проблем с Task manager

18 октомври 200916 г.

Проблема ми е следния.Като се опитам да отворя Task manager (crtl+alt+del) ми изписва Task manager has been disabled by your administrator.Същото е с и Regedit.Какво да направя ?!?

18 октомври 200916 г.

Здравейте Brasnaro!

Аз съм Maniac и ще Ви помагам да почистите вашата система от зловреден софтуер. Анализа на логовете, както и премахването на зловредния софтуер, може да отнеме време, затова моля бъдете търпеливи. Моля, имайте предвид следното:

Аз ще Ви помагам само за почистването на вашата система от зловреден софтуер. За всякакви други проблеми, моля създайте нова тема в съответния форум и опишете детайлно проблема Ви.
Решението се отнася само за този проблем и само на този компютър.
Задължително трябва да разполагате с администраторски привилегии, за да получим възможността успешно да почистим вашата системата.
Следвайте инструкциите ми стриктно, докато не Ви кажа, че системата Ви е напълно чиста. Това, че симптомите са изчезнали, не значи че всичко е наред.
Ако не разбирате нещо, моля Ви попитайте ме, а не рискувайте. По-добре е малко да се позабавим, отколкото да усложним нещата.
При наличие на руткит, аз не гарантирам 100% почистване.
Проявете търпение, защото процедурата по почистването на вашата система може да отнеме известно време, в зависимост от вида на зловредния софтуер.
Цялата кореспонденция минава през тази тема, не създавайте нова тема и не използвайте друга тема за тази цел.

Като начало следвайте инструкциите от тази тема и накрая публикувайте логовете от двете програми:

http://www.kaldata.com/forums/index.php?showtopic=132819

18 октомври 200916 г.

Автор

Anti-Malware :

Malwarebytes' Anti-Malware 1.41

Database version: 2980

Windows 5.1.2600 Service Pack 3

10/18/2009 9:10:34 PM

mbam-log-2009-10-18 (21-10-34).txt

Scan type: Full Scan (C:\|D:\|E:\|)

Objects scanned: 371907

Time elapsed: 54 minute(s), 18 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 5

Folders Infected: 0

Files Infected: 3

Memory Processes Infected:

C:\Documents and Settings\Bikov\Local Settings\Temp\qjnyu.exe (Trojan.Downloader) -> Failed to unload process.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Bikov\Local Settings\Temp\qjnyu.exe (Trojan.Downloader) -> Delete on reboot.

C:\System Volume Information\_restore{49F40857-0796-461C-AEDD-9EF0CBE2F348}\RP514\A0229510.vxd (Rogue.sysCleaner) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{49F40857-0796-461C-AEDD-9EF0CBE2F348}\RP514\A0229511.vxd (Rogue.sysCleaner) -> Quarantined and deleted successfully.

HijackThis :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:00:19 PM, on 10/18/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Bonjour\mDNSResponder.exe

D:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\TUProgSt.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\WINDOWS\vsnpstd2.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

D:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\WINDOWS\Datecs\Flex2K.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\migamix-24.exe

C:\Program Files\wskype\wskype.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\WINDOWS\explorer.exe

C:\DOCUME~1\Bikov\LOCALS~1\Temp\qjnyu.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\BitComet\BitComet.exe

C:\Downloads\Kaldata.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://abv.bg/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101883&gct=&gc=1&q=

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101883&gct=&gc=1&q=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=101883&gct=&gc=1&q=%s

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - (no file)

R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll

O1 - Hosts: 85.25.73.109 l2authd.lineage2.com

O1 - Hosts: 85.25.73.109 l2testauthd.lineage2.com

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll

O2 - BHO: Mario Forever Galaxy Toolbar Helper - {8B81D6D7-7B02-4029-91AF-2BFF2F741555} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - (no file)

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O3 - Toolbar: Mario Forever Galaxy Toolbar - {E738F11F-B0F3-4E0D-A5CA-6ED7B0BD4F5D} - (no file)

O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - (no file)

O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [4shared Update] "C:\Program Files\4shared Desktop\checkUpdate.exe"

O4 - HKLM\..\Run: [sNPSTD2] C:\WINDOWS\vsnpstd2.exe

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Bluetooth.lnk = ?

