От тук : http://www.kaldata.com/forums/index.php?showtopic=140141

се мятам при вас

Ето логчета :

Malwarebytes' Anti-Malware 1.41

Database version: 3056

Windows 5.1.2600 Service Pack 5


29.10.2009 г. 23:26:23

mbam-log-2009-10-29 (23-26-23).txt


Scan type: Quick Scan

Objects scanned: 89368

Time elapsed: 2 minute(s), 21 second(s)


Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0


Memory Processes Infected:

(No malicious items detected)


Memory Modules Infected:

(No malicious items detected)


Registry Keys Infected:

(No malicious items detected)


Registry Values Infected:

(No malicious items detected)


Registry Data Items Infected:

(No malicious items detected)


Folders Infected:

(No malicious items detected)


Files Infected:

(No malicious items detected)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:27:36, on 29.10.2009 г.

Platform: Windows XP SP5 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Unlocker\UnlockerAssistant.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Documents and Settings\Tani4ka\Desktop\baubau.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = About:Blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - Startup: AutorunsDisabled

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe


--

End of file - 2811 bytes

СТЪПКА 1

Изтеглете GMER и го разархивирайте го на вашия десктоп.

Преди да сканирате се уверете, че всички останали работещи програми в момента са изключени и вашия антивирусен софтуер няма да предприема никакви действия по време на сканирането на Gmer. Не използвайте компютъра си, докато трае сканирането.

СТЪПКА 2

*. Временно спрете защитата на антивирусната си програма в реално време.

*. Изтеглете Combofix.

*. Запазете го на Десктопа.

*. Отворете Start => run => и въведете следната команда:

"%userprofile%\desktop\ComboFix.exe" /KillAll

*. По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

*. Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

Когато стартирах Combofix, ми излезе следния прозорец:

http://prikachi.com/files/1128361n.jpg

Къде да натисна ???

Предпочитам да питам първо

А и дъното ми пиукна от Combofix май ...Нормално ли е

Редактирано 29 октомври 200916 г. от palavata_tanq (преглед на промените)

Когато стартирах Combofix, ми излезе следния прозорец:

http://prikachi.com/files/1128361n.jpg

Къде да натисна ???

Предпочитам да питам първо

А и дъното ми пиукна от Combofix май ...Нормално ли е

Натиснете YES.

Да нормално е да писука.

GMER 1.0.15.15163 - http://www.gmer.net

Rootkit quick scan 2009-10-29 23:48:23

Windows 5.1.2600 Service Pack 5

Running: gmer.exe; Driver: C:\DOCUME~1\Тani4ka\LOCALS~1\Temp\pgldipoc.sys



---- Devices - GMER 1.0.15 ----


AttachedDevice  \FileSystem\Ntfs \Ntfs       aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

AttachedDevice  \FileSystem\Fastfat \Fat     fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

AttachedDevice  \FileSystem\Fastfat \Fat     aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

AttachedDevice  \Driver\Tcpip \Device\Ip     aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice  \Driver\Tcpip \Device\Tcp    aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice  \Driver\Tcpip \Device\Udp    aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice  \Driver\Tcpip \Device\RawIp  aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)


---- EOF - GMER 1.0.15 ----

Aми Combofix-a ми изписа, че лог файла е в С: , ама там го няма

Редактирано 29 октомври 200916 г. от palavata_tanq (преглед на промените)

Стъпка 1

Отворете notepad и с copy/paste въведете:

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog]

"Start"=dword:00000004

Запазете файла с име fix.reg и го стартирайте.

Стъпка 2

Бихте ли пуснали Combofix наново. Би трябвало лог файла да се появи веднага след като компютъра се рестартира.

ComboFix 09-10-28.08 - Tani4ka 10.2009 г.  0:37.3.2 - NTFSx86

Microsoft Windows XP Professional  5.1.2600.5.1251.359.1033.18.2046.1702 [GMT 2:00]

Running from: c:\documents and settings\Tani4ka\desktop\ComboFix.exe

Command switches used :: /KillAll

AV: avast! antivirus 4.8.1282 [VPS 091029-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.


(((((((((((((((((((((((((   Files Created from 2009-09-28 to 2009-10-29  )))))))))))))))))))))))))))))))

.


