Обновете MalwareBytes' Anti-Malware и пуснете ново пълно сканиране. Накрая публикувайте резултатите.

Malwarebytes' Anti-Malware 1.41

Database version: 2997

Windows 5.1.2600 Service Pack 3

10/20/2009 4:38:14 PM

mbam-log-2009-10-20 (16-38-14).txt

Scan type: Full Scan (C:\|D:\|E:\|)

Objects scanned: 324166

Time elapsed: 42 minute(s), 33 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 5

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

C:\Documents and Settings\Bikov\Local Settings\temp\yfhi.exe (Trojan.Downloader) -> Failed to unload process.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Bikov\Local Settings\temp\yfhi.exe (Trojan.Downloader) -> Delete on reboot.

Опитай да отвориш Task Manager отново.

Не ми дава !!!Пише ми Task manager has been disabled by your administrator !!!Ако трябва и пик ще кача

Отворете Notepad и чрез комбинацията copy/paste поставете следния текст:

Killall::


FileLook::

c:\windows\system32\drivers\kvrnlk.sys

c:\docume~1\Bikov\LOCALS~1\Temp\nenum13E.sys 

C:\windows\system32\drivers\abp470n5.sys


Driver::

kvrnlk

abp470n5


Rootkit::

kvrnlk

abp470n5


File::

c:\windows\system32\drivers\kvrnlk.sys

C:\windows\system32\drivers\abp470n5.sys


Registry::

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableTaskMgr"=dword:00000000

"DisableRegistryTools"=dword:00000000

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След като, програмата приключи ще Ви изведе лог файла. Отново чрез комбинацията от Copy/Paste поставете информацията тук.

ComboFix 09-10-19.01 - Bikov 10/20/2009 17:04.9.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2046.1499 [GMT 3:00]

Running from: c:\documents and settings\Bikov\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Bikov\Desktop\CFScript.txt

FILE ::

"c:\windows\system32\drivers\abp470n5.sys"

"c:\windows\system32\drivers\kvrnlk.sys"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_ABP470N5

-------\Service_abp470n5

((((((((((((((((((((((((( Files Created from 2009-09-20 to 2009-10-20 )))))))))))))))))))))))))))))))

.

2009-10-20 11:06 . 2009-10-20 11:06 -------- d-----w- c:\program files\BSPlayer

2009-10-19 16:46 . 2009-10-19 16:46 -------- d-----w- C:\Tool

2009-10-19 14:09 . 2009-10-19 18:20 -------- d-----w- c:\program files\Hero Editor

2009-10-19 14:08 . 2009-10-19 14:31 249856 ------w- c:\windows\Setup1.exe

2009-10-19 14:08 . 2009-10-19 14:31 73216 ----a-w- c:\windows\ST6UNST.EXE

2009-10-18 19:03 . 2009-10-18 19:03 -------- d-----w- c:\program files\Foxit Software

2009-10-18 19:03 . 2009-10-18 19:03 -------- d-----w- c:\documents and settings\Bikov\Application Data\Foxit

2009-10-18 13:51 . 2009-10-18 13:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Divinity 2

2009-10-18 13:51 . 2009-10-18 13:51 -------- d-----w- c:\documents and settings\Bikov\Local Settings\Application Data\Divinity 2

2009-10-18 13:49 . 2009-10-18 13:49 -------- d-----w- c:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP

2009-10-18 13:44 . 2009-10-18 13:44 -------- d-----w- c:\documents and settings\Bikov\Application Data\Malwarebytes

2009-10-18 13:44 . 2009-09-10 11:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-18 13:44 . 2009-10-19 18:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-10-18 13:44 . 2009-10-18 13:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-10-18 13:44 . 2009-09-10 11:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-10-13 13:58 . 2009-10-13 13:58 -------- d-----w- c:\documents and settings\Bikov\Application Data\2K Sports

2009-10-13 13:42 . 2009-10-13 13:42 -------- d-----w- c:\windows\system32\URTTEMP

2009-10-12 15:13 . 2008-04-14 02:42 53760 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll

2009-10-12 15:13 . 2008-04-14 02:42 53760 ----a-w- c:\windows\system32\vfwwdm32.dll