O4 - Global Startup: FlexType 2K.lnk = ?

O4 - Global Startup: migamix-24.exe

O4 - Global Startup: wskype.lnk = C:\Program Files\wskype\wskype.exe

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O8 - Extra context menu item: &Download all 4shared files - C:\Program Files\4shared Desktop\down_all.htm

O8 - Extra context menu item: &Download using 4shared Desktop - C:\Program Files\4shared Desktop\down_link.htm

O8 - Extra context menu item: &С&валяне &с BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &С&валяне на всички с BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: &С&валяне на всичкото видео с BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Send To &Bluetooth - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: Преведи - {60237576-b24c-4ba9-9740-c9f3ec9db557} - C:\PROGRA~1\SkyCode\WEBTRA~1\wt2ie.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} (System Requirements Lab Class) - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll

O20 - Winlogon Notify: Antiwpa - antiwpa.dll (file missing)

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe

O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--

End of file - 9599 bytes

18 октомври 200916 г.

Стъпка 1:

Моля, отворете HijackThis, и изберете Do a system scan only.

Сложете отметки на следните редове:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.c...83&gct=&gc=1&q=

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.c...83&gct=&gc=1&q=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.c...&gct=&gc=1&q=%s

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - (no file)

O2 - BHO: Mario Forever Galaxy Toolbar Helper - {8B81D6D7-7B02-4029-91AF-2BFF2F741555} - (no file)

O2 - BHO: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - (no file)

O3 - Toolbar: Mario Forever Galaxy Toolbar - {E738F11F-B0F3-4E0D-A5CA-6ED7B0BD4F5D} - (no file)

O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - (no file)

O4 - Global Startup: migamix-24.exe

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)

O20 - Winlogon Notify: Antiwpa - antiwpa.dll (file missing)

O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)

След това, затворете всички отворени прозорци, освен този на HiJackThis, и изберете Fix checked.

Стъпка 2:

Изтеглете Security Check от screen317 от тук или

тук и го запаметете на вашия десктоп.

Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия Ви коментар в тази тема.

Стъпка 3:

Изтеглете RootRepeal от тук и го запазете на вашия десктоп. След това,

разархивирайте го на вашия десктоп, отново.

Кликнете два пъти върху RootRepeal.exe , за да стартирате програмата
Кликнете на таба Report в долната част на прозореца
Кликнете на бутона Scan
Сложете отметки пред следното:

Drivers
Processes
SSDT
Hidden Services

Кликнете на бутона OK
На следващия диалогов прозорец, сложете отметки преди всички дялове (C:\ , D:\ ....)
Кликнете на OK, за да започне процеса на сканиране

Бележка: Процеса на сканиране може да отнеме време. Моля,

не стартирайте

никакви програми, докато програмата сканира.

Когато сканирането завърши успешно ще се появи бутона Save Report
Кликнете върху Save Report и запишете лог файла на вашия десктоп, с име RootRepeal.txt
Отворете File, след което Exit , за да затворите програмата.

Копирайте и поставете съдържанието на RootRepeal.txt в следващия си пост.

18 октомври 200916 г.

Автор

Security Check

Results of screen317's Security Check version 0.99.0

Windows XP Service Pack 3 (UAC is disabled!)

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Disabled!

WMIC entry does not exist for antivirus; attempting automatic update.

``````````````````````````````

Anti-malware/Other Utilities Check:

Trojan Remover 6.8.1

HijackThis 2.0.2

TuneUp Utilities 2009

Java 6 Update 14

Out of date Java installed!

Adobe Flash Player 10

Adobe Reader 8.1.3

Out of date Adobe Reader installed!

