Explorer.exe е заразен [Решен]

3 октомври 200916 г.

Имам уинбоз виста и преди около месец съм свалил някъкъв вирус който дори нод 32 версия 4 и от тогава когато затворя каквото и да е процесора отива на 100% и трябва ръчно да рестартирам еxplorer.exe.

3 октомври 200916 г.

Здравейте!

Следвайте инструкциите от тази тема:

http://www.kaldata.com/forums/index.php?showtopic=132819

Представете лог файловете и от двете програми, като следвате инструкциите в последователността, в която са дадени. Когато някой колега се появи, веднага ще Ви поеме.

4 октомври 200916 г.

Автор

направих всичко по инструкциите и ето логовете:

на първата Malwarebytes' Anti-Malware 1.41

Версия на базата от данни: 2899

Windows 6.0.6001 Service Pack 1

3.10.2009 г. 17:45:17

mbam-log-2009-10-03 (17-45-17).txt

Тип сканиране: Пълно сканиране (C:\|D:\|E:\|F:\|G:\|H:\|)

Сканирани обекти: 337773

Изминало време: 2 hour(s), 25 minute(s), 30 second(s)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 0

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 0

Заразени файлове: 3

Заразени процеси в паметта:

(Не бяха открити заплахи)

Заразени модули в паметта:

(Не бяха открити заплахи)

Заразени ключове в регистратурата:

(Не бяха открити заплахи)

Заразени стойности в регистратурата:

(Не бяха открити заплахи)

Заразени информационни обекти в регистратурата:

(Не бяха открити заплахи)

Заразени папки:

(Не бяха открити заплахи)

Заразени файлове:

C:\downloads\gmaker80beta.exe (Adware.EShoper) -> Quarantined and deleted successfully.

C:\Users\Фодор\Desktop\програми ФодоР\Windows Vista Activated by Clony\VistaActivator.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Windows\System32\kr_done1 (Malware.Trace) -> Quarantined and deleted successfully.

на втората

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:08 ч., on 4.10.2009 г.

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18248)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Launch Manager\LManager.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\ESET\ESET Smart Security\egui.exe

C:\Program Files\VVSN\VVSN.exe

C:\Program Files\VMware\vmware-tray.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\uTorrent2\uTorrent.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\system32\igfxext.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\explorer.exe

C:\Windows\system32\conime.exe

C:\Program Files\JGsoft\EditPadPro6\EditPadPro.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0402&s=2&o=vb32&d=1208&m=e520

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://adventurersbg.info

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0402&s=2&o=vb32&d=1208&m=e520

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0402&s=2&o=vb32&d=1208&m=e520

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)

O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - (no file)

O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe

O4 - HKLM\..\Run: [vmware-tray] "C:\Program Files\VMware\vmware-tray.exe"

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent2\uTorrent.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [daemon] C:\Program Files\DAEMON Tools Lite\daemon.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICO LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICO LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Servico de rede')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\vmware\vsocklib.dll

O13 - Gopher Prefix:

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - (no file)

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe

O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe

O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\EMACHINES\eMachines Recovery Management\Service\ETService.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Услуга Google Update (gupdate1c9ed0ba5e15fed) (gupdate1c9ed0ba5e15fed) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)

O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - C:\Program Files\Borland\InterBase\bin\ibguard.exe

O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - C:\Program Files\Borland\InterBase\bin\ibserver.exe

O23 - Service: InterBase InterClient Server (InterServer) - InterBase - C:\Program Files\Borland\InterBase\InterClient\bin\interserver.exe

O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit (mi-raysat_3dsMax2009_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe

O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\vmware-ufad.exe

O23 - Service: VCL MySQL Database Server - Unknown owner - C:\Музика и програми на ФодоР\Virtual Chemistry Lab 2.0\mysql\bin\mysqld.exe

O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\vmware-authd.exe

O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe

O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

--

End of file - 9073 bytes

това е сичко

4 октомври 200916 г.

Здравейте FodoR!

Аз съм Maniac и ще Ви помагам да почистите вашата система от зловреден софтуер. Анализа на логовете, както и премахването на зловредния софтуер, може да отнеме време, затова моля бъдете търпеливи. Моля, имайте предвид следното:

Аз ще Ви помагам само за почистването на вашата система от зловреден софтуер. За всякакви други проблеми, моля създайте нова тема в съответния форум и опишете детайлно проблема Ви.
Решението се отнася само за този проблем и само на този компютър.
Задължително трябва да разполагате с администраторски привилегии, за да получим възможността успешно да почистим вашата системата.
Следвайте инструкциите ми стриктно, докато не Ви кажа, че системата Ви е напълно чиста. Това, че симптомите са изчезнали, не значи че всичко е наред.
Ако не разбирате нещо, моля Ви попитайте ме, а не рискувайте. По-добре е малко да се позабавим, отколкото да усложним нещата.
При наличие на руткит, аз не гарантирам 100% почистване.
Проявете търпение, защото процедурата по почистването на вашата система може да отнеме известно време, в зависимост от вида на зловредния софтуер.
Цялата кореспонденция минава през тази тема, не създавайте нова тема и не използвайте друга тема за тази цел.

Явно този колега ще съм аз. :cool:

Стъпка 1:

Моля, отворете HijackThis, и изберете Do a system scan only.

Сложете отметки на следните редове:

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)

O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - (no file)

O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - (no file)

O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)

След това, затворете всички отворени прозорци, освен този на HiJackThis, и изберете Fix checked.

Стъпка 2:

Изтеглете Security Check от screen317 от тук или тук и го запаметете на вашия десктоп.

Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия Ви коментар в тази тема.