2009-10-29 21:23 . 2009-09-10 12:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-29 21:23 . 2009-10-29 21:23	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware

2009-10-29 21:23 . 2009-09-10 12:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys

2009-10-29 19:46 . 2009-10-29 19:46	--------	d-----w-	c:\windows\system32\CatRoot_bak

2009-10-29 19:14 . 2009-10-29 19:14	--------	d-----w-	C:\EmergencyUtils

2009-10-28 23:11 . 2009-10-28 23:11	160272	----a-w-	c:\windows\system32\drivers\tmcomm.sys

2009-10-28 18:06 . 2009-10-28 23:05	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\GlarySoft

2009-10-28 18:05 . 2009-10-28 18:05	--------	d-----w-	c:\program files\Glary Utilities

2009-10-27 08:11 . 2009-10-27 08:11	--------	d-----w-	c:\program files\Trillian

2009-10-26 05:21 . 2009-10-26 05:21	--------	d-----w-	c:\documents and settings\Tani4ka\dwhelper

2009-10-26 05:18 . 2009-10-26 05:18	0	----a-w-	c:\windows\nsreg.dat

2009-10-26 05:18 . 2009-10-26 05:18	--------	d-----w-	c:\documents and settings\Tani4ka\Local Settings\Application Data\Mozilla

2009-10-17 06:18 . 2009-10-17 06:18	123939	----a-w-	c:\windows\system32\drivers\kqemu.sys

2009-10-14 20:52 . 2009-10-14 20:52	--------	d-----w-	c:\program files\Microsoft Group Policy

2009-10-14 17:35 . 2009-10-14 17:35	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\Malwarebytes

2009-10-14 17:35 . 2009-10-14 17:35	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes

2009-10-12 22:37 . 2009-10-13 05:09	--------	d-----w-	c:\program files\nnCron

2009-10-12 19:43 . 1996-12-04 21:00	77824	----a-w-	c:\windows\system32\ODBCTL32.dll

2009-10-12 19:43 . 2000-07-19 06:00	24848	----a-w-	c:\windows\system32\MSJtEr35.dll

2009-10-12 19:43 . 2000-07-19 06:00	123664	----a-w-	c:\windows\system32\MSJInt35.dll

2009-10-12 19:43 . 2000-06-08 14:00	430080	----a-w-	c:\windows\system32\MsRepl35.dll

2009-10-12 19:43 . 2000-06-08 14:00	1064960	----a-w-	c:\windows\system32\MSJet35.dll

2009-10-12 19:43 . 1996-12-04 21:00	251664	----a-w-	c:\windows\system32\MSRD2x35.dll

2009-10-12 19:42 . 1997-01-15 21:00	71680	----a-w-	c:\windows\ST5UNST.EXE

2009-10-12 11:53 . 2009-10-12 11:53	68	----a-w-	c:\windows\FTp.scr

2009-10-12 11:01 . 2009-10-28 23:01	--------	d-----w-	c:\program files\vetton.ru

2009-10-10 08:04 . 2009-10-10 08:04	15872	----a-w-	c:\windows\system32\srvany.exe

2009-10-09 13:22 . 2009-10-09 13:24	--------	d-----w-	c:\windows\tmpT12

2009-10-09 13:09 . 2002-01-12 13:30	3567	----a-w-	c:\windows\system32\drivers\PortTalk.sys

2009-10-09 03:28 . 2009-10-09 03:28	--------	d-----w-	c:\documents and settings\Tani4ka\Local Settings\Application Data\Runscanner.net

2009-10-08 06:35 . 2009-10-08 06:35	--------	d-----w-	c:\program files\CAM Development

2009-10-08 06:35 . 2009-10-08 06:35	--------	d-----w-	c:\documents and settings\All Users\Application Data\CAM Development

2009-10-06 17:07 . 2008-04-14 17:08	26112	----a-w-	c:\windows\system32\setupcl.exe

2009-10-05 17:53 . 2009-10-05 17:53	--------	d-----w-	c:\documents and settings\Tani4ka\Local Settings\Application Data\TechSmith

2009-10-05 17:50 . 2009-10-05 17:50	--------	d-----w-	c:\windows\system32\QuickTime

2009-10-05 17:50 . 2009-10-05 17:50	--------	d-----w-	c:\documents and settings\All Users\Application Data\TechSmith

