Нямам Daemon Tools.

Инсталирането на Service Pack 3 бе втора стъпка.

Моля започнете със стъпка 1 и направете проверка с Dr.Web.

CureIt направи много голям лог, който не може да се пейстне във форума.

Но на пръв поглед нещата са добре.

-----------------------------------------------------------------------------

Статистика на проверката

-----------------------------------------------------------------------------

Обектите са проверени: 11536

Инфектирани: 0

Инфектирани с модификации: 0

Подозрителни: 0

Рекламни програми: 0

Програми dialers: 0

Програми-шеги: 0

Потенциално опасни програми: 0

Програми за взлом: 0

Излекуван: 0

Изтрит: 0

Преименуван: 0

Преместен: 0

Игнориран: 0

Скорост на проверката: 5139 Kb/s

Време за проверка: 00:11:35

-----------------------------------------------------------------------------

=============================================================================

Обща статистика на сесиите

=============================================================================

Обектите са проверени: 11536

Инфектирани: 0

Инфектирани с модификации: 0

Подозрителни: 0

Рекламни програми: 0

Програми dialers: 0

Програми-шеги: 0

Потенциално опасни програми: 0

Програми за взлом: 0

Излекуван: 0

Изтрит: 0

Преименуван: 0

Преместен: 0

Игнориран: 0

Скорост на проверката: 5059 Kb/s

Време за проверка: 00:11:46

=============================================================================

Изтрийте наличните версии на Combofix и изтеглете нова. След това повторете стъпките от този пост:

http://www.kaldata.com/forums/index.php?showtopic=139552&view=findpost&p=1541055

Намерете отнякъде инсталационен диск за да поправим MBR секторите или направо един Repair Install, ако не иска да зарежда в Normal Mode.

И двете инсталации, които имате ли зареждат само в Debug Mode ?

ComboFix 09-11-05.05 - DUDU 11.2009 г. 16:33.3.2 - FAT32x86

Running from: c:\documents and settings\DUDU\desktop\ComboFix.exe

Command switches used :: /KillAll

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

.

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected

Restored copy from - Kitty ate it

.

.

2009-11-06 14:43 . 2009-11-06 14:43 -------- d-----w- C:\FOUND.009

2009-11-06 14:31 . 2004-03-02 15:37 5504 ----a-w- c:\windows\system32\drivers\imagedrv.sys

2009-11-05 10:07 . 2009-11-05 10:07 -------- d-----w- C:\FOUND.008

2009-11-04 23:35 . 2009-11-04 23:35 -------- d-----w- C:\FOUND.007

2009-11-02 18:15 . 2009-11-02 18:15 -------- d-----w- C:\FOUND.006

2009-11-02 18:08 . 2009-11-02 18:08 -------- d-----w- C:\FOUND.005

2009-11-02 18:00 . 2009-11-02 18:00 -------- d-----w- C:\FOUND.004

2009-11-02 17:55 . 2009-11-02 17:55 -------- d-----w- C:\FOUND.003

2009-11-02 12:04 . 2009-11-02 12:04 -------- d-----w- C:\FOUND.002

2009-11-01 21:05 . 2009-11-01 21:05 -------- d-----w- C:\FOUND.001

2009-10-26 09:59 . 2009-10-26 09:59 -------- d-----w- c:\program files\Foxit Software

2009-10-25 21:22 . 2009-10-25 21:22 -------- d-----w- C:\FOUND.000

2009-10-25 21:00 . 2009-10-25 21:00 -------- d-----w- c:\windows\system32\CatRoot_bak

2009-10-24 12:18 . 2009-10-24 12:18 -------- d-----w- c:\documents and settings\DUDU\DoctorWeb

2009-10-23 15:54 . 2009-10-23 15:54 -------- d-----w- c:\documents and settings\DUDU\Application Data\Malwarebytes

2009-10-23 15:54 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-23 15:54 . 2009-10-23 15:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-10-23 15:54 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-10-23 15:54 . 2009-10-23 15:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-10-23 14:47 . 2009-10-23 14:47 -------- d-----w- c:\program files\Common Files\Skype