Стъпка 3:

Изтеглете RootRepeal от тук и го запазете на вашия десктоп. След това, разархивирайте го на вашия десктоп, отново.

Кликнете два пъти върху RootRepeal.exe , за да стартирате програмата
Кликнете на таба Report в долната част на прозореца
Кликнете на бутона Scan
Сложете отметки пред следното:

Drivers
Processes
SSDT
Hidden Services

Кликнете на бутона OK
На следващия диалогов прозорец, сложете отметки преди всички дялове (C:\ , D:\ ....)
Кликнете на OK, за да започне процеса на сканиране

Бележка: Процеса на сканиране може да отнеме време. Моля,

не стартирайте

никакви програми, докато програмата сканира.

Когато сканирането завърши успешно ще се появи бутона Save Report
Кликнете върху Save Report и запишете лог файла на вашия десктоп, с име RootRepeal.txt
Отворете File, след което Exit , за да затворите програмата.

Копирайте и поставете съдържанието на RootRepeal.txt в следващия си пост.

2

4 октомври 200916 г.

Автор

Ето на пъервата

Results of screen317's Security Check version 0.99.0

Windows Vista Service Pack 1 (UAC is enabled)

Out of date service pack!!

``````````````````````````````

Antivirus/Firewall Check:

ESET Smart Security

WMIC entry does not exist for antivirus; attempting automatic update.

``````````````````````````````

Anti-malware/Other Utilities Check:

HijackThis 2.0.2

CCleaner (remove only)

Java 2 Runtime Environment Standard Edition v1.2.2

Adobe Flash Player 10

Adobe Reader 8.1.0

Out of date Adobe Reader installed!

``````````````````````````````

Process Check:

objlist.exe by Laurent

``````````````````````````````

DNS Vulnerability Check:

GREAT! (Not vulnerable to DNS cache poisoning)

`````````End of Log```````````

ето на втората

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/10/04 09:15

Program Version: Version 1.3.5.0

Windows Version: Windows Vista SP1

==================================================

Drivers

-------------------

Name: dump_dumpata.sys

Image Path: C:\Windows\System32\Drivers\dump_dumpata.sys

Address: 0x8BCC7000 Size: 45056 File Visible: No Signed: -

Status: -

Name: dump_msahci.sys

Image Path: C:\Windows\System32\Drivers\dump_msahci.sys

Address: 0x8BCD2000 Size: 40960 File Visible: No Signed: -

Status: -

Name: rootrepeal.sys

Image Path: C:\Windows\system32\drivers\rootrepeal.sys

Address: 0xAEBB6000 Size: 49152 File Visible: No Signed: -

Status: -

Name: sptd

Image Path: \Driver\sptd

Address: 0x00000000 Size: 0 File Visible: No Signed: -

Status: -

Name: spus.sys

Image Path: C:\Windows\System32\Drivers\spus.sys

Address: 0x80697000 Size: 1040384 File Visible: No Signed: -

Status: -

Processes

-------------------

Path: System

PID: 4 Status: Locked to the Windows API!

Path: C:\Windows\System32\audiodg.exe

PID: 1236 Status: Locked to the Windows API!

==EOF==

4 октомври 200916 г.

Супер!

Стъпка 1:

Моля, отидете на Start --> Settings --> Control Panel --> Add or Remove Programs, и деинсталирайте следните програми (Ако присъстват в списъка):

Adobe Reader 8.1.0

Това е много стара и уязвима версия на Adobe Reader. Ако държите на нея, винаги се грижете тя да е up-to-date:

http://www.kaldata.com/comments.php?id=42956&catid=1&highlight=adobe+reader

В противен случай, насочете се към нейна алтернатива, която е по-бърза, по-лека, по-сигурна и по-малка:

http://www.kaldata.com/comments.php?id=50098&catid=1&highlight=foxit+reader

Стъпка 2:

Изтеглете LSP-Fix и го запазете на вашия десктоп.

1. Стартирайте го

2. Сложете отметка на I know what I'm doing

3. Кликнете върху файла vsocklib.dll и след това, цъкнете върху бутона >>

4. Накрая изберете Finish

Повторете процедурата и с файла wpclsp.dll, като след Finish рестартирайте компютъра си.

Стъпка 3:

Изтеглете ComboFix от някой от следните линкове:

Линк 1

Линк 2

* ВАЖНО !!! Запазете ComboFix.exe на вашия десктоп

Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

Преименувайте ComboFix.exe на Tool.exe

Стартирайте Tool.exe и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

1

4 октомври 200916 г.

Автор

инсталирах адобе ридъра ,но не мога да пусна ЛСП–фикс:

4 октомври 200916 г.

Имате ли администраторски права? Ако нямате, стартирайте го с администраторски права, ако не изтрийте и инсталирайте програмата отново.

4 октомври 200916 г.

Автор

Имам администраторски права.Не иска да тръгне...

Редактирано 4 октомври 200916 г. от FodoR (преглед на промените)

4 октомври 200916 г.

Добре, няма проблем. Продължете нататък.

4 октомври 200916 г.

Автор

Ето от Комбо фиксерът

ComboFix 09-10-03.01 - Фодор 10.2009 г. 14:34.1.1 - NTFSx86

Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1251.359.2070.18.1977.834 [GMT 1:00]

Running from: c:\users\Фодор\Downloads\ComboFix.exe

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\$recycle.bin\S-1-5-21-1891059771-1908516478-2069820796-1001

c:\$recycle.bin\S-1-5-21-1891059771-1908516478-2069820796-1002

c:\$recycle.bin\S-1-5-21-1891059771-1908516478-2069820796-1004

c:\$recycle.bin\S-1-5-21-1891059771-1908516478-2069820796-500

c:\$recycle.bin\S-1-5-21-300333245-3506868601-414586884-500

c:\users\Фодор\AppData\Roaming\.#

c:\users\Фодор\AppData\Roaming\.#\MBX@94C@26D1F50.###

c:\users\Фодор\AppData\Roaming\.#\MBX@94C@26D1F60.###

c:\users\Фодор\AppData\Roaming\.#\MBX@94C@26D1F70.###

c:\users\Фодор\AppData\Roaming\.#\MBX@CB4@21B1F50.###

c:\users\Фодор\AppData\Roaming\.#\MBX@CB4@21B1F60.###

c:\users\Фодор\AppData\Roaming\.#\MBX@CB4@21B1F70.###

c:\users\”®¤®а\Documents\аҐЈЁбв а1.reg

c:\windows\system32\Trial The Santa Claus 3D.dll

.

((((((((((((((((((((((((( Files Created from 2009-09-04 to 2009-10-04 )))))))))))))))))))))))))))))))

.

2009-10-04 14:04 . 2009-10-04 14:05 -------- d-----w- c:\users\Фодор\AppData\Local\temp

2009-10-04 14:04 . 2009-10-04 14:04 -------- d-----w- c:\users\Default\AppData\Local\temp

2009-10-04 00:08 . 2009-10-04 00:08 -------- d-----w- c:\program files\Trend Micro

2009-10-03 20:32 . 2005-10-15 13:42 1552384 ----a-w- c:\windows\system32\myodbc3.dll

2009-10-03 20:32 . 2005-10-15 13:42 28672 ----a-w- c:\windows\system32\myodbc3i.exe

2009-10-03 20:32 . 2005-10-15 13:42 2183168 ----a-w- c:\windows\system32\myodbc3S.dll

2009-10-03 20:32 . 2005-10-15 13:42 11776 ----a-w- c:\windows\system32\myodbc3m.exe

2009-10-03 20:32 . 2005-10-15 13:42 2056192 ----a-w- c:\windows\system32\myodbc3c.exe

2009-10-03 20:32 . 2004-02-23 00:00 78848 ----a-w- c:\windows\system32\MSBIND.DLL

2009-10-03 20:32 . 2003-07-04 06:42 731 ----a-w- c:\windows\system32\xpstylelib.dll

2009-10-03 20:32 . 2003-01-26 12:41 40960 ----a-w- c:\windows\system32\SSubTmr6.dll

2009-10-03 12:53 . 2009-10-03 12:53 -------- d-----w- c:\users\Фодор\AppData\Roaming\Malwarebytes

2009-10-03 12:53 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-03 12:53 . 2009-10-03 12:53 -------- d-----w- c:\programdata\Malwarebytes

