се предскаже кои ще са те. Затова да пристъпим към действия:

Заредете пак от диска с Windows XP SP2, но този път не натискайте "R", а натиснете "Enter"

Там вече по-стандартната процедура натиснете "F8" за да се съгласите с лицензионното споразумение.

След като се появи това меню тук вече натиснете "R"

Продължете все едно правите стандартна преинсталация...

За финал, когато вече имате десктоп, направете нова проверка с Combofix и публикувайте резултата.

Malwarebytes' Anti-Malware 1.41

Версия на базата от данни: 2914

Windows 5.1.2600 Service Pack 2

10/6/2009 11:24:27 AM

mbam-log-2009-10-06 (11-24-26).txt

Тип сканиране: Пълно сканиране (C:\|D:\|)

Сканирани обекти: 112892

Изминало време: 32 minute(s), 23 second(s)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 0

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 0

Заразени файлове: 11

Заразени процеси в паметта:

(Не бяха открити заплахи)

Заразени модули в паметта:

(Не бяха открити заплахи)

Заразени ключове в регистратурата:

(Не бяха открити заплахи)

Заразени стойности в регистратурата:

(Не бяха открити заплахи)

Заразени информационни обекти в регистратурата:

(Не бяха открити заплахи)

Заразени папки:

(Не бяха открити заплахи)

Заразени файлове:

C:\System Volume Information\_restore{A387FCE8-7F0F-47C4-BE1D-F2B40C8153A5}\RP229\A0110377.sys (Worm.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A387FCE8-7F0F-47C4-BE1D-F2B40C8153A5}\RP229\A0110473.sys (Worm.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A387FCE8-7F0F-47C4-BE1D-F2B40C8153A5}\RP229\A0110571.sys (Worm.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A387FCE8-7F0F-47C4-BE1D-F2B40C8153A5}\RP228\A0109775.sys (Worm.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A387FCE8-7F0F-47C4-BE1D-F2B40C8153A5}\RP228\A0109847.sys (Worm.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A387FCE8-7F0F-47C4-BE1D-F2B40C8153A5}\RP228\A0109929.sys (Worm.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A387FCE8-7F0F-47C4-BE1D-F2B40C8153A5}\RP228\A0110003.sys (Worm.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A387FCE8-7F0F-47C4-BE1D-F2B40C8153A5}\RP228\A0110080.sys (Worm.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A387FCE8-7F0F-47C4-BE1D-F2B40C8153A5}\RP228\A0110165.sys (Worm.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A387FCE8-7F0F-47C4-BE1D-F2B40C8153A5}\RP228\A0110263.sys (Worm.Agent) -> Quarantined and deleted successfully.

C:\ComboFix\Combo-Fix.sys (Worm.Agent) -> Quarantined and deleted successfully.

B-boy ти написа да сканираш с Combofix.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:38:02 AM, on 10/6/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

d:\Apis\Apis6Euro\App\iupd\iupd7.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\taskmgr.exe

C:\WINDOWS\system32\wscntfy.exe

C:\kaldata.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com

R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

O4 - HKLM\..\Run: [WHITNEY2_XRX_S2P] C:\Program Files\Xerox\Xerox Phaser 3200MFP\PSU\Scan2pc.exe

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\CF678.exe /c C:\ComboFix\Combobatch.bat

O4 - HKLM\..\RunOnce: [combofix] C:\WINDOWS\system32\CF678.exe /c C:\ComboFixCombobatch.bat

O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup

O4 - Global Startup: FlexType 2K.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{99B2458D-B213-4442-AED0-3100DEE7D2CF}: NameServer = 212.39.90.42,212.39.90.43

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O21 - SSODL: IrckpLPfyka - {132E0CF3-B984-A659-F942-8556532D094B} - C:\WINDOWS\system32\xiu.dll

O23 - Service: ApisIupd2005 - Apis Bulgaria - d:\Apis\Apis6Euro\App\iupd\iupd7.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: lmab_device - - C:\WINDOWS\system32\LMabcoms.exe

--

End of file - 3652 bytes

Преди да направя това което ме посаветва последно реших да направя по още едно сканиране това са резултатите от него ще правим ли нещо друго или да почвам това което ме посаветва последно?Чакам последни указания

Volume in drive C has no label.

Volume Serial Number is 132E-0CF2

Това е от Комбото

Обърках логовете от Комбото ето истинския

ComboFix 09-10-05.01 - Iurist 10/06/2009 12:42.9.1 - FAT32x86

Running from: c:\documents and settings\Iurist\My Documents\Изтегляния\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_WIYGJA

-------\Service_WIYGJA

((((((((((((((((((((((((( Files Created from 2009-09-06 to 2009-10-06 )))))))))))))))))))))))))))))))

.

2009-10-05 04:24 . 2009-10-05 04:24 -------- d-----w- c:\windows\system32\NtmsData

2009-10-02 11:03 . 2009-10-02 11:03 -------- d-----w- c:\windows\system32\CatRoot_bak

2009-10-01 05:26 . 2009-10-01 05:26 396288 ----a-w- C:\kaldata.exe

2009-09-30 12:21 . 2009-09-30 12:21 -------- d-----w- c:\documents and settings\Iurist\Application Data\Malwarebytes

2009-09-30 12:20 . 2009-09-10 11:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-09-30 12:20 . 2009-09-30 12:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-30 12:20 . 2009-09-10 11:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-09-30 12:20 . 2009-09-30 12:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-09-29 04:55 . 2009-09-29 04:55 -------- d-----w- c:\documents and settings\Iurist\Local Settings\Application Data\AVG Security Toolbar

2009-09-29 04:49 . 2009-09-29 04:49 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2009-09-29 04:49 . 2009-09-29 04:49 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2009-09-29 04:49 . 2009-09-29 04:49 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-09-29 04:49 . 2009-09-29 04:49 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2009-09-29 04:49 . 2009-09-29 04:49 -------- d-----w- c:\windows\system32\drivers\Avg

2009-09-29 04:49 . 2009-09-29 04:49 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar

2009-09-29 04:48 . 2009-09-29 04:48 -------- d-----w- c:\program files\AVG

2009-09-29 04:48 . 2009-09-29 04:48 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

2009-09-24 08:46 . 2009-09-24 08:46 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-01 04:37 . 2009-09-01 04:37 -------- d-----w- c:\program files\uTorrent [tfile.ru]

2009-08-14 05:37 . 2009-08-14 05:37 1744 ----a-w- c:\windows\system32\d3d9caps.dat

2009-08-14 05:37 . 2009-08-14 05:37 1632 ----a-w- c:\windows\system32\d3d8caps.dat

2009-08-12 09:44 . 2008-07-14 18:06 37960 ----a-w- c:\documents and settings\Iurist\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-08-06 04:44 . 2009-08-04 04:43 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

.