2009-10-23 14:47 . 2009-10-23 14:47 -------- d-----r- c:\program files\Skype

2009-10-22 21:39 . 2009-10-22 21:39 -------- d-----w- c:\program files\CCleaner

2009-10-22 16:18 . 2009-10-22 16:18 44808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\fssync.dll

2009-10-22 16:18 . 2009-10-22 16:18 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\klbg.sys

2009-10-22 16:18 . 2009-10-22 16:18 208616 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\avp.exe

2009-10-22 16:18 . 2009-10-22 16:18 213520 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\XP\klif.sys

2009-10-22 16:03 . 2009-10-22 16:18 95259 ----a-w- c:\windows\system32\drivers\klick.dat

2009-10-22 16:03 . 2009-10-22 16:18 108059 ----a-w- c:\windows\system32\drivers\klin.dat

2009-10-22 15:54 . 2009-11-06 14:40 46624 --sha-w- c:\windows\system32\drivers\fidbox.dat

2009-10-22 15:54 . 2009-11-06 14:40 32 --sha-w- c:\windows\system32\drivers\fidbox2.dat

2009-10-22 15:54 . 2009-10-22 15:54 -------- d-----w- c:\program files\Kaspersky Lab

2009-10-22 15:54 . 2009-10-22 15:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab

2009-10-21 23:32 . 2009-10-21 23:32 -------- d-----w- c:\documents and settings\DUDU\Application Data\SumatraPDF

2009-10-20 16:52 . 2009-10-20 16:52 -------- d-----w- c:\windows\SxsCaPendDel

2009-10-20 16:40 . 2009-10-20 16:40 -------- d-----w- c:\windows\Sun

2009-10-20 16:39 . 2009-10-20 16:39 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-10-20 16:39 . 2009-10-20 16:39 -------- d-----w- c:\program files\Java

2009-10-20 16:39 . 2009-10-20 16:39 152576 ----a-w- c:\documents and settings\DUDU\Application Data\Sun\Java\jre1.6.0_16\lzma.dll

2009-10-20 15:57 . 2009-10-20 15:57 23600 ----a-w- c:\windows\system32\drivers\TVICHW32.SYS

2009-10-20 15:57 . 2009-10-20 15:57 -------- d-----w- c:\documents and settings\DUDU\Local Settings\Application Data\eSupport.com

2009-10-09 15:45 . 2009-10-09 15:45 -------- d-----w- c:\program files\Common Files\Autodesk Shared

2009-10-09 15:45 . 2009-10-09 15:45 -------- d-----w- c:\program files\AutoCAD LT 2009

2009-10-09 15:45 . 2009-10-09 15:45 -------- d-----w- c:\documents and settings\DUDU\Local Settings\Application Data\Autodesk

2009-10-09 15:45 . 2009-10-09 15:45 -------- d-----w- c:\documents and settings\DUDU\Application Data\Autodesk

2009-10-09 15:45 . 2009-10-09 15:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk

2009-10-09 15:44 . 2009-10-09 15:45 -------- d-----w- c:\program files\MSBuild

2009-10-09 15:44 . 2009-10-09 15:44 108552 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2009-10-09 15:42 . 2009-10-09 15:42 -------- d-----w- c:\windows\system32\XPSViewer

2009-10-09 15:41 . 2009-10-09 15:41 -------- d-----w- c:\program files\Reference Assemblies

2009-10-09 15:41 . 2006-06-29 11:07 14048 ------w- c:\windows\system32\spmsg2.dll

.

.

2009-11-06 14:40 . 2009-10-22 15:54 32 --sha-w- c:\windows\system32\drivers\fidbox2.idx

2009-11-06 14:40 . 2009-10-22 15:54 1444 --sha-w- c:\windows\system32\drivers\fidbox.idx

2009-11-06 14:40 . 2007-10-25 03:13 12 ----a-w- c:\windows\bthservsdp.dat

2009-10-24 11:01 . 2007-10-18 19:20 72584 ----a-w- c:\documents and settings\DUDU\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-10-22 16:18 . 2008-01-29 16:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys

2009-09-18 17:15 . 2009-09-18 17:15 -------- d-----w- c:\program files\BORLANDC

.