``````````````````````````````

Process Check:

objlist.exe by Laurent

``````````````````````````````

DNS Vulnerability Check:

GREAT! (Not vulnerable to DNS cache poisoning)

`````````End of Log```````````

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/10/18 21:34

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

Drivers

-------------------

Name: kvrnlk.sys

Image Path: C:\WINDOWS\system32\drivers\kvrnlk.sys

Address: 0xF7993000 Size: 5184 File Visible: No Signed: -

Status: -

Name: PCI_PNP2342

Image Path: \Driver\PCI_PNP2342

Address: 0x00000000 Size: 0 File Visible: No Signed: -

Status: -

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xA626E000 Size: 49152 File Visible: No Signed: -

Status: -

Name: sptd

Image Path: \Driver\sptd

Address: 0x00000000 Size: 0 File Visible: No Signed: -

Status: -

Name: spzl.sys

Image Path: spzl.sys

Address: 0xF7285000 Size: 1052672 File Visible: No Signed: -

Status: -

Name: usbccgp.sys

Image Path: C:\WINDOWS\system32\DRIVERS\usbccgp.sys

Address: 0xA972B000 Size: 32128 File Visible: - Signed: -

Status: Hidden from the Windows API!

SSDT

-------------------

#: 041 Function Name: NtCreateKey

Status: Hooked by "spzl.sys" at address 0xf72860e0

#: 071 Function Name: NtEnumerateKey

Status: Hooked by "spzl.sys" at address 0xf72a4ca4

#: 073 Function Name: NtEnumerateValueKey

Status: Hooked by "spzl.sys" at address 0xf72a5032

#: 119 Function Name: NtOpenKey

Status: Hooked by "spzl.sys" at address 0xf72860c0

#: 160 Function Name: NtQueryKey

Status: Hooked by "spzl.sys" at address 0xf72a510a

#: 177 Function Name: NtQueryValueKey

Status: Hooked by "spzl.sys" at address 0xf72a4f8a

#: 247 Function Name: NtSetValueKey

Status: Hooked by "spzl.sys" at address 0xf72a519c

==EOF==

Но да подчертая !!!Прозорец за маркирането за дискове C,D и т.н. не ми излиза !!!

Редактирано 18 октомври 200916 г. от Brasnaro (преглед на промените)

18 октомври 200916 г.

Стъпка 1:

Моля, отидете на Start --> Settings --> Control Panel --> Add or Remove Programs, и деинсталирайте следните програми (Ако присъстват в списъка):

Adobe Reader 8.1.3

Ask Toolbar

BS Player Toolbar

Mario Forever Galaxy Toolbar

Adobe Reader 8.1.3 е твърде стара и уязвима версия. Ако желаете да използвате тази програма и за напред, моля изтеглете актуална версия:

http://www.kaldata.com/comments.php?id=50513&catid=1&highlight=adobe+reader

В противен случай, можете да се насочите към нейна алтернатива - по-лека, по-сигурна, по-бърза и по-малка:

http://www.kaldata.com/comments.php?id=50510&catid=1&highlight=foxit

Относно останалите toolbars те са излишни, а някои и опасни.

Стъпка 2:

Моля, изтеглете JavaRa и го разархивирайте на вашия десктоп.

***! Моля, преди да започнете с процедурата, затворете Internet Explorer !***

Кликнете два пъти върху JavaRa.exe, за да стартирате програмата

От падащото меню, изберете English ...и изберете Select.

JavaRa ще се стартира; Изберете Remove Older Versions, за да премахнете по-старата версия от вашия компютър.

Посочете Yes, когато бъдете попитани. Когато JavaRa приключи успешно премахването на старата версия, ще получите съобщение, че лог файла от извършената процедура е създаден. Изберете OK.

Лог файлът ще изскочи. Моля, запазете го на вашия десктоп.

Копирайте и поставете лог файла от JavaRa в следващия Ви пост в тази тема.