------- Sigcheck -------

[-] 2004-08-03 . D41D8CD98F00B204E9800998ECF8427E . 14848 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe

[-] 2004-08-03 . D41D8CD98F00B204E9800998ECF8427E . 110592 . . [5.1.2600.2180] . . c:\windows\system32\services.exe

[-] 2004-08-03 . D41D8CD98F00B204E9800998ECF8427E . 58880 . . [5.1.2600.2180] . . c:\windows\system32\spoolsv.exe

[-] 2004-08-03 . D41D8CD98F00B204E9800998ECF8427E . 17408 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe

[-] 2004-08-03 . D41D8CD98F00B204E9800998ECF8427E . 506368 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe

c:\windows\explorer.exe ... is missing !!

.

((((((((((((((((((((((((((((( SnapShot@2009-10-01_12.35.48 )))))))))))))))))))))))))))))))))))))))))

.

+ 2008-07-14 19:34 . 2009-10-05 04:23 196960 c:\windows\system32\FNTCACHE.DAT

- 2008-07-14 19:34 . 2009-05-19 04:16 196960 c:\windows\system32\FNTCACHE.DAT

+ 2009-10-02 12:50 . 2009-10-02 12:50 279040 c:\windows\Installer\6adf9.msi

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-06-30 2329224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WHITNEY2_XRX_S2P"="c:\program files\Xerox\Xerox Phaser 3200MFP\PSU\Scan2pc.exe" [2007-04-09 253952]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-09-29 2007832]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2008-7-14 151552]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

"IrckpLPfyka"= {132E0CF3-B984-A659-F942-8556532D094B} - c:\windows\system32\xiu.dll [2004-08-03 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-09-29 04:49 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\winver.exe"=

"c:\\WINDOWS\\System32\\LMabcoms.exe"=

"c:\\Program Files\\uTorrent [tfile.ru]\\utorrent.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/29/2009 7:49 AM 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/29/2009 7:49 AM 108552]

R2 ApisIupd2005;ApisIupd2005;d:\apis\Apis6Euro\App\iupd\IUPD7.exe [7/15/2008 2:24 AM 1526272]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [9/29/2009 7:48 AM 297752]

S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [5/21/2009 3:15 PM 26224]

.

.

------- Supplementary Scan -------

.

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

TCP: {99B2458D-B213-4442-AED0-3100DEE7D2CF} = 212.39.90.42,212.39.90.43

FF - ProfilePath - c:\documents and settings\Iurist\Application Data\Mozilla\Firefox\Profiles\fnalx9jd.default\

FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official

FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=

FF - component: c:\documents and settings\Iurist\Application Data\Mozilla\Firefox\Profiles\fnalx9jd.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\components\FFAlert.dll

FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

.

- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-06 12:50

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]

"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

.

Completion time: 2009-10-06 12:53

ComboFix-quarantined-files.txt 2009-10-06 09:53

ComboFix2.txt 2009-10-01 12:39

Pre-Run: 4,706,942,976 bytes free

Post-Run: 4,680,417,280 bytes free

127

Upload was successful

Успях да изключа антивирусната ето лога на Комбо при изключена антивирусна

ComboFix 09-10-05.01 - Iurist 10/06/2009 13:25.10.1 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1251.1.1033.18.255.60 [GMT 3:00]

Running from: c:\documents and settings\Iurist\My Documents\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2009-09-06 to 2009-10-06 )))))))))))))))))))))))))))))))

.

2009-10-05 04:24 . 2009-10-05 04:24 -------- d-----w- c:\windows\system32\NtmsData

2009-10-02 11:03 . 2009-10-02 11:03 -------- d-----w- c:\windows\system32\CatRoot_bak

2009-10-01 05:26 . 2009-10-01 05:26 396288 ----a-w- C:\kaldata.exe

2009-09-30 12:21 . 2009-09-30 12:21 -------- d-----w- c:\documents and settings\Iurist\Application Data\Malwarebytes

2009-09-30 12:20 . 2009-09-10 11:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-09-30 12:20 . 2009-09-30 12:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-30 12:20 . 2009-09-10 11:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-09-30 12:20 . 2009-09-30 12:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-09-29 04:55 . 2009-09-29 04:55 -------- d-----w- c:\documents and settings\Iurist\Local Settings\Application Data\AVG Security Toolbar

2009-09-29 04:49 . 2009-09-29 04:49 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2009-09-29 04:49 . 2009-09-29 04:49 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2009-09-29 04:49 . 2009-09-29 04:49 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-09-29 04:49 . 2009-09-29 04:49 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2009-09-29 04:49 . 2009-09-29 04:49 -------- d-----w- c:\windows\system32\drivers\Avg

2009-09-29 04:49 . 2009-09-29 04:49 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar

2009-09-29 04:48 . 2009-09-29 04:48 -------- d-----w- c:\program files\AVG

2009-09-29 04:48 . 2009-09-29 04:48 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

2009-09-24 08:46 . 2009-09-24 08:46 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-01 04:37 . 2009-09-01 04:37 -------- d-----w- c:\program files\uTorrent [tfile.ru]

2009-08-14 05:37 . 2009-08-14 05:37 1744 ----a-w- c:\windows\system32\d3d9caps.dat

2009-08-14 05:37 . 2009-08-14 05:37 1632 ----a-w- c:\windows\system32\d3d8caps.dat

2009-08-12 09:44 . 2008-07-14 18:06 37960 ----a-w- c:\documents and settings\Iurist\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-08-06 04:44 . 2009-08-04 04:43 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

.