.

.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-11-17 7700480]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 167936]

"DataLayer"="c:\program files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 1106944]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-11-17 86016]

"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-10-22 208616]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

"combofix"="c:\combofix\CF20546.exe" [2009-11-06 388608]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-11-17 1622016]

"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-12-19 16062464]

"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Avant Browser\\avant.exe"=

"c:\\Program Files\\FlashGet\\flashget.exe"=

"c:\\Program Files\\uTorrent\\utorrent.exe"=

"c:\\Program Files\\BlueSoleil\\BlueSoleil.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"8018:TCP"= 8018:TCP:WWW

R3 GarenaPEngine;GarenaPEngine;c:\docume~1\DUDU\LOCALS~1\Temp\IJA3FE6.tmp [x]

S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-22 33808]

S0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\DRIVERS\xfilt.sys [2006-02-23 11264]

S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]

S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-03-25 24592]

--- ---

*Deregistered* - mbr

.

.

------- -------

.

uStart Page = about:blank

IE: &Сваляне на всички с FlashGet - c:\program files\FlashGet\jc_all.htm

IE: &Сваляне с FlashGet - c:\program files\FlashGet\jc_link.htm

IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

TCP: {92A948B5-F3FB-4643-9AA9-1785A9243BCC} = 78.90.92.1,89.190.192.162

FF - ProfilePath - c:\documents and settings\DUDU\Application Data\Mozilla\Firefox\Profiles\1m1k4rbd.default\

FF - prefs.js: browser.startup.homepage - ######

---- ----

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

.

- - - - - - - -

HKCU-Run-tempo - c:\docume~1\DUDU\LOCALS~1\Temp\clean-temp.exe

HKCU-Run-clean-temp - c:\docume~1\DUDU\LOCALS~1\Temp\svchost.exe

HKCU-Run-winupdate - c:\docume~1\DUDU\LOCALS~1\Temp\svchost.exe

HKLM-Run-tempo - c:\docume~1\DUDU\LOCALS~1\Temp\clean-temp.exe

HKLM-Run-clean-temp - c:\docume~1\DUDU\LOCALS~1\Temp\svchost.exe

HKLM-Run-winupdate - c:\docume~1\DUDU\LOCALS~1\Temp\svchost.exe

HKLM-RunServices-tempo - c:\docume~1\DUDU\LOCALS~1\Temp\clean-temp.exe

HKLM-RunServices-clean-temp - c:\docume~1\DUDU\LOCALS~1\Temp\svchost.exe

HKLM-RunServices-winupdate - c:\docume~1\DUDU\LOCALS~1\Temp\svchost.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-11-06 16:45

Windows 5.1.2600 Service Pack 2 FAT NTAPI

: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]

"ImagePath"="\??\c:\docume~1\DUDU\LOCALS~1\Temp\IJA3FE6.tmp"

.

--------------------- ---------------------

- - - - - - - > 'explorer.exe'(2888)

c:\windows\system32\msi.dll

c:\windows\system32\WPDShServiceObj.dll

c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll

c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ ------------------------

.

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\rundll32.exe

c:\progra~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE

.

**************************************************************************

.

: 2009-11-06 16:47 -

ComboFix-quarantined-files.txt 2009-11-06 14:47

Pre-Run: 5 787 090 944 bytes free

: 5 819 400 192 bytes free

- - End Of File - - 15F6147BA59FCDB682BE38BF3DA8106B

Имах предвид, че имам два инсталационни Windows XP SP2 на харда.

Вече имам и bootable XP, пуснах repair от диска, но проблема си остана.