2009-10-12 15:10 . 2002-07-03 08:44 53248 ----a-w- c:\windows\amcap.exe

2009-10-12 15:10 . 2004-08-30 13:37 356352 ----a-w- c:\windows\vsnpstd2.exe

2009-10-12 15:10 . 2004-06-08 15:25 53248 ----a-w- c:\windows\system32\dsnpstd2.dll

2009-10-12 15:10 . 2004-10-14 14:12 347264 ----a-w- c:\windows\system32\drivers\snpstd2.sys

2009-10-12 15:10 . 2004-09-24 13:24 57344 ----a-w- c:\windows\system32\rsnpstd2.dll

2009-10-12 15:10 . 2004-09-24 10:52 36864 ----a-w- c:\windows\system32\vsnpstd2.dll

2009-10-12 15:10 . 2004-02-16 10:59 61440 ----a-w- c:\windows\system32\csnpstd2.dll

2009-10-12 15:10 . 2009-10-12 15:10 -------- d-----w- c:\program files\Trust

2009-10-12 15:10 . 2004-06-09 13:00 20480 ----a-w- c:\windows\usnpstd2.exe

2009-10-12 15:09 . 2008-04-13 21:15 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys

2009-10-12 15:09 . 2008-04-13 21:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys

2009-10-11 16:14 . 2009-04-06 07:08 4682 ----a-w- c:\windows\system32\npptNT2.sys

2009-10-11 16:05 . 2009-10-11 16:05 -------- d-----w- c:\documents and settings\Bikov\Application Data\InstallShield

2009-10-10 11:30 . 2009-10-10 11:32 -------- d-----w- c:\documents and settings\Bikov\Local Settings\Application Data\Mad Skills Motocross

2009-10-10 11:30 . 2009-10-19 18:23 -------- d-----w- c:\program files\Mad Skills Motocross

2009-10-09 18:43 . 2009-10-09 18:43 -------- d-----w- c:\documents and settings\Bikov\Local Settings\Application Data\assembly

2009-10-09 18:29 . 2009-10-09 18:29 -------- d-----w- c:\program files\NCsoft

2009-10-07 19:03 . 2009-10-10 11:16 -------- d-----w- c:\documents and settings\All Users\Application Data\SWTCWRH

2009-10-07 19:02 . 2009-10-07 19:48 -------- d-----w- c:\windows\SxsCaPendDel

2009-10-07 19:01 . 2009-10-07 19:01 -------- d-----w- c:\windows\11AE680750D24F5982B32C3E695E94C2.TMP

2009-10-02 11:40 . 1998-06-19 08:43 435200 ----a-r- c:\windows\N00C28884-Mortal Kombat 4-Setup.exe

2009-09-25 18:20 . 2009-09-25 18:20 -------- d-----w- c:\documents and settings\Bikov\Local Settings\Application Data\Thinstall

2009-09-23 17:45 . 2009-09-23 17:45 -------- d-----w- c:\documents and settings\Bikov\Application Data\Activision

2009-09-23 14:33 . 2009-09-23 14:33 -------- d-----w- c:\program files\Empire Interactive

2009-09-20 18:35 . 2009-09-20 18:35 -------- d-----w- c:\documents and settings\Bikov\Application Data\4shared Desktop

2009-09-20 18:35 . 2009-10-19 18:12 -------- d-----w- c:\program files\4shared Desktop

2009-09-20 17:14 . 2009-09-20 17:14 -------- d-----w- c:\documents and settings\Bikov\Local Settings\Application Data\kaneandlynch

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-20 14:09 . 2008-12-10 18:51 -------- d-----w- c:\documents and settings\Bikov\Application Data\Skype

2009-10-20 13:06 . 2008-12-10 18:52 -------- d-----w- c:\documents and settings\Bikov\Application Data\skypePM

2009-10-20 11:32 . 2008-12-10 11:40 -------- d-----w- c:\program files\BitComet

2009-10-20 04:13 . 2009-07-27 19:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2009-10-19 18:28 . 2009-08-05 12:57 -------- d-----w- c:\program files\[AIO] BEST POKER COLLECTION 2007