------- Sigcheck -------

[-] 2004-08-03 . D41D8CD98F00B204E9800998ECF8427E . 14848 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe

[-] 2004-08-03 . D41D8CD98F00B204E9800998ECF8427E . 110592 . . [5.1.2600.2180] . . c:\windows\system32\services.exe

[-] 2004-08-03 . D41D8CD98F00B204E9800998ECF8427E . 58880 . . [5.1.2600.2180] . . c:\windows\system32\spoolsv.exe

[-] 2004-08-03 . D41D8CD98F00B204E9800998ECF8427E . 17408 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe

[-] 2004-08-03 . D41D8CD98F00B204E9800998ECF8427E . 506368 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe

c:\windows\explorer.exe ... is missing !!

.

((((((((((((((((((((((((((((( SnapShot@2009-10-01_12.35.48 )))))))))))))))))))))))))))))))))))))))))

.

+ 2008-07-14 19:34 . 2009-10-05 04:23 196960 c:\windows\system32\FNTCACHE.DAT

- 2008-07-14 19:34 . 2009-05-19 04:16 196960 c:\windows\system32\FNTCACHE.DAT

+ 2009-10-02 12:50 . 2009-10-02 12:50 279040 c:\windows\Installer\6adf9.msi

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-06-30 2329224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WHITNEY2_XRX_S2P"="c:\program files\Xerox\Xerox Phaser 3200MFP\PSU\Scan2pc.exe" [2007-04-09 253952]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-09-29 2007832]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2008-7-14 151552]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

"IrckpLPfyka"= {132E0CF3-B984-A659-F942-8556532D094B} - c:\windows\system32\xiu.dll [2004-08-03 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-09-29 04:49 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\winver.exe"=

"c:\\WINDOWS\\System32\\LMabcoms.exe"=

"c:\\Program Files\\uTorrent [tfile.ru]\\utorrent.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/29/2009 7:49 AM 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/29/2009 7:49 AM 108552]

R2 ApisIupd2005;ApisIupd2005;d:\apis\Apis6Euro\App\iupd\IUPD7.exe [7/15/2008 2:24 AM 1526272]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [9/29/2009 7:48 AM 297752]

S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [5/21/2009 3:15 PM 26224]

.

.

------- Supplementary Scan -------

.

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

TCP: {99B2458D-B213-4442-AED0-3100DEE7D2CF} = 212.39.90.42,212.39.90.43

FF - ProfilePath - c:\documents and settings\Iurist\Application Data\Mozilla\Firefox\Profiles\fnalx9jd.default\

FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official

FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=

FF - component: c:\documents and settings\Iurist\Application Data\Mozilla\Firefox\Profiles\fnalx9jd.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\components\FFAlert.dll

FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-06 13:29

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]

"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

.

Completion time: 2009-10-06 13:31

ComboFix-quarantined-files.txt 2009-10-06 10:31

ComboFix2.txt 2009-10-06 09:57

ComboFix3.txt 2009-10-01 12:39

Pre-Run: 4,675,870,720 bytes free

Post-Run: 4,650,532,864 bytes free

118

А направихте ли "поправителна преинсталация" (Repair install), защото не виждам промяна...все още explorer.exe е липсващ файл.

' date='06 октомври 2009 - 13:41 ' timestamp='1254825714' post='1527566']

А направихте ли "поправителна преинсталация" (Repair install), защото не виждам промяна...все още explorer.exe е липсващ файл.

Първо пак ще упитам да абгрейтна на СП3 и ако пак не стане ще направя това което ми казваш просто защото сме в мержа и ме е страх да не загубя връзка с нета После ще направя лога с комбото при изкючена антивирусна и нататак ще казвате какво да правя

Първо пак ще упитам да абгрейтна на СП3 и ако пак не стане ще направя това което ми казваш просто защото сме в мержа и ме е страх да не загубя връзка с нета После ще направя лога с комбото при изкючена антивирусна и нататак ще казвате какво да правя

Добре, но ако пак не ви позволи да инсталирате SP3 или опитайте с Repair Install, или другото което остана, но ще ми трябва повече време е да инсталирам WinXP SP2 на виртуална машина и да ви копирам нужните файлове...

Пробвайте дали ще можете да копирате папката I386 в свободната на C:\ или поне на D:\

' date='06 октомври 2009 - 13:56 ' timestamp='1254826598' post='1527577']

Добре, но ако пак не ви позволи да инсталирате SP3 или опитайте с Repair Install, или другото което остана, но ще ми трябва повече време е да инсталирам WinXP SP2 на виртуална машина и да ви копирам нужните файлове...

Пробвайте дали ще можете да копирате папката I386 в свободната на C:\ или поне на D:\

Направих Repair Install и вече имам икони и команден ред направих и сканиране с Комбото лога ще го постна утре рано сутринта,защото остана на заразения компютар на работа,но от лога видях,че е пълно с вируси май....като го видиш ще казваш какво да правим

Направих Repair Install и вече имам икони и команден ред направих и сканиране с Комбото лога ще го постна утре рано сутринта,защото остана на заразения компютар на работа,но от лога видях,че е пълно с вируси май....като го видиш ще казваш какво да правим

Няма проблеми. Аз вече съм докладвал за някои неща и авторът на програмата ги добави в дефинициите си. Последния ви лог не беше чак толкова зле с изключение на редът:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

"IrckpLPfyka"= {132E0CF3-B984-A659-F942-8556532D094B} - c:\windows\system32\xiu.dll [2004-08-03 32768]

който ще оправим утре.

Лека вечер.

' date='06 октомври 2009 - 22:44 ' timestamp='1254858266' post='1527973']

Няма проблеми. Аз вече съм докладвал за някои неща и авторът на програмата ги добави в дефинициите си. Последния ви лог не беше чак толкова зле с изключение на редът:

който ще оправим утре.

Лека вечер.

Ще ви чакам по обичайното за появяване време малко след 13 ч. честно казано въпреки,че имам икони не ме допусна до контролния панел например....Лека вечер

честно казано въпреки,че имам икони не ме допусна до контролния панел например....Лека вечер

Някакво съобщение за грешка изписва ли ?

Пробвайте следното:

Стъпка 1:

Изтеглете това FixPolicies.