Стъпка 3:

Изтеглете ComboFix от някой от следните линкове:

Линк 1

Линк 2

* ВАЖНО !!! Запазете ComboFix.exe на вашия десктоп

Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

Преименувайте ComboFix.exe на Tool.exe

Стартирайте Tool.exe и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

П.П.: Сега възнамерявам да ставам, защото утре трябва да ставам рано за училище, но след училище ще погледна и ако сте изпълнили инструкциите ми ще Ви дам следващите. Благодаря за търпението и точното изпълнение на инструкциите ми! Лека вечер!

18 октомври 200916 г.

Автор

JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Sun Oct 18 22:06:37 2009

Found and removed: C:\Documents and Settings\Bikov\Application Data\Sun\Java\jre1.6.0_11

Found and removed: C:\Documents and Settings\Bikov\Application Data\Sun\Java\jre1.6.0_13

Found and removed: Software\JavaSoft\Java2D\1.5.0_06

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

------------------------------------

Finished reporting.

ComboFix 09-10-17.01 - Bikov 10/18/2009 22:26.2.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2046.1515 [GMT 3:00]

Running from: c:\documents and settings\Bikov\Desktop\Tool.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Previous Run -------

.

c:\program files\AskSearch\bin\DeFAultsearch.dll

c:\windows\Alcmtr.exe

c:\windows\Installer\52aa79.msi

c:\windows\Installer\d65142.msi

c:\windows\system32\d3d10core.dll

c:\windows\system32\kernel32new.dll

c:\windows\system32\msvcrtnew.dll

c:\windows\system32\skinboxer43.dll

c:\windows\system32\system.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_OREANS32

-------\Service_oreans32

((((((((((((((((((((((((( Files Created from 2009-09-18 to 2009-10-18 )))))))))))))))))))))))))))))))

.

2009-10-18 19:03 . 2009-10-18 19:03 -------- d-----w- c:\program files\Foxit Software

2009-10-18 19:03 . 2009-10-18 19:03 -------- d-----w- c:\documents and settings\Bikov\Application Data\Foxit

2009-10-18 13:51 . 2009-10-18 13:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Divinity 2

2009-10-18 13:51 . 2009-10-18 13:51 -------- d-----w- c:\documents and settings\Bikov\Local Settings\Application Data\Divinity 2

2009-10-18 13:49 . 2009-10-18 13:49 -------- d-----w- c:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP

2009-10-18 13:44 . 2009-10-18 13:44 -------- d-----w- c:\documents and settings\Bikov\Application Data\Malwarebytes

2009-10-18 13:44 . 2009-09-10 11:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-18 13:44 . 2009-10-18 17:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-10-18 13:44 . 2009-10-18 13:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-10-18 13:44 . 2009-09-10 11:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-10-13 13:58 . 2009-10-13 13:58 -------- d-----w- c:\documents and settings\Bikov\Application Data\2K Sports

2009-10-13 13:42 . 2009-10-13 13:42 -------- d-----w- c:\windows\system32\URTTEMP

2009-10-12 15:13 . 2008-04-14 02:42 53760 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll

2009-10-12 15:13 . 2008-04-14 02:42 53760 ----a-w- c:\windows\system32\vfwwdm32.dll

2009-10-12 15:10 . 2002-07-03 08:44 53248 ----a-w- c:\windows\amcap.exe

2009-10-12 15:10 . 2004-08-30 13:37 356352 ----a-w- c:\windows\vsnpstd2.exe

2009-10-12 15:10 . 2004-06-08 15:25 53248 ----a-w- c:\windows\system32\dsnpstd2.dll

2009-10-12 15:10 . 2004-10-14 14:12 347264 ----a-w- c:\windows\system32\drivers\snpstd2.sys

2009-10-12 15:10 . 2004-09-24 13:24 57344 ----a-w- c:\windows\system32\rsnpstd2.dll

2009-10-12 15:10 . 2004-09-24 10:52 36864 ----a-w- c:\windows\system32\vsnpstd2.dll