Здравейте отново:

*. Отворете notepad и въведете чрез copy/paste:

KILLALL::

MIA::

c:\windows\system32\DRIVERS\atapi.sys

Folder::

C:\FOUND.009

C:\FOUND.008

C:\FOUND.007

C:\FOUND.006

C:\FOUND.005

C:\FOUND.004

C:\FOUND.003

C:\FOUND.002

C:\FOUND.001

C:\FOUND.000

c:\documents and settings\DUDU\DoctorWeb

Registry::

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"8018:TCP"=-

MBR::

NoOrphans::

Reboot::

*. Запазeте файла с име CFScript и го провлачете чрез drag/drop в Combofix.exe (както е на картинката)

*. По времето на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

*. Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

ComboFix 09-11-05.05 - DUDU 11.2009 г. 17:32.4.2 - FAT32x86

Running from: c:\documents and settings\DUDU\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\DUDU\Desktop\CFScript.txt

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\DUDU\DoctorWeb

c:\documents and settings\DUDU\DoctorWeb\CureIt.log

C:\FOUND.000

c:\found.000\FILE0000.CHK

c:\found.000\FILE0001.CHK

c:\found.000\FILE0002.CHK

c:\found.000\FILE0003.CHK

c:\found.000\FILE0004.CHK

c:\found.000\FILE0005.CHK

c:\found.000\FILE0006.CHK

c:\found.000\FILE0007.CHK

c:\found.000\FILE0008.CHK

c:\found.000\FILE0009.CHK

c:\found.000\FILE0010.CHK

c:\found.000\FILE0011.CHK

C:\FOUND.001

c:\found.001\FILE0000.CHK

c:\found.001\FILE0001.CHK

c:\found.001\FILE0002.CHK

c:\found.001\FILE0003.CHK

c:\found.001\FILE0004.CHK

c:\found.001\FILE0005.CHK

c:\found.001\FILE0006.CHK

c:\found.001\FILE0007.CHK

c:\found.001\FILE0008.CHK

c:\found.001\FILE0009.CHK

c:\found.001\FILE0010.CHK

c:\found.001\FILE0011.CHK

c:\found.001\FILE0012.CHK

c:\found.001\FILE0013.CHK

c:\found.001\FILE0014.CHK

c:\found.001\FILE0015.CHK

c:\found.001\FILE0016.CHK

c:\found.001\FILE0017.CHK

c:\found.001\FILE0018.CHK

c:\found.001\FILE0019.CHK

c:\found.001\FILE0020.CHK

c:\found.001\FILE0021.CHK

c:\found.001\FILE0022.CHK

c:\found.001\FILE0023.CHK

c:\found.001\FILE0024.CHK

c:\found.001\FILE0025.CHK

c:\found.001\FILE0026.CHK

c:\found.001\FILE0027.CHK

c:\found.001\FILE0028.CHK

c:\found.001\FILE0029.CHK

c:\found.001\FILE0030.CHK

c:\found.001\FILE0031.CHK

c:\found.001\FILE0032.CHK

c:\found.001\FILE0033.CHK

c:\found.001\FILE0034.CHK

c:\found.001\FILE0035.CHK

c:\found.001\FILE0036.CHK

c:\found.001\FILE0037.CHK

c:\found.001\FILE0038.CHK

c:\found.001\FILE0039.CHK

c:\found.001\FILE0040.CHK

c:\found.001\FILE0041.CHK

c:\found.001\FILE0042.CHK

C:\FOUND.002

c:\found.002\FILE0000.CHK

C:\FOUND.003

c:\found.003\FILE0000.CHK

C:\FOUND.004

c:\found.004\FILE0000.CHK

c:\found.004\FILE0001.CHK

c:\found.004\FILE0002.CHK

c:\found.004\FILE0003.CHK

c:\found.004\FILE0004.CHK

c:\found.004\FILE0005.CHK

c:\found.004\FILE0006.CHK

c:\found.004\FILE0007.CHK

c:\found.004\FILE0008.CHK

c:\found.004\FILE0009.CHK

c:\found.004\FILE0010.CHK

c:\found.004\FILE0011.CHK

c:\found.004\FILE0012.CHK

c:\found.004\FILE0013.CHK

c:\found.004\FILE0014.CHK

c:\found.004\FILE0015.CHK

c:\found.004\FILE0016.CHK

c:\found.004\FILE0017.CHK