2009-10-19 18:28 . 2008-12-10 11:38 -------- d-----w- c:\program files\wskype

2009-10-19 18:28 . 2008-12-10 11:42 -------- d-----w- c:\program files\Winamp

2009-10-19 18:28 . 2009-03-20 19:13 -------- d-----w- c:\program files\vloader

2009-10-19 18:27 . 2009-01-31 16:01 -------- d-----w- c:\program files\TVUPlayer

2009-10-19 18:27 . 2009-08-27 10:17 -------- d-----w- c:\program files\TeamViewer3

2009-10-19 18:27 . 2009-02-28 11:17 -------- d-----w- c:\program files\SystemRequirementsLab

2009-10-19 18:27 . 2009-03-27 13:08 -------- d-----w- c:\program files\Recuva

2009-10-19 18:26 . 2009-07-27 21:32 -------- d-----w- c:\program files\ProtectDisc Driver Installer

2009-10-19 18:26 . 2009-07-22 10:08 -------- d-----w- c:\program files\PerformanceTest

2009-10-19 18:26 . 2009-06-12 15:55 -------- d-----w- c:\program files\Pcsx2

2009-10-19 18:26 . 2009-06-21 15:43 -------- d-----w- c:\program files\OpenAL

2009-10-19 18:19 . 2009-07-24 13:37 -------- d-----w- c:\program files\GameSpy Arcade

2009-10-19 18:19 . 2009-06-25 19:35 -------- d-----w- c:\program files\GameShadow

2009-10-19 18:19 . 2009-05-01 07:43 -------- d-----w- c:\program files\DAEMON Tools Lite

2009-10-19 18:15 . 2009-04-14 15:34 -------- d-----w- c:\program files\Cheat Engine

2009-10-19 18:15 . 2009-03-22 15:56 -------- d-----w- c:\program files\BS_Player

2009-10-19 18:15 . 2009-05-12 12:50 -------- d-----w- c:\program files\Blaze Media Pro

2009-10-19 18:14 . 2009-05-02 13:28 -------- d-----w- c:\program files\Audacity_Portable

2009-10-19 18:13 . 2009-02-07 19:54 -------- d-----w- c:\program files\AnMing

2009-10-19 18:12 . 2009-04-26 19:33 -------- d-----w- c:\program files\3DO

2009-10-19 17:54 . 2009-08-09 19:15 -------- d-----w- c:\program files\Eset

2009-10-18 13:49 . 2009-09-19 17:05 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-10-16 14:28 . 2009-03-23 11:15 43520 -c--a-w- c:\windows\system32\CmdLineExt03.dll

2009-10-14 08:55 . 2009-09-06 09:29 -------- d-----w- c:\program files\Trojan Remover

2009-10-13 21:40 . 2008-12-10 11:56 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-10-10 11:28 . 2009-02-09 13:52 -------- d-----w- c:\program files\EA Sports

2009-10-09 14:10 . 2009-06-21 15:43 86016 ----a-w- c:\windows\system32\OpenAL32.dll

2009-09-20 18:53 . 2008-12-10 11:32 20816 -c--a-w- c:\documents and settings\Bikov\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-09-20 16:53 . 2009-06-21 15:43 413696 ----a-w- c:\windows\system32\wrap_oal.dll

2009-09-16 15:35 . 2009-03-02 21:26 -------- d-----w- c:\program files\AGEIA Technologies

2009-09-13 21:09 . 2009-09-13 21:09 4096 ----a-w- c:\windows\d3dx.dat

2009-09-12 09:46 . 2009-03-22 15:56 -------- d-----w- c:\documents and settings\Bikov\Application Data\BSplayer

2009-09-06 09:29 . 2009-09-06 09:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software

2009-09-06 09:29 . 2009-09-06 09:29 -------- d-----w- c:\documents and settings\Bikov\Application Data\Simply Super Software

2009-09-05 09:45 . 2009-08-09 12:39 2272 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2009-09-01 18:45 . 2009-09-01 18:45 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI

2009-09-01 18:43 . 2009-08-14 08:20 -------- d-----w- c:\program files\ATI Technologies