2009-10-03 12:53 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-10-03 12:53 . 2009-10-03 12:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-09-30 17:17 . 2009-10-02 21:27 -------- d-----w- c:\users\Фодор\AppData\Roaming\VMware

2009-09-30 17:10 . 2009-08-14 12:40 55856 ----a-w- c:\windows\system32\vnetinst.dll

2009-09-30 17:10 . 2009-08-14 12:40 16560 ----a-w- c:\windows\system32\drivers\vmnetadapter.sys

2009-09-30 17:10 . 2009-08-14 19:19 326192 ----a-w- c:\windows\system32\vmnetdhcp.exe

2009-09-30 17:10 . 2009-08-14 19:19 399920 ----a-w- c:\windows\system32\vmnat.exe

2009-09-30 17:10 . 2009-08-14 19:20 26288 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys

2009-09-30 17:10 . 2009-08-14 12:40 50736 ----a-r- c:\windows\system32\vmnetbridge.dll

2009-09-30 17:10 . 2009-08-14 12:40 31280 ----a-r- c:\windows\system32\drivers\vmnetbridge.sys

2009-09-30 17:10 . 2009-08-14 12:40 18736 ----a-r- c:\windows\system32\drivers\vmnet.sys

2009-09-30 17:10 . 2009-08-14 19:19 723504 ----a-w- c:\windows\system32\vnetlib.dll

2009-09-30 17:09 . 2009-08-14 19:20 23216 ----a-w- c:\windows\system32\drivers\VMkbd.sys

2009-09-30 17:04 . 2009-10-03 16:52 -------- d-----w- c:\programdata\VMware

2009-09-30 17:02 . 2009-09-30 17:08 -------- d-----w- c:\program files\VMware

2009-09-29 13:55 . 2009-09-09 19:15 115856 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys

2009-09-29 13:54 . 2009-09-09 19:15 41424 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys

2009-09-29 13:54 . 2009-09-29 13:54 -------- d-----w- c:\program files\Sun

2009-09-26 21:44 . 2009-09-26 21:44 -------- d-----w- c:\windows\system32\Adobe

2009-09-26 20:43 . 2009-09-26 20:47 -------- d-----w- c:\users\Фодор\.VirtualBox

2009-09-26 20:34 . 2009-09-26 20:38 71653904 ----a-w- C:\VirtualBox-3.0.6-52128-Win.exe

2009-09-26 12:13 . 2009-09-26 12:13 2560 ----a-w- c:\windows\_MSRSTRT.EXE

2009-09-25 19:25 . 2009-09-25 19:26 -------- d-----w- c:\program files\Valve Hammer Editor

2009-09-24 12:30 . 2009-09-26 12:18 -------- d-----w- c:\program files\Google

2009-09-23 20:11 . 2009-09-24 23:22 -------- d-----w- C:\Patevoditel

2009-09-22 17:19 . 2009-09-22 17:19 -------- d-----w- C:\Rarlab.WinRAR.v3.90.Bulgarian.Incl.Regfile-Zamunda

2009-09-21 09:40 . 2009-09-21 09:40 -------- d-----w- c:\program files\12Voip.com

2009-09-20 23:00 . 2009-09-21 09:42 -------- d-----w- c:\users\Фодор\AppData\Roaming\12Voip

2009-09-19 20:54 . 2009-09-19 20:54 -------- d-----w- c:\programdata\Astar Games

2009-09-18 16:56 . 2009-09-18 16:56 -------- d-----w- c:\users\Фодор\AppData\Local\id Software

2009-09-18 16:45 . 2009-09-18 16:45 139152 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2009-09-18 16:45 . 2009-09-18 16:45 139152 ----a-w- c:\users\Фодор\AppData\Roaming\PnkBstrK.sys

2009-09-18 16:45 . 2009-09-18 16:45 111928 ----a-w- c:\windows\system32\PnkBstrB.exe

2009-09-18 16:45 . 2009-09-18 16:45 75064 ----a-w- c:\windows\system32\PnkBstrA.exe

2009-09-18 16:45 . 2009-09-18 16:45 794408 ----a-w- c:\windows\system32\pbsvc.exe

2009-09-18 16:03 . 2009-09-18 16:03 -------- d-----w- c:\program files\Activision

2009-09-15 18:08 . 2009-09-15 18:08 -------- d-----w- c:\programdata\NOS

2009-09-15 18:08 . 2009-09-15 18:08 -------- d-----w- c:\program files\NOS

2009-09-15 18:08 . 2009-09-03 10:53 30912 ----a-w- c:\users\Фодор\AppData\Roaming\Mozilla\Firefox\Profiles\43gtkcr2.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll

2009-09-15 18:08 . 2009-09-03 10:53 22848 ----a-w- c:\users\Фодор\AppData\Roaming\Mozilla\Firefox\Profiles\43gtkcr2.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg_bootstrap.exe

2009-09-15 18:08 . 2009-09-03 10:53 19792 ----a-w- c:\users\Фодор\AppData\Roaming\Mozilla\Firefox\Profiles\43gtkcr2.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe

2009-09-14 16:05 . 2009-09-14 16:05 -------- d-----w- c:\users\Фодор\.borland

2009-09-14 15:30 . 2009-09-14 15:30 -------- d-----w- C:\Inprise

2009-09-14 15:29 . 1999-10-23 13:41 55808 ------w- c:\windows\system32\ActPanel.dll

2009-09-14 15:29 . 2009-09-14 15:29 -------- d-----w- c:\program files\JavaSoft

2009-09-14 15:27 . 2001-11-28 23:50 177152 ----a-w- c:\windows\system32\ibinstall.dll

2009-09-14 15:26 . 2001-11-28 23:50 28672 ----a-w- c:\windows\system32\ibxml.dll

2009-09-14 15:26 . 2001-11-28 23:50 376832 ----a-w- c:\windows\system32\gds32.dll

2009-09-14 15:09 . 2009-09-14 15:26 -------- d-----w- c:\program files\Borland

2009-09-14 15:09 . 2009-09-14 15:14 -------- d-----w- c:\program files\Common Files\Borland Shared

2009-09-14 13:38 . 2009-09-14 13:38 -------- d-----w- c:\users\Фодор\AppData\Roaming\JGsoft

2009-09-14 13:38 . 2009-09-14 13:38 -------- d-----w- c:\program files\JGsoft

2009-09-14 13:38 . 2009-06-19 02:20 68232 ----a-w- c:\windows\UnDeployV.exe

2009-09-14 13:34 . 2009-09-14 13:34 0 ----a-w- c:\windows\nsreg.dat

2009-09-14 13:34 . 2009-09-14 13:34 -------- d-----w- c:\users\Фодор\AppData\Local\Mozilla

2009-09-12 18:58 . 2009-09-12 18:58 -------- d-----w- c:\users\Фодор\AppData\Local\Macromedia