2009-10-12 15:10 . 2004-02-16 10:59 61440 ----a-w- c:\windows\system32\csnpstd2.dll

2009-10-12 15:10 . 2009-10-12 15:10 -------- d-----w- c:\program files\Trust

2009-10-12 15:10 . 2004-06-09 13:00 20480 ----a-w- c:\windows\usnpstd2.exe

2009-10-12 15:09 . 2008-04-13 21:15 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys

2009-10-12 15:09 . 2008-04-13 21:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys

2009-10-11 16:14 . 2009-04-06 07:08 4682 ----a-w- c:\windows\system32\npptNT2.sys

2009-10-11 16:05 . 2009-10-11 16:05 -------- d-----w- c:\documents and settings\Bikov\Application Data\InstallShield

2009-10-10 11:30 . 2009-10-10 11:32 -------- d-----w- c:\documents and settings\Bikov\Local Settings\Application Data\Mad Skills Motocross

2009-10-10 11:30 . 2009-10-10 11:30 -------- d-----w- c:\program files\Mad Skills Motocross

2009-10-09 18:43 . 2009-10-09 18:43 -------- d-----w- c:\documents and settings\Bikov\Local Settings\Application Data\assembly

2009-10-09 18:29 . 2009-10-09 18:29 -------- d-----w- c:\program files\NCsoft

2009-10-07 19:03 . 2009-10-10 11:16 -------- d-----w- c:\documents and settings\All Users\Application Data\SWTCWRH

2009-10-07 19:02 . 2009-10-07 19:48 -------- d-----w- c:\windows\SxsCaPendDel

2009-10-07 19:01 . 2009-10-07 19:01 -------- d-----w- c:\windows\11AE680750D24F5982B32C3E695E94C2.TMP

2009-10-02 11:40 . 1998-06-19 08:43 435200 ----a-r- c:\windows\N00C28884-Mortal Kombat 4-Setup.exe

2009-09-25 18:20 . 2009-09-25 18:20 -------- d-----w- c:\documents and settings\Bikov\Local Settings\Application Data\Thinstall

2009-09-23 17:45 . 2009-09-23 17:45 -------- d-----w- c:\documents and settings\Bikov\Application Data\Activision

2009-09-23 14:33 . 2009-09-23 14:33 -------- d-----w- c:\program files\Empire Interactive

2009-09-20 18:35 . 2009-09-20 18:35 -------- d-----w- c:\documents and settings\Bikov\Application Data\4shared Desktop

2009-09-20 18:35 . 2009-09-20 18:35 -------- d-----w- c:\program files\4shared Desktop

2009-09-20 17:14 . 2009-09-20 17:14 -------- d-----w- c:\documents and settings\Bikov\Local Settings\Application Data\kaneandlynch

2009-09-19 17:05 . 2009-09-19 17:05 -------- d-----w- c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP

2009-09-19 17:05 . 2009-10-18 13:49 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-18 19:19 . 2008-12-10 18:51 -------- d-----w- c:\documents and settings\Bikov\Application Data\Skype

2009-10-18 19:15 . 2008-12-10 11:40 -------- d-----w- c:\program files\BitComet

2009-10-18 16:46 . 2008-12-10 18:52 -------- d-----w- c:\documents and settings\Bikov\Application Data\skypePM

2009-10-18 11:02 . 2009-02-28 11:17 -------- d-----w- c:\program files\SystemRequirementsLab

2009-10-16 19:30 . 2009-07-27 19:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2009-10-16 14:28 . 2009-03-23 11:15 43520 -c--a-w- c:\windows\system32\CmdLineExt03.dll

2009-10-14 08:55 . 2009-09-06 09:29 -------- d-----w- c:\program files\Trojan Remover

2009-10-13 21:40 . 2008-12-10 11:56 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-10-10 11:28 . 2009-02-09 13:52 -------- d-----w- c:\program files\EA Sports