2009-09-01 18:41 . 2009-09-01 18:41 -------- d-----w- c:\program files\Common Files\ATI Technologies

2009-08-30 20:17 . 2009-04-18 10:06 -------- d-----w- c:\documents and settings\Bikov\Application Data\THQ

2009-08-30 20:16 . 2009-08-30 20:16 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield

2009-08-30 20:08 . 2008-12-10 11:56 -------- d-----w- c:\program files\Common Files\InstallShield

2009-08-29 12:47 . 2009-08-27 18:20 -------- d-----w- c:\documents and settings\Bikov\Application Data\Hoyle

2009-08-28 14:27 . 2009-08-19 21:41 -------- d-----w- c:\documents and settings\Bikov\Application Data\Digital Red

2009-08-27 18:20 . 2009-08-27 18:20 -------- d-----w- c:\documents and settings\Bikov\Application Data\Hoyle FaceCreator

2009-08-27 18:19 . 2009-08-27 18:19 -------- d-----w- c:\program files\Common Files\Datalode

2009-08-20 08:17 . 2009-08-16 21:56 139152 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2009-08-20 08:17 . 2009-06-28 07:27 139152 -c--a-w- c:\documents and settings\Bikov\Application Data\PnkBstrK.sys

2009-08-20 08:17 . 2009-08-16 21:55 111928 ----a-w- c:\windows\system32\PnkBstrB.exe

2009-08-20 08:17 . 2009-08-20 08:17 794408 ----a-w- c:\windows\system32\pbsvc.exe

2009-08-16 21:55 . 2008-12-10 12:27 66872 ----a-w- c:\windows\system32\PnkBstrA.exe

2009-08-15 23:20 . 2009-08-15 23:20 8176 ----a-w- c:\windows\system32\ealregsnapshot1.reg

2009-08-14 11:43 . 2009-08-14 11:43 0 ----a-w- c:\windows\PowerReg.dat

2009-08-14 08:25 . 2009-08-14 08:25 0 ----a-w- c:\windows\ativpsrm.bin

2009-07-24 09:00 . 2009-01-20 18:00 410984 -c--a-w- c:\windows\system32\deploytk.dll

2008-03-09 04:25 . 2009-05-20 20:05 236 -c--a-w- c:\program files\Common Files\dx.reg

.

((((((((((((((((((((((((((((( SnapShot@2009-10-20_11.36.45 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-10-20 14:09 . 2009-10-20 14:09 16384 c:\windows\temp\Perflib_Perfdata_b50.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

2008-09-22 11:38 284040 -c--a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-22 284040]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-22 284040]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-25 138488]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 233472]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-24 226712]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 135168]

"4shared Update"="c:\program files\4shared Desktop\checkUpdate.exe" [2009-07-13 1337344]

"SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-30 356352]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1385808]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-01-29 16859648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Bluetooth.lnk - d:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-5-12 663613]

FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2009-2-8 221184]

wskype.lnk - c:\program files\wskype\wskype.exe [2007-5-5 97280]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableTaskMgr"= 1 (0x1)

"DisableRegistryTools"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]

"DisableTaskMgr"= 1 (0x1)

"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"FirewallOverride"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\BitComet\\BitComet.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"d:\\Games\\CABAL Online EU\\launcher\\update\\ESTdnheadless.exe"=

"c:\\Documents and Settings\\All Users\\Application Data\\NexonEU\\NGM\\NGM.exe"=

"d:\games\Combat Arms EU\CombatArms.exe"= d:\games\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe

"d:\games\Combat Arms EU\Engine.exe"= d:\games\Combat Arms EU\Engine.exe:*Enabled:Engine.exe

"d:\\Games\\Combat Arms EU\\NMService.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"d:\\Games\\EA Sports\\FIFA 08\\FIFA08.exe"=

"c:\\Documents and Settings\\Bikov\\temp\\TeamViewer3\\TeamViewer.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"d:\\Games\\Valve\\hl.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"d:\\Games\\Eidos\\Kane and Lynch Dead Men\\kaneandlynch.exe"=