Запазете го някъде на декстопа.Кликнете два пъти върху файла и изберете Install.Ще се създаде папка с името FixPolicies на десктопа.Отворете я и стартирайте файла Fix_policies.cmd .

Утре обновете дефинициите и направете нова проверка с Malwarebytes и публикувайте лог файла.

Също така изтрийте вашето копие на Combofix и го изтеглете наново оттук:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Направете нова проверка и публикувайте новия лог файл.

До утре.

' date='06 октомври 2009 - 22:51 ' timestamp='1254858664' post='1527986']

Някакво съобщение за грешка изписва ли ?

Пробвайте следното:

Стъпка 1:

Изтеглете това FixPolicies.

Запазете го някъде на декстопа.Кликнете два пъти върху файла и изберете Install.Ще се създаде папка с името FixPolicies на десктопа.Отворете я и стартирайте файла Fix_policies.cmd .

Утре обновете дефинициите и направете нова проверка с Malwarebytes и публикувайте лог файла.

Също така изтрийте вашето копие на Combofix и го изтеглете наново оттук:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Направете нова проверка и публикувайте новия лог файл.

До утре.

Ето първо лога от вчера с Комбото

ComboFix 09-10-05.01 - Iurist 10/06/2009 15:46.11.1 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.255.67 [GMT 3:00]

Running from: c:\documents and settings\Iurist\My Documents\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((( Files Created from 2009-09-06 to 2009-10-06 )))))))))))))))))))))))))))))))

.

2009-10-06 12:18 . 2004-08-04 12:00 30208 ----a-w- c:\windows\system32\dllcache\sm87w.dll

2009-10-06 12:17 . 2004-08-04 12:00 70656 ----a-w- c:\windows\system32\dllcache\korwbrkr.dll

2009-10-06 12:16 . 2004-08-04 12:00 42496 ----a-w- c:\windows\system32\dllcache\davcdata.exe

2009-10-06 12:15 . 2004-08-04 12:00 68608 ----a-w- c:\windows\system32\dllcache\isatq.dll

2009-10-06 12:11 . 2004-08-04 12:00 16384 ----a-w- c:\windows\system32\dllcache\isignup.exe

2009-10-06 12:08 . 2009-10-06 12:08 -------- d-----w- c:\program files\Windows Media Connect 2

2009-10-06 11:56 . 2004-08-04 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll

2009-10-06 11:56 . 2004-08-04 12:00 24661 ----a-w- c:\windows\system32\dllcache\spxcoins.dll

2009-10-06 11:56 . 2004-08-04 12:00 13312 ----a-w- c:\windows\system32\irclass.dll

2009-10-06 11:56 . 2004-08-04 12:00 13312 ----a-w- c:\windows\system32\dllcache\irclass.dll

2009-10-06 11:47 . 2009-10-06 11:47 -------- d-----w- c:\windows\system32\drivers\UMDF

2009-10-06 11:47 . 2009-10-06 11:47 -------- d-----w- c:\windows\msapps

2009-10-06 11:47 . 2009-10-06 11:47 -------- d-----w- c:\windows\l2schemas

2009-10-05 04:24 . 2009-10-05 04:24 -------- d-----w- c:\windows\system32\NtmsData

2009-10-02 11:03 . 2009-10-02 11:03 -------- d-----w- c:\windows\system32\CatRoot_bak

2009-10-01 05:26 . 2009-10-01 05:26 396288 ----a-w- C:\kaldata.exe

2009-09-30 12:21 . 2009-09-30 12:21 -------- d-----w- c:\documents and settings\Iurist\Application Data\Malwarebytes

2009-09-30 12:20 . 2009-09-10 11:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-09-30 12:20 . 2009-09-30 12:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-30 12:20 . 2009-09-10 11:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-09-30 12:20 . 2009-09-30 12:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-09-29 04:55 . 2009-09-29 04:55 -------- d-----w- c:\documents and settings\Iurist\Local Settings\Application Data\AVG Security Toolbar

2009-09-29 04:49 . 2009-09-29 04:49 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2009-09-29 04:49 . 2009-09-29 04:49 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2009-09-29 04:49 . 2009-09-29 04:49 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-09-29 04:49 . 2009-09-29 04:49 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2009-09-29 04:49 . 2009-09-29 04:49 -------- d-----w- c:\windows\system32\drivers\Avg

2009-09-29 04:49 . 2009-09-29 04:49 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar

2009-09-29 04:48 . 2009-09-29 04:48 -------- d-----w- c:\program files\AVG

2009-09-29 04:48 . 2009-09-29 04:48 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

2009-09-24 08:46 . 2009-09-24 08:46 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-06 12:09 . 2008-07-14 17:47 22720 ----a-w- c:\windows\system32\emptyregdb.dat

2009-09-01 04:37 . 2009-09-01 04:37 -------- d-----w- c:\program files\uTorrent [tfile.ru]

2009-08-14 05:37 . 2009-08-14 05:37 1744 ----a-w- c:\windows\system32\d3d9caps.dat

2009-08-14 05:37 . 2009-08-14 05:37 1632 ----a-w- c:\windows\system32\d3d8caps.dat

2009-08-12 09:44 . 2008-07-14 18:06 37960 ----a-w- c:\documents and settings\Iurist\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-08-06 04:44 . 2009-08-04 04:43 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-06-30 2329224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WHITNEY2_XRX_S2P"="c:\program files\Xerox\Xerox Phaser 3200MFP\PSU\Scan2pc.exe" [2007-04-09 253952]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-09-29 2007832]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ShowDeskFix"="shell32" [X]

"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]

"IE7-10"="advpack.dll" - c:\windows\system32\advpack.dll [2007-05-29 124928]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2008-7-14 151552]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

"IrckpLPfyka"= {132E0CF3-B984-A659-F942-8556532D094B} - c:\windows\system32\xiu.dll [2004-08-03 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-09-29 04:49 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\winver.exe"=

"c:\\WINDOWS\\System32\\LMabcoms.exe"=

"c:\\Program Files\\uTorrent [tfile.ru]\\utorrent.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/29/2009 7:49 AM 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/29/2009 7:49 AM 108552]

R2 ApisIupd2005;ApisIupd2005;d:\apis\Apis6Euro\App\iupd\IUPD7.exe [7/15/2008 2:24 AM 1526272]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [9/29/2009 7:48 AM 297752]

S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [5/21/2009 3:15 PM 26224]

.