2009-10-09 14:10 . 2009-06-21 15:43 86016 ----a-w- c:\windows\system32\OpenAL32.dll

2009-09-20 18:53 . 2008-12-10 11:32 20816 -c--a-w- c:\documents and settings\Bikov\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-09-20 16:53 . 2009-06-21 15:43 413696 ----a-w- c:\windows\system32\wrap_oal.dll

2009-09-16 15:35 . 2009-03-02 21:26 -------- d-----w- c:\program files\AGEIA Technologies

2009-09-13 21:09 . 2009-09-13 21:09 4096 ----a-w- c:\windows\d3dx.dat

2009-09-13 21:08 . 2009-09-13 21:08 8192 ----a-r- c:\documents and settings\Bikov\Application Data\Microsoft\Installer\{4704C796-05D9-40FC-AF0E-8A168B511AA8}\Icon1AA8EB78.exe

2009-09-13 21:08 . 2009-09-13 21:08 17920 ----a-r- c:\documents and settings\Bikov\Application Data\Microsoft\Installer\{4704C796-05D9-40FC-AF0E-8A168B511AA8}\Icon9B7939695.exe

2009-09-12 09:46 . 2009-03-22 15:56 -------- d-----w- c:\documents and settings\Bikov\Application Data\BSplayer

2009-09-06 09:29 . 2009-09-06 09:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software

2009-09-06 09:29 . 2009-09-06 09:29 -------- d-----w- c:\documents and settings\Bikov\Application Data\Simply Super Software

2009-09-05 09:45 . 2009-08-09 12:39 2272 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2009-09-05 09:28 . 2009-09-09 13:09 3036024 ----a-w- c:\documents and settings\Bikov\Application Data\Simply Super Software\Trojan Remover\daw26.exe

2009-09-01 18:45 . 2009-09-01 18:45 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI

2009-09-01 18:43 . 2009-08-14 08:20 -------- d-----w- c:\program files\ATI Technologies

2009-09-01 18:41 . 2009-09-01 18:41 9158 ----a-r- c:\documents and settings\Bikov\Application Data\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe

2009-09-01 18:41 . 2009-09-01 18:41 -------- d-----w- c:\program files\Common Files\ATI Technologies

2009-08-30 23:23 . 2009-08-09 19:15 -------- d-----w- c:\program files\Eset

2009-08-30 20:17 . 2009-04-18 10:06 -------- d-----w- c:\documents and settings\Bikov\Application Data\THQ

2009-08-30 20:16 . 2009-08-30 20:16 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield

2009-08-30 20:08 . 2008-12-10 11:56 -------- d-----w- c:\program files\Common Files\InstallShield

2009-08-29 12:47 . 2009-08-27 18:20 -------- d-----w- c:\documents and settings\Bikov\Application Data\Hoyle

2009-08-28 14:27 . 2009-08-19 21:41 -------- d-----w- c:\documents and settings\Bikov\Application Data\Digital Red

2009-08-27 18:20 . 2009-08-27 18:20 -------- d-----w- c:\documents and settings\Bikov\Application Data\Hoyle FaceCreator

2009-08-27 18:19 . 2009-08-27 18:19 -------- d-----w- c:\program files\Common Files\Datalode

2009-08-27 10:17 . 2009-08-27 10:17 -------- d-----w- c:\program files\TeamViewer3

2009-08-20 08:17 . 2009-08-16 21:56 139152 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2009-08-20 08:17 . 2009-06-28 07:27 139152 -c--a-w- c:\documents and settings\Bikov\Application Data\PnkBstrK.sys

2009-08-20 08:17 . 2009-08-16 21:55 111928 ----a-w- c:\windows\system32\PnkBstrB.exe

2009-08-20 08:17 . 2009-08-20 08:17 794408 ----a-w- c:\windows\system32\pbsvc.exe

2009-08-19 20:35 . 2009-08-04 09:50 -------- d-----w- c:\documents and settings\Bikov\Application Data\funkitron