2009-09-12 18:50 . 2009-09-12 18:50 -------- d-----w- c:\windows\system32\QuickTime

2009-09-10 08:21 . 2009-09-10 08:21 -------- d-----w- c:\users\Фодор\AppData\Roaming\Microsoft Games

2009-09-10 08:21 . 2009-09-10 08:21 -------- d-----w- c:\programdata\Microsoft Games

2009-09-09 19:42 . 2009-09-09 19:42 -------- d-----w- c:\program files\Common Files\NSV

2009-09-09 19:15 . 2009-09-09 19:15 91856 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys

2009-09-09 19:15 . 2009-09-09 19:15 133648 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll

2009-09-09 19:15 . 2009-09-09 19:15 100368 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys

2009-09-09 15:23 . 2009-09-17 18:32 -------- d-----w- C:\ESET NOD32 Antivirus 4.0.435 Bulgarian

2009-09-08 17:37 . 2009-09-08 17:39 -------- d-----w- c:\program files\Е107

2009-09-08 17:32 . 2009-09-09 21:04 -------- d-----w- c:\program files\VVSN

2009-09-08 17:31 . 2009-09-08 17:31 -------- d-----w- c:\program files\Crystal Player

2009-09-08 16:56 . 2009-09-26 12:17 -------- d-----w- c:\windows\uninstall

2009-09-08 16:29 . 2009-09-08 16:30 -------- d-----w- c:\program files\Spring

2009-09-08 16:21 . 2009-09-08 16:21 -------- d-----w- c:\program files\VISUALROUTE

2009-09-08 16:18 . 2009-09-08 16:18 7840 ----a-w- c:\windows\system32\mcdmsg5.dll

2009-09-08 16:18 . 2009-09-08 16:27 -------- d-----w- c:\program files\Common Files\Stardock

2009-09-08 16:17 . 2009-09-08 16:17 -------- d-----w- c:\program files\AutoCRYPT7

2009-09-08 16:07 . 2006-11-16 10:54 1470464 ----a-w- c:\windows\The Santa Claus 3D Trial.scr

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-04 14:05 . 2009-05-24 12:14 3932160 --sha-w- c:\users\Фодор\ntuser.dat

2009-10-04 14:04 . 2009-05-24 15:16 -------- d-----w- c:\users\Фодор\AppData\Roaming\uTorrent

2009-10-04 13:52 . 2009-06-14 16:17 -------- d-----w- c:\users\Фодор\AppData\Roaming\Skype

2009-10-04 12:18 . 2009-08-18 17:11 -------- d-----w- c:\users\Фодор\AppData\Roaming\FileZilla

2009-10-04 09:01 . 2009-05-27 15:28 -------- d-----w- c:\users\Фодор\AppData\Roaming\WinRAR

2009-10-04 08:45 . 2008-08-14 17:05 -------- d-----w- c:\program files\Common Files\Adobe

2009-10-04 07:08 . 2008-01-21 06:20 656224 ----a-w- c:\windows\system32\prfh0816.dat

2009-10-04 07:08 . 2008-01-21 06:20 130052 ----a-w- c:\windows\system32\prfc0816.dat

2009-10-04 07:03 . 2009-06-13 20:15 -------- d-----w- c:\users\Фодор\AppData\Roaming\skypePM

2009-10-04 06:54 . 2009-07-10 14:50 -------- d-----w- c:\users\Фодор\AppData\Roaming\Mozilla

2009-10-03 12:53 . 2009-10-03 12:53 -------- d-----w- c:\users\Фодор\AppData\Roaming\Malwarebytes

2009-10-02 21:27 . 2009-09-30 17:17 -------- d-----w- c:\users\Фодор\AppData\Roaming\VMware

2009-09-26 08:40 . 2009-08-18 17:11 -------- d-----w- c:\program files\FileZilla FTP Client

2009-09-25 16:47 . 2009-05-24 12:15 86472 ----a-w- c:\users\Фодор\AppData\Local\GDIPFONTCACHEV1.DAT

2009-09-21 09:42 . 2009-09-20 23:00 -------- d-----w- c:\users\Фодор\AppData\Roaming\12Voip

2009-09-18 16:53 . 2009-05-24 12:14 -------- d-s---w- c:\users\Фодор\AppData\Roaming\Microsoft

2009-09-18 16:45 . 2009-09-18 16:45 139152 ----a-w- c:\users\Фодор\AppData\Roaming\PnkBstrK.sys

2009-09-18 16:45 . 2008-08-14 16:44 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-09-14 13:38 . 2009-09-14 13:38 -------- d-----w- c:\users\Фодор\AppData\Roaming\JGsoft

2009-09-12 18:58 . 2009-05-24 12:16 -------- d-----w- c:\users\Фодор\AppData\Roaming\Macromedia

2009-09-12 18:54 . 2009-05-24 21:40 -------- d-----w- c:\program files\Macromedia

2009-09-10 08:21 . 2009-09-10 08:21 -------- d-----w- c:\users\Фодор\AppData\Roaming\Microsoft Games

2009-09-10 08:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Microsoft Games

2009-09-09 19:44 . 2009-06-22 08:51 -------- d-----w- c:\program files\Winamp

2009-09-08 16:33 . 2009-09-08 16:33 60083 ----a-w- c:\users\Фодор\ia_remove.sh9032.tmp

2009-09-08 15:06 . 2009-05-24 19:40 40 ----a-w- c:\windows\RSoftInfo.dat

2009-09-08 14:51 . 2009-06-02 08:48 -------- d-----w- c:\program files\ReflexiveArcade

2009-09-07 19:32 . 2009-06-24 16:45 -------- d-----w- c:\programdata\Rosetta Stone

2009-08-28 19:15 . 2009-08-28 19:15 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2009-08-28 10:05 . 2009-08-28 10:05 -------- d-----w- c:\program files\Lavalys

2009-08-27 21:28 . 2009-05-30 19:21 -------- d-----w- c:\programdata\Bimesoft

2009-08-27 21:27 . 2008-08-14 17:06 -------- d-----w- c:\programdata\Microsoft Help

2009-08-27 21:19 . 2009-07-01 16:25 -------- d-----w- c:\program files\Invadazoid

2009-08-17 15:29 . 2009-08-17 15:29 -------- d-----w- c:\users\Фодор\AppData\Roaming\InterVideo

2009-08-14 19:20 . 2009-08-14 19:20 32304 ----a-w- c:\windows\system32\drivers\hcmon.sys

2009-08-14 19:20 . 2009-08-14 19:20 54960 ----a-w- c:\windows\system32\drivers\vmci.sys

2009-08-14 19:20 . 2009-08-14 19:20 857520 ----a-w- c:\windows\system32\drivers\vmx86.sys

2009-08-14 14:17 . 2009-08-14 14:17 252464 ----a-w- c:\windows\system32\vmnc.dll

2009-08-12 14:56 . 2009-08-12 14:56 -------- d-----w- c:\users\Фодор\AppData\Roaming\Sahmon Games

2009-08-09 12:12 . 2009-08-09 12:12 680 ----a-w- c:\users\Фодор\AppData\Local\d3d9caps.dat