c:\found.004\FILE0018.CHK

c:\found.004\FILE0019.CHK

c:\found.004\FILE0020.CHK

c:\found.004\FILE0021.CHK

c:\found.004\FILE0022.CHK

c:\found.004\FILE0023.CHK

c:\found.004\FILE0024.CHK

c:\found.004\FILE0025.CHK

c:\found.004\FILE0026.CHK

c:\found.004\FILE0027.CHK

c:\found.004\FILE0028.CHK

c:\found.004\FILE0029.CHK

c:\found.004\FILE0030.CHK

c:\found.004\FILE0031.CHK

c:\found.004\FILE0032.CHK

c:\found.004\FILE0033.CHK

c:\found.004\FILE0034.CHK

c:\found.004\FILE0035.CHK

c:\found.004\FILE0036.CHK

c:\found.004\FILE0037.CHK

c:\found.004\FILE0038.CHK

c:\found.004\FILE0039.CHK

C:\FOUND.005

c:\found.005\FILE0000.CHK

c:\found.005\FILE0001.CHK

c:\found.005\FILE0002.CHK

c:\found.005\FILE0003.CHK

c:\found.005\FILE0004.CHK

C:\FOUND.006

c:\found.006\FILE0000.CHK

C:\FOUND.007

c:\found.007\FILE0000.CHK

c:\found.007\FILE0001.CHK

c:\found.007\FILE0002.CHK

C:\FOUND.008

c:\found.008\FILE0000.CHK

c:\found.008\FILE0001.CHK

c:\found.008\FILE0002.CHK

c:\found.008\FILE0003.CHK

c:\found.008\FILE0004.CHK

C:\FOUND.009

c:\found.009\FILE0000.CHK

c:\found.009\FILE0001.CHK

c:\found.009\FILE0002.CHK

c:\found.009\FILE0003.CHK

c:\found.009\FILE0004.CHK

c:\found.009\FILE0005.CHK

c:\found.009\FILE0006.CHK

c:\found.009\FILE0007.CHK

c:\found.009\FILE0008.CHK

c:\found.009\FILE0009.CHK

c:\found.009\FILE0010.CHK

c:\found.009\FILE0011.CHK

c:\found.009\FILE0012.CHK

c:\found.009\FILE0013.CHK

c:\found.009\FILE0014.CHK

c:\found.009\FILE0015.CHK

c:\found.009\FILE0016.CHK

.

((((((((((((((((((((((((( Files Created from 2009-10-06 to 2009-11-06 )))))))))))))))))))))))))))))))

.

2009-11-06 14:31 . 2004-03-02 15:37 5504 ----a-w- c:\windows\system32\drivers\imagedrv.sys

2009-10-26 09:59 . 2009-10-26 09:59 -------- d-----w- c:\program files\Foxit Software

2009-10-25 21:00 . 2009-10-25 21:00 -------- d-----w- c:\windows\system32\CatRoot_bak

2009-10-23 15:54 . 2009-10-23 15:54 -------- d-----w- c:\documents and settings\DUDU\Application Data\Malwarebytes

2009-10-23 15:54 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-23 15:54 . 2009-10-23 15:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-10-23 15:54 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-10-23 15:54 . 2009-10-23 15:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-10-23 14:47 . 2009-10-23 14:47 -------- d-----w- c:\program files\Common Files\Skype

2009-10-23 14:47 . 2009-10-23 14:47 -------- d-----r- c:\program files\Skype

2009-10-22 21:39 . 2009-10-22 21:39 -------- d-----w- c:\program files\CCleaner

2009-10-22 16:18 . 2009-10-22 16:18 44808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\fssync.dll

2009-10-22 16:18 . 2009-10-22 16:18 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\klbg.sys

2009-10-22 16:18 . 2009-10-22 16:18 208616 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\avp.exe

2009-10-22 16:18 . 2009-10-22 16:18 213520 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\XP\klif.sys

2009-10-22 16:03 . 2009-10-22 16:18 95259 ----a-w- c:\windows\system32\drivers\klick.dat