2009-10-05 17:49 . 2009-10-05 17:49	--------	d-----w-	c:\program files\Common Files\TechSmith Shared

2009-10-05 17:49 . 2009-10-05 17:49	--------	d-----w-	c:\program files\TechSmith

2009-10-05 15:33 . 2009-10-13 05:09	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\EssentialPIM

2009-10-04 06:33 . 2009-10-29 21:13	--------	d-----w-	c:\windows\system32\wbem\Logs

2009-10-04 06:31 . 2009-10-29 22:37	--------	d-----w-	c:\windows\system32\CatRoot2

2009-10-04 06:10 . 2008-11-15 22:12	2978	----a-w-	c:\windows\system32\DELTEMP.CMD

2009-10-04 06:10 . 2004-06-11 12:33	290304	----a-w-	c:\windows\system32\subinacl.exe

2009-10-03 07:40 . 2007-12-17 00:34	107864	----a-w-	c:\windows\system32\tsccvid.dll

2009-10-03 07:40 . 2009-10-03 07:40	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\Media Player Classic

2009-10-03 05:03 . 2009-10-28 23:03	--------	d-----w-	c:\windows\system32\NtmsData

2009-10-02 22:59 . 2009-10-02 22:59	--------	d-----w-	c:\program files\Windows Resource Kits


.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-29 20:35 . 2009-09-15 16:49	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\Skype

2009-10-28 18:12 . 2009-09-15 17:59	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\uTorrent

2009-10-27 06:31 . 2009-09-22 02:51	15600	----a-w-	c:\windows\system32\drivers\???????

2009-10-07 15:11 . 2009-09-24 08:17	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\Thinstall

2009-10-05 17:53 . 2009-09-15 13:33	12720	----a-w-	c:\documents and settings\Tani4ka\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-10-03 05:24 . 2009-09-25 18:05	--------	d-----w-	c:\program files\Picture Resize Genius

2009-10-03 05:23 . 2009-09-22 05:41	--------	d-----w-	c:\program files\RocketDock

2009-09-27 16:46 . 2009-09-27 16:46	--------	d-----w-	c:\program files\DIFX

2009-09-25 21:32 . 2009-09-22 14:42	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\Dropbox

2009-09-24 21:57 . 2009-09-24 21:57	--------	d-----w-	c:\program files\Common Files\Windows Live

2009-09-24 21:16 . 2009-09-24 21:16	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\JAM Software

2009-09-24 10:14 . 2009-09-24 10:14	--------	d-----w-	c:\program files\Trend Micro

2009-09-21 14:11 . 2009-09-21 14:10	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\TeamViewer

2009-09-19 09:59 . 2009-09-19 09:59	--------	d-----w-	c:\program files\Common Files\Adobe

2009-09-19 09:51 . 2009-09-19 09:51	--------	d-----w-	c:\program files\Alwil Software

2009-09-18 09:56 . 2009-09-18 09:56	411368	----a-w-	c:\windows\system32\deploytk.dll

2009-09-18 09:56 . 2009-09-18 09:56	--------	d-----w-	c:\program files\Java

2009-09-16 04:11 . 2009-09-16 04:11	--------	d-----w-	c:\program files\iВыкл

2009-09-16 03:33 . 2009-09-16 03:33	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\FindeXer

2009-09-15 23:36 . 2009-09-15 23:36	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\GRETECH

2009-09-15 23:35 . 2009-09-15 23:35	--------	d-----w-	c:\program files\GRETECH

2009-09-15 23:35 . 2009-09-15 23:35	--------	d-----w-	c:\program files\Combined Community Codec Pack

2009-09-15 21:25 . 2009-09-15 21:21	--------	d-----w-	c:\program files\Dev

2009-09-15 21:17 . 2009-09-15 21:17	--------	d-----w-	c:\program files\STDUViewer

2009-09-15 21:17 . 2009-09-15 21:17	--------	d-----w-	c:\program files\Common Files\STDUtility

2009-09-15 19:53 . 2009-09-15 19:53	--------	d-----w-	c:\program files\7z SFX Tools

2009-09-15 18:14 . 2009-09-15 18:02	--------	d-----w-	c:\program files\Unlocker

2009-09-15 18:12 . 2009-09-15 18:12	--------	d-----w-	c:\program files\HashTab Shell Extension