.

------- Supplementary Scan -------

.

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

TCP: {99B2458D-B213-4442-AED0-3100DEE7D2CF} = 212.39.90.42,212.39.90.43

FF - ProfilePath - c:\documents and settings\Iurist\Application Data\Mozilla\Firefox\Profiles\fnalx9jd.default\

FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official

FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=

FF - component: c:\documents and settings\Iurist\Application Data\Mozilla\Firefox\Profiles\fnalx9jd.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\components\FFAlert.dll

FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll

FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-06 15:54

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]

"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3244)

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

Completion time: 2009-10-06 15:57

ComboFix-quarantined-files.txt 2009-10-06 12:57

ComboFix2.txt 2009-10-06 10:31

ComboFix3.txt 2009-10-06 09:57

ComboFix4.txt 2009-10-01 12:39

Pre-Run: 5,440,487,424 bytes free

Post-Run: 5,410,504,704 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

8200

Деинсталирах AVG и компютара започна да работи по-леко

Така, темата вече работи (благодарение на Калин - благодаря) и можем да се преместим от Лични Съобщения в нея.

PS: изтрих няколко поста, които бяхте публикували няколко пъти...и се повтаряха.

Ще публикувам и резултатите и Личните Съобщения:

givens:

Направих всичко което ми каза логовете са готови,деинсталирах и АVG вирусната преди да ги направя,тя си беше и без това бъгава,но немога да пиша в темата дава ми някакъв фатал ерор незнам ,какво да правя да пускам нова тема ли или какво ще чакам да кажеш!Иначе от Старт менюто не мога да влизам в Контролния панел,а само от Май компютар и иконата на Май компютар си стои сякаш е недозаредена с цветните точици...

Да ти пратя логовете тук?Или смисъла на темата е да се вижда от всички и да се ползва,нали?Кажи какво да правим?

Аз:

Ами докато я оправят да продължим на Л.С. Няма да стоите с "развалена" машина.

Да моля, пратете ми логовете - нов от изтеглен наново Combofix, от обнове Malwarebytes (с последните дефинииции) и още един от HijackThis.

givens:

1. Combofix:

ComboFix 09-10-06.03 - Iurist 10/07/2009 9:06.12.1 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.255.133 [GMT 3:00]

Running from: c:\documents and settings\Iurist\Desktop\ComboFix2.exe

.

((((((((((((((((((((((((( Files Created from 2009-09-07 to 2009-10-07 )))))))))))))))))))))))))))))))

.

2009-10-07 05:39 . 2009-09-10 11:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-07 05:39 . 2009-09-10 11:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-10-07 05:39 . 2009-10-07 05:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-10-06 12:18 . 2004-08-04 12:00 30208 ----a-w- c:\windows\system32\dllcache\sm87w.dll

2009-10-06 12:17 . 2004-08-04 12:00 70656 ----a-w- c:\windows\system32\dllcache\korwbrkr.dll

2009-10-06 12:16 . 2004-08-04 12:00 42496 ----a-w- c:\windows\system32\dllcache\davcdata.exe

2009-10-06 12:15 . 2004-08-04 12:00 68608 ----a-w- c:\windows\system32\dllcache\isatq.dll

2009-10-06 12:11 . 2004-08-04 12:00 16384 ----a-w- c:\windows\system32\dllcache\isignup.exe

2009-10-06 12:08 . 2009-10-06 12:08 -------- d-----w- c:\program files\Windows Media Connect 2

2009-10-06 11:56 . 2004-08-04 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll

2009-10-06 11:56 . 2004-08-04 12:00 24661 ----a-w- c:\windows\system32\dllcache\spxcoins.dll

2009-10-06 11:56 . 2004-08-04 12:00 13312 ----a-w- c:\windows\system32\irclass.dll

2009-10-06 11:56 . 2004-08-04 12:00 13312 ----a-w- c:\windows\system32\dllcache\irclass.dll

2009-10-06 11:47 . 2009-10-06 11:47 -------- d-----w- c:\windows\system32\drivers\UMDF

2009-10-06 11:47 . 2009-10-06 11:47 -------- d-----w- c:\windows\msapps

2009-10-06 11:47 . 2009-10-06 11:47 -------- d-----w- c:\windows\l2schemas

2009-10-05 04:24 . 2009-10-05 04:24 -------- d-----w- c:\windows\system32\NtmsData

2009-10-02 11:03 . 2009-10-02 11:03 -------- d-----w- c:\windows\system32\CatRoot_bak

2009-10-01 05:26 . 2009-10-01 05:26 396288 ----a-w- C:\kaldata.exe

2009-09-30 12:21 . 2009-09-30 12:21 -------- d-----w- c:\documents and settings\Iurist\Application Data\Malwarebytes

2009-09-30 12:20 . 2009-09-30 12:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-29 04:48 . 2009-09-29 04:48 -------- d-----w- c:\program files\AVG

2009-09-29 04:48 . 2009-09-29 04:48 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

2009-09-24 08:46 . 2009-09-24 08:46 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-07 04:39 . 2008-07-14 18:06 37960 ----a-w- c:\documents and settings\Iurist\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-10-06 12:09 . 2008-07-14 17:47 22720 ----a-w- c:\windows\system32\emptyregdb.dat

2009-09-01 04:37 . 2009-09-01 04:37 -------- d-----w- c:\program files\uTorrent [tfile.ru]

2009-08-14 05:37 . 2009-08-14 05:37 1744 ----a-w- c:\windows\system32\d3d9caps.dat

2009-08-14 05:37 . 2009-08-14 05:37 1632 ----a-w- c:\windows\system32\d3d8caps.dat

2009-08-06 04:44 . 2009-08-04 04:43 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

.