2009-08-16 21:55 . 2008-12-10 12:27 66872 ----a-w- c:\windows\system32\PnkBstrA.exe

2009-08-15 23:20 . 2009-08-15 23:20 8176 ----a-w- c:\windows\system32\ealregsnapshot1.reg

2009-08-14 11:43 . 2009-08-14 11:43 0 ----a-w- c:\windows\PowerReg.dat

2009-08-14 08:25 . 2009-08-14 08:25 0 ----a-w- c:\windows\ativpsrm.bin

2009-07-24 09:00 . 2009-01-20 18:00 410984 -c--a-w- c:\windows\system32\deploytk.dll

2009-07-24 08:59 . 2009-07-24 08:57 152576 -c--a-w- c:\documents and settings\Bikov\Application Data\Sun\Java\jre1.6.0_14\lzma.dll

2008-03-09 04:25 . 2009-05-20 20:05 236 -c--a-w- c:\program files\Common Files\dx.reg

.

((((((((((((((((((((((((((((( SnapShot@2009-10-18_19.17.41 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-02-08 12:00 . 2000-12-30 10:39 221184 c:\windows\Datecs\Flex2K.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

2008-09-22 11:38 284040 -c--a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-22 284040]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-22 284040]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-25 146680]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 233472]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-24 226712]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 139264]

"4shared Update"="c:\program files\4shared Desktop\checkUpdate.exe" [2009-07-13 1337344]

"SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-30 356352]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1385808]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-01-29 16859648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Bluetooth.lnk - d:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-5-12 581693]

FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2009-2-8 221184]

wskype.lnk - c:\program files\wskype\wskype.exe [2007-5-5 23552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"FirewallOverride"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\BitComet\\BitComet.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"d:\\Games\\CABAL Online EU\\launcher\\update\\ESTdnheadless.exe"=

"c:\\Documents and Settings\\All Users\\Application Data\\NexonEU\\NGM\\NGM.exe"=

"d:\games\Combat Arms EU\CombatArms.exe"= d:\games\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe

"d:\games\Combat Arms EU\Engine.exe"= d:\games\Combat Arms EU\Engine.exe:*Enabled:Engine.exe

"d:\\Games\\Combat Arms EU\\NMService.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"d:\\Games\\EA Sports\\FIFA 08\\FIFA08.exe"=

"c:\\Documents and Settings\\Bikov\\temp\\TeamViewer3\\TeamViewer.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"d:\\Games\\Valve\\hl.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"d:\\Games\\Eidos\\Kane and Lynch Dead Men\\kaneandlynch.exe"=

"c:\\Documents and Settings\\Bikov\\My Documents\\sandra..jpg.pif"=

"c:\\Program Files\\Google\\Common\\Google Updater\\GoogleUpdaterService.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=

"c:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\CLIStart.exe"=

"c:\\WINDOWS\\system32\\NeroCheck.exe"=

"c:\\WINDOWS\\vsnpstd2.exe"=

"c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"=

"c:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\MOM.exe"=

"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbamgui.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"12007:TCP"= 12007:TCP:BitComet 12007 TCP

"12007:UDP"= 12007:UDP:BitComet 12007 UDP

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [12/6/2005 6:11 PM 35328]

R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [7/30/2008 8:51 AM 277736]

R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [6/24/2009 3:36 PM 604416]

R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\kvrnlk.sys --> c:\windows\system32\drivers\kvrnlk.sys [?]

S3 cpuz130;cpuz130;\??\c:\docume~1\Bikov\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\Bikov\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]

S3 GPU-Z;GPU-Z;\??\c:\docume~1\Bikov\LOCALS~1\Temp\GPU-Z.sys --> c:\docume~1\Bikov\LOCALS~1\Temp\GPU-Z.sys [?]