2009-09-15 18:00 . 2009-09-15 18:00	--------	d-----w-	c:\program files\uTorrent

2009-09-15 17:31 . 2009-09-15 17:31	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\Nero

2009-09-15 17:30 . 2009-09-15 17:30	--------	d-----w-	c:\program files\Common Files\Nero

2009-09-15 17:30 . 2009-09-15 17:30	--------	d-----w-	c:\program files\Nero

2009-09-15 17:29 . 2009-09-15 17:29	--------	d-----w-	c:\program files\Alcohol Soft

2009-09-15 16:56 . 2009-09-15 16:56	685816	----a-w-	c:\windows\system32\drivers\sptd.sys

2009-09-15 16:49 . 2009-09-15 16:49	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skype

2009-09-15 16:49 . 2009-09-15 16:49	--------	d-----w-	c:\program files\Skype

2009-09-15 16:47 . 2009-09-15 16:47	--------	d-----w-	c:\documents and settings\Tani4ka\Application Data\USBSafelyRemove

2009-09-15 16:29 . 2009-09-15 16:29	--------	d-----w-	c:\program files\Opera

2009-09-15 14:13 . 2009-09-15 14:13	86016	----a-w-	c:\windows\system32\OpenAL32.dll

2009-09-15 14:13 . 2009-09-15 14:13	262144	----a-w-	c:\windows\system32\wrap_oal.dll

2009-09-15 14:11 . 2009-09-15 14:11	--------	d--h--w-	c:\program files\InstallShield Installation Information

2009-09-15 14:11 . 2009-09-15 14:11	--------	d-----w-	c:\program files\Futuremark

2009-09-15 14:09 . 2009-09-22 06:13	2987368	----a-w-	C:\Procmon.exe

2009-09-10 17:30 . 2009-09-10 17:30	--------	d-----w-	c:\program files\microsoft frontpage

2009-09-10 17:27 . 2009-09-10 17:27	21640	----a-w-	c:\windows\system32\emptyregdb.dat

2009-09-10 16:43 . 2009-09-10 16:43	664	----a-w-	c:\windows\system32\d3d9caps.dat

.


(((((((((((((((((((((((((((((   SnapShot@2009-10-29_22.01.59   )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-10-29 22:40 . 2009-10-29 22:40	16384              c:\windows\Temp\Perflib_Perfdata_4c8.dat

+ 2009-10-29 22:40 . 2009-10-29 22:40	16384              c:\windows\Temp\Perflib_Perfdata_100.dat

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-12 81000]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-30 13750272]


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoFavoritesMenu"= 1 (0x1)

"NoSMMyDocs"= 1 (0x1)

"NoSMMyPictures"= 1 (0x1)

"NoStartMenuMyMusic"= 1 (0x1)

"NoRecentDocsNetHood"= 1 (0x1)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoFavoritesMenu"= 1 (0x1)

"NoSMMyDocs"= 1 (0x1)

"NoSMMyPictures"= 1 (0x1)

"NoStartMenuMyMusic"= 1 (0x1)

"NoRecentDocsNetHood"= 1 (0x1)


[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]

"NoAutoUpdate"= 1 (0x1)


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"RRT-Auto"=c:\docume~1\Tani4ka\LOCALS~1\Temp\Rar$EX00.968\RRT.exe auto

"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Opera\\opera.exe"=

"c:\\WINDOWS\\system32\\ftp.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=


R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [9/19/2009 11:51 AM 110160]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [9/19/2009 11:51 AM 20560]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [9/10/2009 7:39 PM 1684736]

S3 kqemu;KQEMU virtualisation module for QEMU;c:\windows\system32\drivers\kqemu.sys [10/17/2009 8:18 AM 123939]

S3 PortTalk;PortTalk;c:\windows\system32\drivers\PortTalk.sys [10/9/2009 3:09 PM 3567]

S3 rk_remover;rk_remover;\??\c:\windows\system32\drivers\rk_remover.sys --> c:\windows\system32\drivers\rk_remover.sys [?]