------- Sigcheck -------

[-] 2007-05-29 . D41D8CD98F00B204E9800998ECF8427E . 1033216 . . [6.00.2900.2894] . . c:\windows\explorer.exe

[7] 2007-05-29 . 42D32722B805D7DF42D30487A0BCBD78 . 1033216 . . [6.00.2900.2894] . . c:\windows\system32\dllcache\explorer.exe

[7] 2007-05-29 . 42D32722B805D7DF42D30487A0BCBD78 . 1033216 . . [6.00.2900.2894] . . c:\windows\ERDNT\cache\explorer.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-06-30 2329224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WHITNEY2_XRX_S2P"="c:\program files\Xerox\Xerox Phaser 3200MFP\PSU\Scan2pc.exe" [2007-04-09 253952]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ShowDeskFix"="shell32" [X]

"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]

"IE7-10"="advpack.dll" - c:\windows\system32\advpack.dll [2007-05-29 124928]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2008-7-14 151552]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

"IrckpLPfyka"= {132E0CF3-B984-A659-F942-8556532D094B} - c:\windows\system32\xiu.dll [2004-08-03 32768]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\winver.exe"=

"c:\\WINDOWS\\System32\\LMabcoms.exe"=

"c:\\Program Files\\uTorrent [tfile.ru]\\utorrent.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 ApisIupd2005;ApisIupd2005;d:\apis\Apis6Euro\App\iupd\IUPD7.exe [7/15/2008 2:24 AM 1526272]

S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [5/21/2009 3:15 PM 26224]

.

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

TCP: {99B2458D-B213-4442-AED0-3100DEE7D2CF} = 212.39.90.42,212.39.90.43

FF - ProfilePath - c:\documents and settings\Iurist\Application Data\Mozilla\Firefox\Profiles\fnalx9jd.default\

FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official

FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=

FF - component: c:\documents and settings\Iurist\Application Data\Mozilla\Firefox\Profiles\fnalx9jd.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\components\FFalert.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-07 09:10

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]

"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3340)

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

Completion time: 2009-10-07 9:12

ComboFix-quarantined-files.txt 2009-10-07 06:12

ComboFix2.txt 2009-10-06 12:57

ComboFix3.txt 2009-10-06 10:31

ComboFix4.txt 2009-10-06 09:57

ComboFix5.txt 2009-10-07 06:05

Pre-Run: 5,357,527,040 bytes free

Post-Run: 5,339,095,040 bytes free

117

2.Malwarebytes:

Malwarebytes' Anti-Malware 1.41

Database version: 2917

Windows 5.1.2600 Service Pack 2

10/7/2009 8:56:29 AM

mbam-log-2009-10-07 (08-56-29).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 103267

Time elapsed: 10 minute(s), 13 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\System Volume Information\_restore{A387FCE8-7F0F-47C4-BE1D-F2B40C8153A5}\RP1\A0000080.sys (Worm.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A387FCE8-7F0F-47C4-BE1D-F2B40C8153A5}\RP1\A0000224.sys (Worm.Agent) -> Quarantined and deleted successfully.

3. HijackThis:

Ето го и третото

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:13:18 PM, on 10/7/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.20544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Xerox\Xerox Phaser 3200MFP\PSU\Scan2pc.exe

C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe

C:\WINDOWS\Datecs\Flex2K.exe

d:\Apis\Apis6Euro\App\iupd\iupd7.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\svchost.exe

C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)

O4 - HKLM\..\Run: [WHITNEY2_XRX_S2P] C:\Program Files\Xerox\Xerox Phaser 3200MFP\PSU\Scan2pc.exe

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [iE7-10] rundll32 advpack.dll,LaunchINFSectionEx NR_IE7en.inf,AfterUserStart,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')

O4 - Global Startup: FlexType 2K.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{99B2458D-B213-4442-AED0-3100DEE7D2CF}: NameServer = 212.39.90.42,212.39.90.43

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O21 - SSODL: IrckpLPfyka - {132E0CF3-B984-A659-F942-8556532D094B} - C:\WINDOWS\system32\xiu.dll

O23 - Service: ApisIupd2005 - Apis Bulgaria - d:\Apis\Apis6Euro\App\iupd\iupd7.exe

O23 - Service: lmab_device - - C:\WINDOWS\system32\LMabcoms.exe

--

End of file - 3842 bytes

Аз:

Здравей,

Отвори notepad и с copy/paste въведи следната информация:

Запази файла с име CFScript и го провлачи с мишката и го пусни в ComboFix:

Прами ми новия лог файл.

givens:

ComboFix 09-10-06.04 - Iurist 10/07/2009 13:34.13.1 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.255.158 [GMT 3:00]

Running from: c:\documents and settings\Iurist\Desktop\ComboFix2.exe

Command switches used :: c:\documents and settings\Iurist\Desktop\CFScript.txt

FILE ::

"C:\kaldata.exe"

"c:\windows\system32\xiu.dll"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\avg8

c:\documents and settings\All Users\Application Data\avg8\Cfg\krnl.cfg

c:\documents and settings\All Users\Application Data\avg8\Cfg\mail.cfg

c:\documents and settings\All Users\Application Data\avg8\Cfg\malrep.cfg

c:\documents and settings\All Users\Application Data\avg8\Cfg\scan.cfg

c:\documents and settings\All Users\Application Data\avg8\Cfg\sched.cfg

c:\documents and settings\All Users\Application Data\avg8\Cfg\update.cfg

c:\documents and settings\All Users\Application Data\avg8\Cfg\user.cfg

c:\documents and settings\All Users\Application Data\avg8\CfgAll\changecfgreg.cfg

c:\documents and settings\All Users\Application Data\avg8\CfgAll\krnlall.cfg

c:\documents and settings\All Users\Application Data\avg8\CfgAll\srmall.cfg

c:\documents and settings\All Users\Application Data\avg8\CfgAll\updateall.cfg

c:\documents and settings\All Users\Application Data\avg8\Log\avgcfg.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\avgcore.log

c:\documents and settings\All Users\Application Data\avg8\Log\avgcore.log.1

c:\documents and settings\All Users\Application Data\avg8\Log\avgcore.log.10

c:\documents and settings\All Users\Application Data\avg8\Log\avgcore.log.2

c:\documents and settings\All Users\Application Data\avg8\Log\avgcore.log.3

c:\documents and settings\All Users\Application Data\avg8\Log\avgcore.log.4

c:\documents and settings\All Users\Application Data\avg8\Log\avgcore.log.5

c:\documents and settings\All Users\Application Data\avg8\Log\avgcore.log.6

c:\documents and settings\All Users\Application Data\avg8\Log\avgcore.log.7

c:\documents and settings\All Users\Application Data\avg8\Log\avgcore.log.8

c:\documents and settings\All Users\Application Data\avg8\Log\avgcore.log.9

c:\documents and settings\All Users\Application Data\avg8\Log\avgcore.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\avgfrw.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\avgldr.log