S3 nenum13E;nenum13E;\??\c:\docume~1\Bikov\LOCALS~1\Temp\nenum13E.sys --> c:\docume~1\Bikov\LOCALS~1\Temp\nenum13E.sys [?]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 NTProcDrv;Process creation detector for NT.;\??\c:\documents and settings\Bikov\My Documents\™\laineta\NtProcDrv.sys --> c:\documents and settings\Bikov\My Documents\™\laineta\NtProcDrv.sys [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Contents of the 'Scheduled Tasks' folder

2009-10-18 c:\windows\Tasks\1-Click Maintenance.job

- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 12:37]

2009-10-18 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-10 19:41]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://abv.bg/

IE: &Download all 4shared files - c:\program files\4shared Desktop\down_all.htm

IE: &Download using 4shared Desktop - c:\program files\4shared Desktop\down_link.htm

IE: &С&валяне &с BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

IE: &С&валяне на всички с BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

IE: &С&валяне на всичкото видео с BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: E&xport to Microsoft Excel - c:\progra~1\Microsoft Office\Office10\EXCEL.EXE/3000

IE: Send To &Bluetooth - d:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: {{60237576-b24c-4ba9-9740-c9f3ec9db557} - {EAADF17C-B6EA-4511-8549-A67CFD406EAF} - c:\progra~1\SkyCode\WEBTRA~1\wt2ie.dll

DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab

.

- - - - ORPHANS REMOVED - - - -

Toolbar-{E738F11F-B0F3-4E0D-A5CA-6ED7B0BD4F5D} - (no file)

Toolbar-{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - (no file)

WebBrowser-{E738F11F-B0F3-4E0D-A5CA-6ED7B0BD4F5D} - (no file)

WebBrowser-{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - (no file)

AddRemove-CABAL Online Europe_is1 - c:\program files\CABAL Online EU\unins000.exe

AddRemove-EuroDictXP - c:\downloads\KoralSoft\EuroDictXP\Uninstall.exe

AddRemove-HijackThis - c:\downloads\HijackThis.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-18 22:29

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1144)

c:\windows\system32\Ati2evxx.dll

.

Completion time: 2009-10-18 22:30

ComboFix-quarantined-files.txt 2009-10-18 19:30

Pre-Run: 28,496,027,648 bytes free

Post-Run: 28,449,378,304 bytes free

Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5

264 --- E O F --- 2009-07-08 09:18

19 октомври 200916 г.

Отворете Notepad и чрез комбинацията copy/paste поставете следния текст:

http://www.kaldata.com/forums/index.php?showtopic=139127


Killall::


Collect::

c:\windows\system32\drivers\acedrv11.sys

c:\windows\system32\drivers\kvrnlk.sys

c:\windows\system32\drivers\abp470n5.sys

c:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP

c:\windows\11AE680750D24F5982B32C3E695E94C2.TMP

c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP


Driver::

acedrv11

kvrnlk

abp470n5


Registry::

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=-

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След като, програмата приключи ще Ви изведе лог файла. Отново чрез комбинацията от Copy/Paste поставете информацията тук.

19 октомври 200916 г.

Автор

ComboFix 09-10-18.04 - Bikov 10/19/2009 18:33.4.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2046.1413 [GMT 3:00]

Running from: c:\documents and settings\Bikov\Desktop\Tool.exe

Command switches used :: c:\documents and settings\Bikov\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Previous Run -------

.

c:\windows\system32\drivers\acedrv11.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_ABP470N5

-------\Legacy_ACEDRV11

-------\Service_abp470n5

-------\Service_acedrv11

-------\Legacy_ABP470N5

-------\Service_abp470n5

((((((((((((((((((((((((( Files Created from 2009-09-19 to 2009-10-19 )))))))))))))))))))))))))))))))

.

2009-10-19 14:09 . 2009-10-19 14:32 -------- d-----w- c:\program files\Hero Editor

2009-10-19 14:08 . 2009-10-19 14:31 249856 ------w- c:\windows\Setup1.exe

2009-10-19 14:08 . 2009-10-19 14:31 73216 ----a-w- c:\windows\ST6UNST.EXE