S4 RecycleNOW.exe;RecycleNOW.exe;c:\windows\system32\srvany.exe [10/10/2009 10:04 AM 15872]


--- Other Services/Drivers In Memory ---


*NewlyCreated* - PCIIDEX_2

*Deregistered* - CLASSPNP_2

*Deregistered* - mbr

*Deregistered* - PCIIDEX_2

.

Contents of the 'Scheduled Tasks' folder


2009-10-29 c:\windows\Tasks\GlaryInitialize.job

- c:\program files\Glary Utilities\initialize.exe [2009-10-28 17:27]

.

.

------- Supplementary Scan -------

.

uStart Page = About:Blank

.


**************************************************************************


catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-30 00:40

Windows 5.1.2600 Service Pack 5 NTFS


scanning hidden processes ...  


scanning hidden autostart entries ... 


scanning hidden files ...  


scan completed successfully

hidden files: 0


**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------


- - - - - - - > 'explorer.exe'(3684)

c:\windows\system32\msi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\program files\Alwil Software\Avast4\aswUpdSv.exe

c:\program files\Alwil Software\Avast4\ashServ.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

c:\program files\Alwil Software\Avast4\ashMaiSv.exe

c:\program files\Alwil Software\Avast4\ashWebSv.exe

.

**************************************************************************

.

Completion time: 2009-10-29  0:42 - machine was rebooted

ComboFix-quarantined-files.txt  2009-10-29 22:42


Pre-Run: 6 279 114 752 bytes free

Post-Run: 6 240 022 528 bytes free


- - End Of File - - 77B7A90E05B53D0132EBE47A4E3BC13F

Хмм.

Бихте ли изпратили този файл за анализ на следния адрес => http://www.virustotal.com/

c:\windows\system32\srvany.exe

TrendMicro Sysclean

Изтеглете следните 3-части:

[*]Sysclean Package

[*]Virus Pattern Files - Official Pattern Release

[*]Spyware Pattern Files - Detection and Cleanup (Trend Micro Anti-Spyware) – Ssapiptn.Da5

Направете папка на дял C:\ (или място по-избор) с име TrendMicro

Копирайте там и 3-те изтеглени файлове.

Разархивирайте вирусните и антишпионските дефиниции.

Стартирайте sysclean.com => уверете се, че следните отметки са поставени:

Изберете бутона SCAN.

След края на проверката, отворете отново папката C:\TrendMicro и проверете съдържанието на лог файла sysclean.log

/--------------------------------------------------------------\

|                  Trend Micro System Cleaner                  |

|            Copyright 2009-2010, Trend Micro, Inc.            |

|                  http://www.trendmicro.com                   |

\--------------------------------------------------------------/



2009-10-30, 01:11:13,   Auto-clean mode specified.

2009-10-30, 01:11:13,   Failed to initialize Rootkit Driver.

2009-10-30, 01:11:13,   Running scanner "C:\TrendMicro\TSC.BIN"...

2009-10-30, 01:11:17,   Scanner "C:\TrendMicro\TSC.BIN" has finished running.

2009-10-30, 01:11:17,   TSC Log:


яюD a m a g e   C l e a n u p   E n g i n e   ( D C E )     6 . 1 ( B u i l d   1 0 2 7 )   ( R C M :   D r i v e r   n o t   r e a d y ! ) 



 W i n d o w s   X P ( B u i l d   2 6 0 0 :   S e r v i c e   P a c k   5 ) 





 S t a r t   t i m e   :   ?5BJ:  :B><2@8  3 0   2 0 0 9   0 1 : 1 1 : 1 4 






 L o a d   D a m a g e   C l e a n u p   T e m p l a t e   ( D C T )   " C : \ T r e n d M i c r o \ T M R D C T . p t n "   ( v e r s i o n   )   [ f a i l ] 



 L o a d   D a m a g e   C l e a n u p   T e m p l a t e   ( D C T )   " C : \ T r e n d M i c r o \ t s c . p t n "   ( v e r s i o n   1 0 6 4 )   [ s u c c e s s ] 






 C o m p l e t e   t i m e   :   ?5BJ:  :B><2@8  3 0   2 0 0 9   0 1 : 1 1 : 1 7 



 E x e c u t e   p a t t e r n   c o u n t ( 3 0 6 3 ) ,   V i r u s   f o u n d   c o u n t ( 0 ) ,   V i r u s   c l e a n   c o u n t ( 0 ) ,   C l e a n   f a i l e d   c o u n t ( 0 ) 






 2009-10-30, 01:11:17,   Running scanner "C:\TrendMicro\VSCANTM.BIN"...