c:\documents and settings\All Users\Application Data\avg8\Log\avgldr.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\avglng.log

c:\documents and settings\All Users\Application Data\avg8\Log\avglng.log.1

c:\documents and settings\All Users\Application Data\avg8\Log\avglng.log.10

c:\documents and settings\All Users\Application Data\avg8\Log\avglng.log.2

c:\documents and settings\All Users\Application Data\avg8\Log\avglng.log.3

c:\documents and settings\All Users\Application Data\avg8\Log\avglng.log.4

c:\documents and settings\All Users\Application Data\avg8\Log\avglng.log.5

c:\documents and settings\All Users\Application Data\avg8\Log\avglng.log.6

c:\documents and settings\All Users\Application Data\avg8\Log\avglng.log.7

c:\documents and settings\All Users\Application Data\avg8\Log\avglng.log.8

c:\documents and settings\All Users\Application Data\avg8\Log\avglng.log.9

c:\documents and settings\All Users\Application Data\avg8\Log\avglng.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\avgns.log

c:\documents and settings\All Users\Application Data\avg8\Log\avgns.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log

c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.1

c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.10

c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.2

c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.3

c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.4

c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.5

c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.6

c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.7

c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.8

c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.9

c:\documents and settings\All Users\Application Data\avg8\Log\avgrs.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\avgscan.log

c:\documents and settings\All Users\Application Data\avg8\Log\avgscan.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\avgsched.log.1

c:\documents and settings\All Users\Application Data\avg8\Log\avgsched.log.10

c:\documents and settings\All Users\Application Data\avg8\Log\avgsched.log.2

c:\documents and settings\All Users\Application Data\avg8\Log\avgsched.log.3

c:\documents and settings\All Users\Application Data\avg8\Log\avgsched.log.4

c:\documents and settings\All Users\Application Data\avg8\Log\avgsched.log.5

c:\documents and settings\All Users\Application Data\avg8\Log\avgsched.log.6

c:\documents and settings\All Users\Application Data\avg8\Log\avgsched.log.7

c:\documents and settings\All Users\Application Data\avg8\Log\avgsched.log.8

c:\documents and settings\All Users\Application Data\avg8\Log\avgsched.log.9

c:\documents and settings\All Users\Application Data\avg8\Log\avgsched.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\avgsrm.log

c:\documents and settings\All Users\Application Data\avg8\Log\avgsrm.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\avgui.log

c:\documents and settings\All Users\Application Data\avg8\Log\avgui.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\avgupd.log

c:\documents and settings\All Users\Application Data\avg8\Log\avgupd.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\avgwd.log.1

c:\documents and settings\All Users\Application Data\avg8\Log\avgwd.log.10

c:\documents and settings\All Users\Application Data\avg8\Log\avgwd.log.2

c:\documents and settings\All Users\Application Data\avg8\Log\avgwd.log.3

c:\documents and settings\All Users\Application Data\avg8\Log\avgwd.log.4

c:\documents and settings\All Users\Application Data\avg8\Log\avgwd.log.5

c:\documents and settings\All Users\Application Data\avg8\Log\avgwd.log.6

c:\documents and settings\All Users\Application Data\avg8\Log\avgwd.log.7

c:\documents and settings\All Users\Application Data\avg8\Log\avgwd.log.8

c:\documents and settings\All Users\Application Data\avg8\Log\avgwd.log.9

c:\documents and settings\All Users\Application Data\avg8\Log\avgwd.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\avgwdsvc.log

c:\documents and settings\All Users\Application Data\avg8\Log\avgwdsvc.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\commonpriv.log

c:\documents and settings\All Users\Application Data\avg8\Log\commonpriv.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\fixcfg.log

c:\documents and settings\All Users\Application Data\avg8\Log\fixcfg.log.lock

c:\documents and settings\All Users\Application Data\avg8\Log\history.xml

c:\documents and settings\All Users\Application Data\avg8\scanlogs\I_00000001.log

c:\documents and settings\All Users\Application Data\avg8\scanlogs\I_00000009.log

c:\documents and settings\All Users\Application Data\avg8\scanlogs\I_00000010.log

c:\documents and settings\All Users\Application Data\avg8\scanlogs\I_00000011.log

c:\documents and settings\All Users\Application Data\avg8\scanlogs\I_00000012.log

c:\documents and settings\All Users\Application Data\avg8\scanlogs\I_00000013.log

c:\documents and settings\All Users\Application Data\avg8\scanlogs\I_00000014.log

c:\documents and settings\All Users\Application Data\avg8\scanlogs\I_00000015.log

c:\documents and settings\All Users\Application Data\avg8\scanlogs\srm.idx

c:\documents and settings\All Users\Application Data\avg8\update\backup\cf.dat

c:\documents and settings\All Users\Application Data\avg8\update\backup\incavi.avm

c:\documents and settings\All Users\Application Data\avg8\update\backup\microavi.avg

c:\documents and settings\All Users\Application Data\avg8\update\backup\ph.dat

c:\documents and settings\All Users\Application Data\avg8\update\backup\sb.dat

c:\documents and settings\All Users\Application Data\avg8\update\backup\sb.dat.xcd

c:\documents and settings\All Users\Application Data\avg8\update\backup\sb2.dat

c:\documents and settings\All Users\Application Data\avg8\update\backup\sc.dat

c:\documents and settings\All Users\Application Data\avg8\update\backup\sc.dat.xcd

c:\documents and settings\All Users\Application Data\avg8\update\prepare\incavi.avm

c:\documents and settings\All Users\Application Data\avg8\update\prepare\sb.dat.prepare

c:\documents and settings\All Users\Application Data\avg8\update\prepare\sc.dat.prepare

C:\kaldata.exe

c:\program files\AVG

c:\windows\system32\xiu.dll

.