2009-08-07 11:37 . 2009-08-07 11:37 -------- d-----w- c:\users\Фодор\AppData\Roaming\Island

2009-08-05 15:23 . 2009-08-05 15:23 -------- d-----w- c:\users\Фодор\AppData\Roaming\PlayFirst

2009-08-05 15:23 . 2009-08-05 15:23 -------- d-----w- c:\programdata\PlayFirst

2009-08-05 15:21 . 2009-08-05 15:21 -------- d-----w- c:\program files\FreeGamePick.com

2009-08-03 21:30 . 2009-08-03 21:30 549 ----a-w- c:\windows\eReg.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-05-26 24264488]

"uTorrent"="c:\program files\uTorrent2\uTorrent.exe" [2009-07-07 288048]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-16 150040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-16 170520]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-16 145944]

"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-07-25 768520]

"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-12 2029640]

"VVSN"="c:\program files\VVSN\VVSN.exe" [2004-12-22 107520]

"vmware-tray"="c:\program files\VMware\vmware-tray.exe" [2009-08-14 96816]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-06-27 6244896]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-5-24 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\startupfolder\C:^Users^Фодор^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Iniciacao Rapida do Microsoft Office OneNote 2007.lnk]

path=c:\users\Фодор\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Iniciacao Rapida do Microsoft Office OneNote 2007.lnk

backup=c:\windows\pss\Iniciacao Rapida do Microsoft Office OneNote 2007.lnk.Startup

backupExtension=.Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{7D5666CB-C594-44AF-BDB8-52458DBAC7E7}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe

"{C685938C-CCA7-41F9-9BB8-6454E7AD10A6}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe

"{C875A510-F25E-4B27-B0A5-E1C91810A082}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe

"{56F55DD5-00DA-4A2E-BC2F-69F121FCC3DC}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe

"{19342910-52C8-4DD5-99A7-8548993AF6AF}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe

"{BBD375BB-F746-45BF-A331-AF47588FF6C5}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe

"{48207832-7FF9-42F9-BB45-524D779A45DC}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{7FFF791A-9F2E-4C0F-AF01-061DE300C1F8}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"TCP Query User{A19A784F-C78C-4E1A-87C9-A1C42F1E9A40}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"UDP Query User{0FC3B06D-2E90-418B-853F-5DB233B26285}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"TCP Query User{20321BE1-8471-4F36-B861-B4BD2148D882}e:\\keygen.folder.guard.8.1.exe"= UDP:E:\keygen.folder.guard.8.1.exe:Keygen.Folder.Guard.8.1

"UDP Query User{39CB941F-5C98-421C-8BE5-25DFEA202E17}e:\\keygen.folder.guard.8.1.exe"= TCP:E:\keygen.folder.guard.8.1.exe:Keygen.Folder.Guard.8.1

"TCP Query User{E9E726D5-F1B1-458D-B914-438BF1A592B2}e:\\crack.folder.guard.8.1.exe"= UDP:E:\crack.folder.guard.8.1.exe:Crack.Folder.Guard.8.1

"UDP Query User{D5C96EEC-4B18-4000-A0DD-6365EB4A9B35}e:\\crack.folder.guard.8.1.exe"= TCP:E:\crack.folder.guard.8.1.exe:Crack.Folder.Guard.8.1

"TCP Query User{FCBA0388-196D-469A-BC06-86B50C1B8BE1}c:\\игри\\return to castle wolfenstein\\wolfmp.exe"= UDP:c:\игри\return to castle wolfenstein\wolfmp.exe:WolfMP

"UDP Query User{5D025BF5-744A-4425-AB72-D862AE4543B1}c:\\игри\\return to castle wolfenstein\\wolfmp.exe"= TCP:c:\игри\return to castle wolfenstein\wolfmp.exe:WolfMP

"{8F45116A-DAC1-41A1-BC6D-75CF35F8D2FC}"= UDP:c:\program files\uTorrent2\uTorrent.exe:µTorrent (TCP-In)

"{349ACBF8-A49A-4173-9AE1-9FF7C3075B01}"= TCP:c:\program files\uTorrent2\uTorrent.exe:µTorrent (UDP-In)

"{09E9397B-9340-4218-A559-D910AE0E1C4E}"= UDP:c:\program files\BitComet\BitComet.exe:BitComet.exe

"{60EB8B6E-41B6-46FA-BB60-75CB8F7801E4}"= TCP:c:\program files\BitComet\BitComet.exe:BitComet.exe

"{03F3AEDE-D4BF-4111-9FC5-CE32B70EE722}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{9A7B9219-669D-4A55-ABA8-3A414479C455}"= c:\users\Фодор\Desktop\Rosetta Stone Version 3\RosettaStoneVersion3.exe:Rosetta Stone Version 3 Application

"{0FF68BA2-949D-4110-8428-9A27F2A860D5}"= c:\users\Фодор\Desktop\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe:Rosetta Stone Ltd Services

"{8EDC3033-914D-4503-9455-EF84EDE315FF}"= UDP:c:\program files\Autodesk\Backburner\monitor.exe:backburner 2.3 monitor

"{568B7966-5A03-4909-A439-580F02D36200}"= TCP:c:\program files\Autodesk\Backburner\monitor.exe:backburner 2.3 monitor

"{0041F388-C5BE-4575-B7D8-73B5215BD29F}"= UDP:c:\program files\Autodesk\Backburner\manager.exe:backburner 2.3 manager

"{45C0D36E-8BFA-4E74-AD49-BFC8F0864BC9}"= TCP:c:\program files\Autodesk\Backburner\manager.exe:backburner 2.3 manager

"{F91CF435-F6B1-45EF-BE33-701F33025371}"= UDP:c:\program files\Autodesk\Backburner\server.exe:backburner 2.3 server

"{1C4FDB1E-9FEE-4222-A440-7E6CE5CF7626}"= TCP:c:\program files\Autodesk\Backburner\server.exe:backburner 2.3 server

"{FF26CB61-7243-4CD5-B689-966ACB739E01}"= UDP:c:\program files\Autodesk\3ds Max 2009\3dsmax.exe:Autodesk 3ds Max 2009 32-bit