2009-10-30, 01:18:29,   Scanner "C:\TrendMicro\VSCANTM.BIN" has finished running.

2009-10-30, 01:18:29,   VSCANTM Log:


2009-10-30, 01:18:29,   Files Detected:

Copyright (c) 1990 - 2006 Trend Micro Inc.

Report Date : 10/30/2009 01:11:17

VSAPI Engine Version : 8.950-1092

VSCANTM Version : 3.00-1018 (Official Build)


VSGetVirusPatternInformation is invoked


Virus Pattern Version : 587 (478901/478901 Patterns) (2009/10/29) (658700)


Command Line: C:\TrendMicro\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /BK /LR C:\*.* /P=C:\TrendMicro\lpt$vpn.587 


23639 files have been read.

23639 files have been checked.

23607 files have been scanned.

57061 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At: 10/30/2009 01:18:29	7 minutes 11 seconds (431.03 seconds) has elapsed.(18.234 msec/file)

---------*---------*---------*---------*---------*---------*---------*---------*

2009-10-30, 01:18:29,   Files Clean:

Copyright (c) 1990 - 2006 Trend Micro Inc.

Report Date : 10/30/2009 01:11:17

VSAPI Engine Version : 8.950-1092

VSCANTM Version : 3.00-1018 (Official Build)


VSGetVirusPatternInformation is invoked


Virus Pattern Version : 587 (478901/478901 Patterns) (2009/10/29) (658700)


Command Line: C:\TrendMicro\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /BK /LR C:\*.* /P=C:\TrendMicro\lpt$vpn.587 


23639 files have been read.

23639 files have been checked.

23607 files have been scanned.

57061 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At: 10/30/2009 01:18:29	7 minutes 11 seconds (431.03 seconds) has elapsed.(18.234 msec/file)

---------*---------*---------*---------*---------*---------*---------*---------*

2009-10-30, 01:18:29,   Clean Fail:

Copyright (c) 1990 - 2006 Trend Micro Inc.

Report Date : 10/30/2009 01:11:17

VSAPI Engine Version : 8.950-1092

VSCANTM Version : 3.00-1018 (Official Build)


VSGetVirusPatternInformation is invoked


Virus Pattern Version : 587 (478901/478901 Patterns) (2009/10/29) (658700)


Command Line: C:\TrendMicro\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /BK /LR C:\*.* /P=C:\TrendMicro\lpt$vpn.587 


23639 files have been read.

23639 files have been checked.

23607 files have been scanned.

57061 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At: 10/30/2009 01:18:29	7 minutes 11 seconds (431.03 seconds) has elapsed.(18.234 msec/file)

---------*---------*---------*---------*---------*---------*---------*---------*

2009-10-30, 01:18:29,   Running scanner "C:\TrendMicro\VSCANTM.BIN"...

2009-10-30, 01:26:53,   Scanner "C:\TrendMicro\VSCANTM.BIN" has finished running.

2009-10-30, 01:26:53,   VSCANTM Log:


2009-10-30, 01:26:53,   Files Detected:

Copyright (c) 1990 - 2006 Trend Micro Inc.

Report Date : 10/30/2009 01:18:29

VSAPI Engine Version : 8.950-1092

VSCANTM Version : 3.00-1018 (Official Build)


VSGetVirusPatternInformation is invoked


Virus Pattern Version : 587 (478901/478901 Patterns) (2009/10/29) (658700)


Command Line: C:\TrendMicro\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /BK /LR D:\*.* /P=C:\TrendMicro\lpt$vpn.587 


5946 files have been read.

5946 files have been checked.

5942 files have been scanned.

8925 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At: 10/30/2009 01:26:53	8 minutes 23 seconds (503.13 seconds) has elapsed.(84.616 msec/file)

---------*---------*---------*---------*---------*---------*---------*---------*

2009-10-30, 01:26:53,   Files Clean:

Copyright (c) 1990 - 2006 Trend Micro Inc.