"c:\\Program Files\\Google\\Common\\Google Updater\\GoogleUpdaterService.exe"=

"c:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\CLIStart.exe"=

"c:\\WINDOWS\\system32\\NeroCheck.exe"=

"c:\\WINDOWS\\vsnpstd2.exe"=

"c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"=

"c:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\MOM.exe"=

"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbamgui.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\WINDOWS\\system32\\netsh.exe"=

"c:\\WINDOWS\\Datecs\\Flex2K.exe"=

"d:\\Program Files\\WIDCOMM\\Bluetooth Software\\BTTray.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=

"c:\\Program Files\\wskype\\wskype.exe"=

"c:\\WINDOWS\\RTHDCPL.EXE"=

"c:\\WINDOWS\\NIRCMD.exe"=

"c:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\ccc.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"12007:TCP"= 12007:TCP:BitComet 12007 TCP

"12007:UDP"= 12007:UDP:BitComet 12007 UDP

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [12/6/2005 6:11 PM 35328]

R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [6/24/2009 3:36 PM 604416]

S3 cpuz130;cpuz130;\??\c:\docume~1\Bikov\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\Bikov\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]

S3 GPU-Z;GPU-Z;\??\c:\docume~1\Bikov\LOCALS~1\Temp\GPU-Z.sys --> c:\docume~1\Bikov\LOCALS~1\Temp\GPU-Z.sys [?]

S3 nenum13E;nenum13E;\??\c:\docume~1\Bikov\LOCALS~1\Temp\nenum13E.sys --> c:\docume~1\Bikov\LOCALS~1\Temp\nenum13E.sys [?]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 NTProcDrv;Process creation detector for NT.;\??\c:\documents and settings\Bikov\My Documents\™\laineta\NtProcDrv.sys --> c:\documents and settings\Bikov\My Documents\™\laineta\NtProcDrv.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - ABP470N5

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Contents of the 'Scheduled Tasks' folder

2009-10-20 c:\windows\Tasks\1-Click Maintenance.job

- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 12:37]

2009-10-20 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-10 19:41]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://abv.bg/

IE: &Download all 4shared files - c:\program files\4shared Desktop\down_all.htm

IE: &Download using 4shared Desktop - c:\program files\4shared Desktop\down_link.htm

IE: &С&валяне &с BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

IE: &С&валяне на всички с BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

IE: &С&валяне на всичкото видео с BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: E&xport to Microsoft Excel - c:\progra~1\Microsoft Office\Office10\EXCEL.EXE/3000

IE: Send To &Bluetooth - d:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: {{60237576-b24c-4ba9-9740-c9f3ec9db557} - {EAADF17C-B6EA-4511-8549-A67CFD406EAF} - c:\progra~1\SkyCode\WEBTRA~1\wt2ie.dll

DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-20 17:08

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1108)

c:\windows\system32\Ati2evxx.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\windows\system32\ati2evxx.exe

c:\combofix\CF28193.exe

c:\program files\Bonjour\mDNSResponder.exe

d:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\PnkBstrA.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

c:\program files\Skype\Plugin Manager\skypePM.exe

.

**************************************************************************

.

Completion time: 2009-10-20 17:11 - machine was rebooted

ComboFix-quarantined-files.txt 2009-10-20 14:11

ComboFix2.txt 2009-10-20 11:58

ComboFix3.txt 2009-10-20 11:38

ComboFix4.txt 2009-10-19 16:22

Pre-Run: 28,617,138,176 bytes free

Post-Run: 28,456,808,448 bytes free

Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5

- - End Of File - - 8F4E34610D37B8CA4106025A295C9B31

Препоръчвам Ви да направите същото нещо:

http://www.kaldata.com/forums/index.php?showtopic=139172&view=findpost&p=1538766

Нещо не мога да разбера какво трябва да направя :|

Използвайте преводач и внимателно разгледайте линковете.

Еми не мога да се оправя.Какво да направя... :|

Добре, ето нещо по просто:

http://www.raymond.cc/blog/archives/2008/06/16/kaspersky-offers-free-rescue-disk-to-clean-virus-without-booting-in-windows/

С Kaspersky процедурата изглежда по лесна.