"{DC0DC9CA-1759-468B-98F7-13ADF76BEEDE}"= TCP:c:\program files\Autodesk\3ds Max 2009\3dsmax.exe:Autodesk 3ds Max 2009 32-bit

"{D26B45CC-D23B-4442-A423-7D01D7F35FAE}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{2ADC8625-0912-4EAA-B625-C5D5A15B078C}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{6F5B0A23-0D26-409E-BD5E-5040429A23A3}"= UDP:c:\program files\Microsoft Games\Zoo Tycoon 2\zt.exe:Zoo Tycoon 2 Executable

"{ABD76CA1-E82C-4168-8C64-61DE5CF1867C}"= TCP:c:\program files\Microsoft Games\Zoo Tycoon 2\zt.exe:Zoo Tycoon 2 Executable

"{48FAB255-BD9E-4A3E-A1D9-BDD6A9B26F9E}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{358AD328-9CE6-44AD-891F-14D7346859FE}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{051DEC9B-C854-417C-9FA5-C409A948568B}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{E42FE16C-A2D1-4196-BCEB-896E755D58DA}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{76FBBEAB-4636-440C-80BF-FD4E91E7FEDB}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{8698FD52-B037-456A-AF9E-5DBB9CC95240}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{CF3C0ADC-0A30-4559-AD86-8CC360B0B2BE}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{DF141448-B8C7-43B7-9F6E-01EAD27AA498}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{B244C546-E448-4689-93A7-EE81BACB0BC9}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{F685F817-6B79-4A16-873B-D293F94749BA}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{DD615C39-0FD8-4832-A4FA-A9F332583CD4}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{DD7B21F0-ECE0-4EA9-802B-331214E280CD}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{57D02B04-FC48-4602-A267-A4FB0EBA4003}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{C7F451A1-7026-43F3-8B99-69C0A763C708}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA

"{DA71F7FF-18AA-4409-9272-DE3E12FD60A5}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA

"{35F6836F-C0CC-464D-B0D4-66049E0EC9AC}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB

"{9BB63CD0-2410-490D-9EA0-FCA436ABA43F}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB

"{3EDD0031-D214-4F5F-AC9F-6633742F8EC9}"= UDP:c:\program files\Activision\Wolfenstein\MP\Wolf2MP.exe:Wolfenstein

"{E5C0057B-242D-41E4-9AC0-19A9186F604F}"= TCP:c:\program files\Activision\Wolfenstein\MP\Wolf2MP.exe:Wolfenstein

"{5654769F-BB7D-4E4D-A8F5-F99BDB6E6B3B}"= UDP:c:\program files\Activision\Wolfenstein\MP\Wolf2MPLite.exe:Wolfenstein

"{A02CBC88-0F1A-4DF2-963D-68F7950F1D61}"= TCP:c:\program files\Activision\Wolfenstein\MP\Wolf2MPLite.exe:Wolfenstein

"{770C4600-6434-453D-97DE-8323DDC33835}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{F9BCACAE-C528-498C-9EC0-6F822C73D91F}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{AE121979-6701-4205-A74F-39549CAF1C11}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{6DE09D3C-0599-42C2-8C80-4A9205941735}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{C820021B-9B04-48AA-A4DB-478E4D1BEEE3}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{1DDCE5F9-4C2D-4D1B-BB32-786DE6F999E8}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{7AC7FD73-B9B3-47AD-91C2-DAEC4A8B4A6B}"= UDP:c:\program files\12Voip.com\12Voip\12Voip.exe:12Voip

"{83D33930-4CF3-427F-B58E-C1123952AFB2}"= TCP:c:\program files\12Voip.com\12Voip\12Voip.exe:12Voip

"{0DD6F045-3B17-45CF-8C95-5199DDB37989}"= UDP:c:\program files\12Voip.com\12Voip\12Voip.exe:12Voip

"{21A99428-EF30-4A50-B3B0-66835C677C2B}"= TCP:c:\program files\12Voip.com\12Voip\12Voip.exe:12Voip

"{9B77CC5A-7C2E-42D3-B1C2-D5EE077A6813}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{159AF293-4473-475C-B0F1-2EB45C15A7A0}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{01A96246-907B-4535-B3D3-60A373AE5B73}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{60EE3C92-899F-41CA-BF9A-DE7CD16E7672}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{5742B8DD-3167-4070-AA72-85B0D18ED49C}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{71622089-F0DD-49E1-A81D-04105C6BF081}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{FB31E84D-6E46-4704-B787-74A426CAA7C6}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{869538C6-97A0-4D16-91C7-098C83090363}"= UDP:c:\program files\VMware\vmware-authd.exe:VMware Authd

"{4E0A059E-71A7-4C69-B13F-33727E481C11}"= TCP:c:\program files\VMware\vmware-authd.exe:VMware Authd

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"= 0 (0x0)

R1 ehdrv;ehdrv;c:\windows\System32\drivers\ehdrv.sys [12.5.2009 г. 06:33 107256]

R1 VBoxDrv;VirtualBox Service;c:\windows\System32\drivers\VBoxDrv.sys [29.9.2009 г. 14:55 115856]

R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\System32\drivers\VBoxUSBMon.sys [29.9.2009 г. 14:54 41424]

R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [3.3.2008 г. 13:11 16384]

R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [12.5.2009 г. 06:33 731840]

R2 epfwwfp;epfwwfp;c:\windows\System32\drivers\epfwwfp.sys [12.5.2009 г. 06:34 38240]

R2 ETService;Empowering Technology Service;c:\program files\EMACHINES\eMachines Recovery Management\Service\ETService.exe [26.12.2008 г. 10:38 24576]