2009-10-22 16:03 . 2009-10-22 16:18 108059 ----a-w- c:\windows\system32\drivers\klin.dat

2009-10-22 15:54 . 2009-11-06 15:36 46624 --sha-w- c:\windows\system32\drivers\fidbox.dat

2009-10-22 15:54 . 2009-11-06 15:36 32 --sha-w- c:\windows\system32\drivers\fidbox2.dat

2009-10-22 15:54 . 2009-10-22 15:54 -------- d-----w- c:\program files\Kaspersky Lab

2009-10-22 15:54 . 2009-10-22 15:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab

2009-10-21 23:32 . 2009-10-21 23:32 -------- d-----w- c:\documents and settings\DUDU\Application Data\SumatraPDF

2009-10-20 16:52 . 2009-10-20 16:52 -------- d-----w- c:\windows\SxsCaPendDel

2009-10-20 16:40 . 2009-10-20 16:40 -------- d-----w- c:\windows\Sun

2009-10-20 16:39 . 2009-10-20 16:39 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-10-20 16:39 . 2009-10-20 16:39 -------- d-----w- c:\program files\Java

2009-10-20 16:39 . 2009-10-20 16:39 152576 ----a-w- c:\documents and settings\DUDU\Application Data\Sun\Java\jre1.6.0_16\lzma.dll

2009-10-20 15:57 . 2009-10-20 15:57 23600 ----a-w- c:\windows\system32\drivers\TVICHW32.SYS

2009-10-20 15:57 . 2009-10-20 15:57 -------- d-----w- c:\documents and settings\DUDU\Local Settings\Application Data\eSupport.com

2009-10-09 15:45 . 2009-10-09 15:45 -------- d-----w- c:\program files\Common Files\Autodesk Shared

2009-10-09 15:45 . 2009-10-09 15:45 -------- d-----w- c:\program files\AutoCAD LT 2009

2009-10-09 15:45 . 2009-10-09 15:45 -------- d-----w- c:\documents and settings\DUDU\Local Settings\Application Data\Autodesk

2009-10-09 15:45 . 2009-10-09 15:45 -------- d-----w- c:\documents and settings\DUDU\Application Data\Autodesk

2009-10-09 15:45 . 2009-10-09 15:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk

2009-10-09 15:44 . 2009-10-09 15:45 -------- d-----w- c:\program files\MSBuild

2009-10-09 15:44 . 2009-10-09 15:44 108552 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2009-10-09 15:42 . 2009-10-09 15:42 -------- d-----w- c:\windows\system32\XPSViewer

2009-10-09 15:41 . 2009-10-09 15:41 -------- d-----w- c:\program files\Reference Assemblies

2009-10-09 15:41 . 2006-06-29 11:07 14048 ------w- c:\windows\system32\spmsg2.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-06 15:36 . 2009-10-22 15:54 32 --sha-w- c:\windows\system32\drivers\fidbox2.idx

2009-11-06 15:36 . 2009-10-22 15:54 1444 --sha-w- c:\windows\system32\drivers\fidbox.idx

2009-11-06 15:36 . 2007-10-25 03:13 12 ----a-w- c:\windows\bthservsdp.dat

2009-10-24 11:01 . 2007-10-18 19:20 72584 ----a-w- c:\documents and settings\DUDU\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-10-22 16:18 . 2008-01-29 16:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys

2009-09-18 17:15 . 2009-09-18 17:15 -------- d-----w- c:\program files\BORLANDC

.

((((((((((((((((((((((((((((( SnapShot@2009-11-06_14.43.43 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-11-06 15:37 . 2009-11-06 15:37 16384 c:\windows\temp\Perflib_Perfdata_60c.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-11-17 7700480]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 167936]

"DataLayer"="c:\program files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 1106944]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-11-17 86016]

"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-10-22 208616]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

"combofix"="c:\combofix\CF31421.exe" [2009-11-06 388608]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-11-17 1622016]

"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-12-19 16062464]

"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Avant Browser\\avant.exe"=

"c:\\Program Files\\FlashGet\\flashget.exe"=

"c:\\Program Files\\uTorrent\\utorrent.exe"=

"c:\\Program Files\\BlueSoleil\\BlueSoleil.exe"=

R3 GarenaPEngine;GarenaPEngine;c:\docume~1\DUDU\LOCALS~1\Temp\IJA3FE6.tmp [x]

S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-22 33808]

S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]

S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-03-25 24592]

.