--------------- FCopy ---------------

c:\windows\system32\dllcache\explorer.exe --> c:\windows\explorer.exe

.

((((((((((((((((((((((((( Files Created from 2009-09-07 to 2009-10-07 )))))))))))))))))))))))))))))))

.

2009-10-07 10:12 . 2009-10-07 10:12 396288 ----a-w- C:\HijackThis.exe

2009-10-07 05:39 . 2009-09-10 11:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-07 05:39 . 2009-09-10 11:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-10-07 05:39 . 2009-10-07 05:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-10-06 12:18 . 2004-08-04 12:00 30208 ----a-w- c:\windows\system32\dllcache\sm87w.dll

2009-10-06 12:17 . 2004-08-04 12:00 70656 ----a-w- c:\windows\system32\dllcache\korwbrkr.dll

2009-10-06 12:16 . 2004-08-04 12:00 42496 ----a-w- c:\windows\system32\dllcache\davcdata.exe

2009-10-06 12:15 . 2004-08-04 12:00 68608 ----a-w- c:\windows\system32\dllcache\isatq.dll

2009-10-06 12:11 . 2004-08-04 12:00 16384 ----a-w- c:\windows\system32\dllcache\isignup.exe

2009-10-06 12:08 . 2009-10-06 12:08 -------- d-----w- c:\program files\Windows Media Connect 2

2009-10-06 11:56 . 2004-08-04 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll

2009-10-06 11:56 . 2004-08-04 12:00 24661 ----a-w- c:\windows\system32\dllcache\spxcoins.dll

2009-10-06 11:56 . 2004-08-04 12:00 13312 ----a-w- c:\windows\system32\irclass.dll

2009-10-06 11:56 . 2004-08-04 12:00 13312 ----a-w- c:\windows\system32\dllcache\irclass.dll

2009-10-06 11:47 . 2009-10-06 11:47 -------- d-----w- c:\windows\system32\drivers\UMDF

2009-10-06 11:47 . 2009-10-06 11:47 -------- d-----w- c:\windows\msapps

2009-10-06 11:47 . 2009-10-06 11:47 -------- d-----w- c:\windows\l2schemas

2009-10-05 04:24 . 2009-10-05 04:24 -------- d-----w- c:\windows\system32\NtmsData

2009-10-02 11:03 . 2009-10-02 11:03 -------- d-----w- c:\windows\system32\CatRoot_bak

2009-09-30 12:21 . 2009-09-30 12:21 -------- d-----w- c:\documents and settings\Iurist\Application Data\Malwarebytes

2009-09-30 12:20 . 2009-09-30 12:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-24 08:46 . 2009-09-24 08:46 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-07 04:39 . 2008-07-14 18:06 37960 ----a-w- c:\documents and settings\Iurist\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-10-06 12:09 . 2008-07-14 17:47 22720 ----a-w- c:\windows\system32\emptyregdb.dat

2009-09-01 04:37 . 2009-09-01 04:37 -------- d-----w- c:\program files\uTorrent [tfile.ru]

2009-08-14 05:37 . 2009-08-14 05:37 1744 ----a-w- c:\windows\system32\d3d9caps.dat

2009-08-14 05:37 . 2009-08-14 05:37 1632 ----a-w- c:\windows\system32\d3d8caps.dat

2009-08-06 04:44 . 2009-08-04 04:43 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-06-30 2329224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WHITNEY2_XRX_S2P"="c:\program files\Xerox\Xerox Phaser 3200MFP\PSU\Scan2pc.exe" [2007-04-09 253952]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]

"IE7-10"="advpack.dll" - c:\windows\system32\advpack.dll [2007-05-29 124928]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2008-7-14 151552]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\winver.exe"=

"c:\\WINDOWS\\System32\\LMabcoms.exe"=

"c:\\Program Files\\uTorrent [tfile.ru]\\utorrent.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 ApisIupd2005;ApisIupd2005;d:\apis\Apis6Euro\App\iupd\IUPD7.exe [7/15/2008 2:24 AM 1526272]

S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [5/21/2009 3:15 PM 26224]

.

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

TCP: {99B2458D-B213-4442-AED0-3100DEE7D2CF} = 212.39.90.42,212.39.90.43

FF - ProfilePath - c:\documents and settings\Iurist\Application Data\Mozilla\Firefox\Profiles\fnalx9jd.default\

FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official

FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=

FF - component: c:\documents and settings\Iurist\Application Data\Mozilla\Firefox\Profiles\fnalx9jd.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\components\FFalert.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-07 13:40

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]

"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2540)

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-10-07 13:42 - machine was rebooted

ComboFix-quarantined-files.txt 2009-10-07 10:42

ComboFix2.txt 2009-10-07 06:12

ComboFix3.txt 2009-10-06 12:57

ComboFix4.txt 2009-10-06 10:31

ComboFix5.txt 2009-10-07 10:33

Pre-Run: 5,348,843,520 bytes free

Post-Run: 5,318,844,416 bytes free

238

Аз:

Може ли да архивирате папката C:\Qoobox и да я качите на този адрес:

http://4storing.com/

След това ми дайте линк за да я сваля.

Как се сега машината, защото лог файла бе успешен. Имаме съвсем малко работа. (или поне така се надявам)

Ето лик за един от проблемит

http://4storing.com/di255a/f7e3e740908d6b4f4ff1a45a2eb0960b.html

Ето и как изглежда другия

http://4storing.com/fqb4zk/1dbccaa294d7d1d9fecf7858b408c381.html

Ето и архивираната папка

http://4storing.com/tr8l5v/bd93454be5e652bc5354e09d58013ff6.html

За проблем 1 пробвайте да изтриете иконата с десен бутон върху нея => Delete => на въпроса дали сте сигурни изберете => Yes

След това с десен бутон на мишката върху празно място на десктопа => Properties => Desktop => Customize => сложете отметка пред My Computer => натиснете OK.

За проблем 2 изтеглете този файл => http://www.dougknox.com/xp/fileassoc/xp_cpl_file_assoc.zip

Разархивирайте го и го стартирайте. Изберете YES, за да влезнат промените в сила.

Рестартирайте машината и вижте дали проблемите остават.