R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [6.4.2008 г. 22:42 50424]

R2 regi;regi;c:\windows\System32\drivers\regi.sys [17.4.2007 г. 21:09 11032]

R2 vmci;VMware vmci;c:\windows\System32\drivers\vmci.sys [14.8.2009 г. 20:20 54960]

R2 WinFLdrv;WinFLdrv;c:\windows\System32\WinFLdrv.sys [11.6.2009 г. 18:15 10752]

R3 ActivHidSerMini;Promethean Serial Board Driver;c:\windows\System32\drivers\activhidsermini.sys [17.12.2008 г. 10:42 55424]

R3 prmvmouse;Promethean HID Mouse Service;c:\windows\System32\drivers\activmouse.sys [17.12.2008 г. 10:42 4352]

R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\System32\drivers\VBoxNetAdp.sys [9.9.2009 г. 20:15 91856]

R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\System32\drivers\VBoxNetFlt.sys [9.9.2009 г. 20:15 100368]

S2 gupdate1c9ed0ba5e15fed;Услуга Google Update (gupdate1c9ed0ba5e15fed);c:\program files\Google\Update\GoogleUpdate.exe [24.9.2009 г. 13:30 133104]

S2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [9.3.2008 г. 23:04 65536]

S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [4.4.2008 г. 03:03 131072]

S2 VCL MySQL Database Server;VCL MySQL Database Server;c:\музика и програми на фодор\Virtual Chemistry Lab 2.0\mysql\bin\mysqld.exe [3.10.2009 г. 21:32 3956736]

S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\System32\drivers\btnetBus.sys [7.12.2008 г. 12:44 30088]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Corporate Edition\kerneld.wnt [28.8.2009 г. 11:06 23152]

S3 getPlusHelper;getPlus® Helper;c:\windows\System32\svchost.exe -k getPlusHelper [21.1.2008 г. 03:33 21504]

S3 InterServer;InterBase InterClient Server;c:\program files\Borland\InterBase\InterClient\bin\interserver.exe [14.9.2009 г. 16:26 114176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

getPlusHelper REG_MULTI_SZ getPlusHelper

.

Contents of the 'Scheduled Tasks' folder

2009-10-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 12:30]

2009-10-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 12:30]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://adventurersbg.info

mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0402&s=2&o=vb32&d=1208&m=e520

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: E&xportar para o Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

LSP: c:\windows\system32\wpclsp.dll

LSP: c:\program files\VMware\vsocklib.dll

FF - ProfilePath - c:\users\Фодор\AppData\Roaming\Mozilla\Firefox\Profiles\43gtkcr2.default\

FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

.

- - - - ORPHANS REMOVED - - - -

HKLM-Run-eRecoveryService - (no file)

AddRemove-Counter-Strike 1.6 - c:\музика и програми на фодор\cs\Uninst.exe

AddRemove-D'Accord Drums Player 1.0_is1 - c:\музика и програми на фодор\D_Accord_Drums_Player\unins000.exe

AddRemove-Guitar Pro 5_is1 - c:\музика и програми на фодор\GuitarPro_5.2\GuitarPro 5.2\unins000.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-04 15:05

Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\windows\system32\sys_drv.dat 6024 bytes

c:\windows\system32\sys_drv_2.dat 5020 bytes

c:\users\Фодор\AppData\Roaming\systemfl.$dk 990 bytes

scan completed successfully

hidden files: 3

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EverestDriver]

"ImagePath"="\??\c:\program files\Lavalys\EVEREST Corporate Edition\kerneld.wnt"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1891059771-1908516478-2069820796-1000\Software\SecuROM\License information*]

"datasecu"=hex:23,5d,49,12,a0,2a,9d,fb,9a,d8,ac,89,59,3f,fc,27,c7,88,96,7d,a8,

a3,a7,6e,a6,ad,a4,61,c8,6f,01,e5,98,a4,ac,b2,54,f7,e4,e6,36,56,71,42,0f,2d,\

"rkeysecu"=hex:e7,c4,7f,c4,45,c1,81,16,8d,73,11,b5,02,5c,b9,d5

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Completion time: 2009-10-04 15:08

ComboFix-quarantined-files.txt 2009-10-04 14:08

Pre-Run: 55 278 800 896 bytes livres

Post-Run: 55 189 213 184 bytes livres

367 --- E O F --- 2009-07-16 10:18

4 октомври 200916 г.

Архивирайте папка Qoobox, която се намира в C:\ , качете я в www.rapidshare.com и пуснете линк за изтегляне в следващия Ви коментар придружен със състоянието на вашата система в момента.

5 октомври 200916 г.

Автор

Ето го Кулбоксът .А във моментът вече нямам проблем :giggle1: .

5 октомври 200916 г.

Честито!

Само деинсталирайте ComboFix:

За да деинсталирате ComboFix и всички резервни копия на файлове, които той премахва:

* Кликнете върху бутона Start и изберете Run
* Въведете ComboFix /u в полето и изберете OK

Бележка: Забележете, че има разстояние между ComboFix и /u, което задължително трябва да има.

Тази процедура ще:

Изтрие следното:

ComboFix и всички свързани с нея файлове и папки.
Backup на VundoFix (ако съществува).
Папката Deckard (ако съществува).
Папката _OtMoveIt (ако съществува).
Нулира настройките на часовника.
Скрива файлови разширения, ако е необходимо.
Скрива системни файлове, ако е необходимо.
Нулира

System Restore

.

5 октомври 200916 г.

Автор

Готово е.

Благодаря!!! :clap:

Добре дошли!

Explorer.exe е заразен [Решен]

Featured Replies

Регистрирайте се или влезете в профила си за да коментирате

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)