.

------- Supplementary Scan -------

.

uStart Page = about:blank

IE: &Сваляне на всички с FlashGet - c:\program files\FlashGet\jc_all.htm

IE: &Сваляне с FlashGet - c:\program files\FlashGet\jc_link.htm

IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

TCP: {92A948B5-F3FB-4643-9AA9-1785A9243BCC} = 78.90.92.1,89.190.192.162

FF - ProfilePath - c:\documents and settings\DUDU\Application Data\Mozilla\Firefox\Profiles\1m1k4rbd.default\

FF - prefs.js: browser.startup.homepage - ######

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-11-06 17:41

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]

"ImagePath"="\??\c:\docume~1\DUDU\LOCALS~1\Temp\IJA3FE6.tmp"

.

------------------------ Other Running Processes ------------------------

.

c:\program files\BlueSoleil\BTNtService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\rundll32.exe

c:\progra~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE

.

**************************************************************************

.

Completion time: 2009-11-06 17:41 - machine was rebooted

ComboFix-quarantined-files.txt 2009-11-06 15:41

ComboFix2.txt 2009-11-06 14:47

Pre-Run: 6 042 910 720 bytes free

Post-Run: 5 786 992 640 bytes free

- - End Of File - - 0F68209ED23931798614946AB7225FD2

Щом вече имате инсталационен диск да пробваме следното:

{можете да си принтирате или препишите инструкциите):

Вкарайте инсталационния диск на Windows XP в оптичното устройство.

Рестартирайте компютъра, като се уверите, че в БИОС-а е направено CD/DVD да е boot-ващото устройство.

(ако CD/DVD-то ви е вече boot-ващо прескочете проверката в Биос-а).

Заредете от диска на Windows и натиснете "R"

Ще бъдете подканен\а да изберете коя Windows инсталация ще възстановявате:

Ако имате само една инсталация просто изберете "1"

След това се изисква и администраторската парола.

Ако не сте въвеждали такава просто натиснете "ENTER".

В появилия се command prompt вече можете да напишете всяка валидна команда.

Въведете следната команда:

fixmbr

натиснете [ENTER]

Натиснете Y за да потвърдите командата.

След това въведете командата:

fixboot

натиснете [ENTER]

Натиснете Y за да потвърдите командара.

Напишете exit за да рестартирате компютъра.

Дано вече успее да зареди в Normal Mode.

Компютърът ми вече се пуска нормално и скайпа не забива.

Благодаря Ви!!!

Радвам се да го чуя.

СТЪПКА 1:

Деинсталирайте Combofix с командата => Start => Run => напишете => Combofix /Uninstall (има празно място между Combofix и /Uninstall).

СТЪПКА 2:

Не е зле да се имунизирате срещу страници с "печална" слава.

1.Изтеглете си тази програма hpHosts и я инсталирайте. На последното прозорче сложете отметка на DISABLE Windows DNS Client (Recommended).

2.Идва ред и на Spyware Blaster 4.2.Oтидeте на Updates и посочете бутона Check for updates.Остава само да отидете в Protection Status и да изберете Enable All Protection.

Разбира се, няма да е зле да използвате алтернативен браузър...

С Opera + Avira Classic (в случай, че използвате Avira разбира се) получавате защита като на Avira Premium с включен WebGuard модул.

С Mozilla Firefox получавате възможността да го закрепите с редица добавки от рода на AdBlock Plus, NoScript, Flashblock.

Във версия 3 има има модул за разпознаване на опасните сайтове => но все пак аз препоръчвам инсталирането на една от следните добавки (особено WoT) Mcafee SiteAdvisor, SITEHOUND, WoT (web of Trust)

Приятно сърфиране !