Report Date : 10/30/2009 01:18:29

VSAPI Engine Version : 8.950-1092

VSCANTM Version : 3.00-1018 (Official Build)


VSGetVirusPatternInformation is invoked


Virus Pattern Version : 587 (478901/478901 Patterns) (2009/10/29) (658700)


Command Line: C:\TrendMicro\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /BK /LR D:\*.* /P=C:\TrendMicro\lpt$vpn.587 


5946 files have been read.

5946 files have been checked.

5942 files have been scanned.

8925 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At: 10/30/2009 01:26:53	8 minutes 23 seconds (503.13 seconds) has elapsed.(84.616 msec/file)

---------*---------*---------*---------*---------*---------*---------*---------*

2009-10-30, 01:26:53,   Clean Fail:

Copyright (c) 1990 - 2006 Trend Micro Inc.

Report Date : 10/30/2009 01:18:29

VSAPI Engine Version : 8.950-1092

VSCANTM Version : 3.00-1018 (Official Build)


VSGetVirusPatternInformation is invoked


Virus Pattern Version : 587 (478901/478901 Patterns) (2009/10/29) (658700)


Command Line: C:\TrendMicro\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /BK /LR D:\*.* /P=C:\TrendMicro\lpt$vpn.587 


5946 files have been read.

5946 files have been checked.

5942 files have been scanned.

8925 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At: 10/30/2009 01:26:53	8 minutes 23 seconds (503.13 seconds) has elapsed.(84.616 msec/file)

---------*---------*---------*---------*---------*---------*---------*---------*

2009-10-30, 01:26:53,   Running SSAPI scanner ""...

2009-10-30, 01:33:42,   SSAPI Log:


SSAPI Scanner Version: 1.0.1003

SSAPI Engine Version: 5.2.1032

SSAPI Pattern Version: 8.49

SSAPI Anti-Rootkit Version: <Failed>


Spyware Scan Started: 10/30/2009 01:26:56


Detected: 0 items.


Spyware Scan Ended: 10/30/2009 01:33:42

Scan Complete. Time=408.221283.

Хммм явно не е заради вирус.

Моля, изтеглете SystemLook и запазете програмата на десктопа.

# Кликнете два пъти върху SystemLook.exe, за да стартирате програмата.

# Копирайте съдържанието на следния код в текстовото поле на програмата

:filefind

msconfig.exe

* Кликнете на бутона Look, за да започне сканирането.

* Когато сканирането завърши ще Ви се отвори Notepad с резултата от сканирането. Моля, публикувайте лог файла в следващия си коментар.

Заповядайте Г-не

SystemLook v1.0 by jpshortstuff (29.08.09)

Log created at 01:44 on 30/10/2009 by Tani4ka (Administrator - Elevation successful)


========== filefind ==========


Searching for "msconfig.exe"

C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe	--a--- 169984 bytes	[17:27 10/09/2009]	[04:45 27/11/2008] A81135541C9D4EBCE43EFA8AD31395B4

C:\WINDOWS\system32\dllcache\msconfig.exe	--a--c 169984 bytes	[17:27 10/09/2009]	[04:45 27/11/2008] A81135541C9D4EBCE43EFA8AD31395B4


-=End Of File=-

Става все по-интересно...

• Изтеглете Win32kDiag от някой от следните линкове и го запазете на вашия десктоп.

• Линк #1
  
• Линк #2
  
• Линк #3
  

• Кликнете два пъти върху Win32kDiag.exe, за да стартирате Win32kDiag , след което я изчакайте да приключи работата си.
  
• Когато изпише "Finished! Press any key to exit...", натиснете произволен бутон от вашата клавиатура, за да се затвори прозореца.
  
• Кликнете два пъти върху Win32kDiag.txt, който се намира на вашия десктоп и поставете цялото съдържание на лог файла в следващия Ви коментар в тази тема.
  

Running from: C:\Documents and Settings\Tani4ka\Desktop\Win32kDiag.exe


Log file at : C:\Documents and Settings\Tani4ka\Desktop\Win32kDiag.txt


WARNING: Could not get backup privileges!


Searching 'C:\WINDOWS'...






Finished!

Тъй като случая е разрешен => http://www.kaldata.com/forums/index.php?showtopic=140141

Слагам статус [РЕШЕН] на случая. Пфу-у-у бая неща опитахме, но научихме поне нещо ново.