Проблем с прекъсване на интернета,съмнения за вирус [РЕШЕН]

16 ноември 200916 г.

Уверете се, че интернет връзката е активна и натиснете YES.

16 ноември 200916 г.

Автор

GMER 1.0.15.15227 - http://www.gmer.net

Rootkit quick scan 2009-11-16 23:48:12

Windows 5.1.2600 Service Pack 3

Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ugtdrpow.sys

---- System - GMER 1.0.15 ----

SSDT sptd.sys ZwEnumerateKey [0xB9EC5E2C]

SSDT sptd.sys ZwEnumerateValueKey [0xB9EC61BA]

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 8A24A1E8

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- EOF - GMER 1.0.15 ----

' date='17 ноември 2009 - 00:39 ' timestamp='1258411150' post='1560557']
Уверете се, че интернет връзката е активна и натиснете YES.

Направих го и неможа да го истегли този файл,след това започна някво сканиране рестартира се компа два пъти и не видях никъде лог файл.Впрочем компа сега работи добре явно е на приливи и отливи.

Редактирано 16 ноември 200916 г. от Colt1911 (преглед на промените)

16 ноември 200916 г.

Отворете C:\Combofix или C:\Qoobox\Combofix.txt и публикувайте лог файловете.

16 ноември 200916 г.

Автор

ComboFix 09-10-30.01 - Administrator .11.2009 . 12:52.1.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.1535.1148 [GMT 2:00]

Running from: c:\documents and settings\Administrator\desktop\ComboFix.exe

Command switches used :: /KillAll

AV: avast! antivirus 4.8.1351 [VPS 091031-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: ActiveArmor Firewall *disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\cbkulrcr.ini

c:\windows\system32\cjrxfwem.ini

c:\windows\system32\clufrwnm.ini

c:\windows\system32\eayuebfj.ini

c:\windows\system32\fdbggnmj.ini

c:\windows\system32\fulpyvtg.ini

c:\windows\system32\gjunobjc.ini

c:\windows\system32\hqyrmmrp.ini

c:\windows\system32\iaiuppps.ini

c:\windows\system32\jbecyaqf.ini

c:\windows\system32\jgmandeq.ini

c:\windows\system32\jlUFffii.ini

c:\windows\system32\jlUFffii.ini2

c:\windows\system32\jvuretak.ini

c:\windows\system32\kgbrwdxy.ini

c:\windows\system32\kxldtbat.ini

c:\windows\system32\lbstvloy.ini

c:\windows\system32\pavftbcy.ini

c:\windows\system32\pxmesylm.ini

c:\windows\system32\qwswsnxf.ini

c:\windows\system32\syutuqrp.ini

c:\windows\system32\tmp67.tmp

c:\windows\system32\tmp68.tmp

c:\windows\system32\uituptwh.ini

c:\windows\system32\wbgosqxj.ini

.

((((((((((((((((((((((((( Files Created from 2009-10-01 to 2009-11-01 )))))))))))))))))))))))))))))))

.

2009-11-01 10:22 . 2009-11-01 10:22 -------- d-----w- c:\windows\LastGood.Tmp

2009-11-01 00:55 . 2009-11-01 00:55 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2009-11-01 00:55 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-11-01 00:55 . 2009-11-01 00:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-11-01 00:55 . 2009-11-01 00:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-11-01 00:55 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-10-25 12:05 . 2009-10-25 12:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage

2009-10-14 23:58 . 2009-10-14 23:58 41872 ----a-w- c:\windows\system32\xfcodec.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-01 10:34 . 2008-08-07 12:06 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype

2009-11-01 10:21 . 2008-08-07 12:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM

2009-11-01 00:51 . 2008-08-07 12:53 -------- d-----w- c:\documents and settings\Administrator\Application Data\Xfire

2009-10-31 22:51 . 2008-08-07 13:57 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2009-10-31 22:51 . 2008-08-07 13:35 103736 ----a-w- c:\windows\system32\PnkBstrB.exe

2009-10-31 12:22 . 2008-08-07 12:32 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent

2009-10-30 08:59 . 2008-08-07 12:53 -------- d-s---w- c:\program files\Xfire

2009-10-23 22:25 . 2008-08-07 12:18 75064 ----a-w- c:\windows\system32\PnkBstrA.exe

2009-10-20 17:27 . 2008-08-07 11:56 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-10-04 12:39 . 2009-07-02 14:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Hamachi

2009-10-04 11:44 . 2009-05-06 13:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\Any Video Converter

2009-09-19 08:15 . 2009-09-19 08:13 -------- d-----w- c:\program files\Calculator.NET

2009-09-19 08:13 . 2008-08-07 11:50 24384 -c--a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-08-17 16:10 . 2009-05-07 06:34 1279456 ----a-w- c:\windows\system32\aswBoot.exe

2009-08-17 16:06 . 2009-05-07 06:35 93392 ----a-w- c:\windows\system32\drivers\aswmon.sys

2009-08-17 16:06 . 2009-05-07 06:35 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2009-08-17 16:05 . 2009-05-07 06:35 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys

2009-08-17 16:05 . 2009-05-07 06:35 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2009-08-17 16:04 . 2009-05-07 06:35 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2009-08-17 16:04 . 2009-05-07 06:35 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2009-08-17 16:03 . 2009-05-07 06:35 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2009-08-17 16:02 . 2009-05-07 06:35 97480 ----a-w- c:\windows\system32\AvastSS.scr

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-05-30 21718312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]

"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-04 8523776]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-04 81920]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-12-04 1626112]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-09-01 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

Nokia Ovi Suite.lnk - c:\program files\Nokia\Ovi\Suite\RunLauncher.exe [2008-11-11 946176]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"d:\\Games\\cod4\\iw3mp.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Nokia\\Nokia Home Media Server\\Media Server\\twonkymedia.exe"=

"c:\\Program Files\\Nokia\\Nokia Home Media Server\\Media Server\\twonkymediaserver.exe"=

"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"22841:TCP"= 22841:TCP:BitComet 22841 TCP

"22841:UDP"= 22841:UDP:BitComet 22841 UDP

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [06.12.2005 . 17:11 35328]

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [07.5.2009 . 08:35 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [07.5.2009 . 08:35 20560]

S2 TwonkyMedia;TwonkyMedia;c:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 --> c:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - CLASSPNP_2

*NewlyCreated* - MBR

*Deregistered* - CLASSPNP_2

*Deregistered* - mbr

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.bg/

IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm

IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: {{60237576-b24c-4ba9-9740-c9f3ec9db557} - {EAADF17C-B6EA-4511-8549-A67CFD406EAF} - c:\progra~1\SkyCode\WEBTRA~1\wt2ie.dll

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0dxjckpk.default\

FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://google.bg

FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=

FF - plugin: c:\program files\ACE Mega CoDecS Pack\SystemS\RealMedia\Browser\plugins\nppl3260.dll

FF - plugin: c:\program files\ACE Mega CoDecS Pack\SystemS\RealMedia\Browser\plugins\nprpjplug.dll

.

- - - - ORPHANS REMOVED - - - -

BHO-{1468C7C6-17BD-49B7-8FA3-53B2DAE30EEF} - (no file)

HKLM-Run-NWEReboot - (no file)

Notify-WgaLogon - (no file)

Notify-xXPjKcYP - xXPjKcYP.dll

AddRemove-WOLAPI - c:\westwood\Internet\UnstllAP.EXE

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-11-01 12:59

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1372)

c:\windows\system32\WPDShServiceObj.dll

c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll

c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll

c:\program files\Nokia\PC Connectivity Solution\ConnAPI.DLL

c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_eng.nlr

c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Alwil Software\Avast4\aswUpdSv.exe

c:\program files\Alwil Software\Avast4\ashServ.exe

c:\windows\system32\RUNDLL32.EXE

c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

c:\windows\system32\nvsvc32.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

c:\windows\system32\PnkBstrA.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

c:\windows\system32\wscntfy.exe

c:\program files\Skype\Plugin Manager\skypePM.exe

c:\program files\Alwil Software\Avast4\ashMaiSv.exe

c:\program files\Alwil Software\Avast4\ashWebSv.exe

.

**************************************************************************

.

Completion time: 2009-11-01 13:02 - machine was rebooted

ComboFix-quarantined-files.txt 2009-11-01 11:01

Pre-Run: 1 173 204 992 bytes free

Post-Run: 1 340 116 992 bytes free

- - End Of File - - 16B602574BA7264F88EE5A8E1F3F5B95

16 ноември 200916 г.

Това е стартия лог файла от този пост:

http://www.kaldata.com/forums/index.php?showtopic=140299&view=findpost&p=1547272

Друг няма ли ?

16 ноември 200916 г.

Автор

Няма друг само този беше в папката Qoobox.

16 ноември 200916 г.

Няма друг само този беше в папката Qoobox.

А в свободната на C:\ ?

Отворете Start => Run => и въведете тази команда => %systemdrive%\ComboFix\Combobatch.bat

Кажете ми какво се случва.

16 ноември 200916 г.

Автор

Няма нищо и в C:\ и пише че неможе да го намери ComboFix\Combobatch.bat

16 ноември 200916 г.

Изтегли DDS от тук.

Запази го на десктопа.

Изключи защитата в реално време на антивирусната си програма (ако е инсталирана такава).Накрая, стартирай инструмента.

Когато DDS приключи успешно анализа на системата ще отвори два лог файла.

DDS.txt
Attach.txt

Запази ги на десктопа и след това ги прикачи към следващия си пост.

16 ноември 200916 г.

Автор

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-10-26.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 07.8.2008 . 14:43:14

System Uptime: 17.11.2009 . 00:18:38 (1 hours ago)

Motherboard: | | K8NF6G-VSTA

Processor: AMD Sempron Processor 2800+ | CPUSocket | 1607/200mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 15 GiB total, 1,177 GiB free.

D: is FIXED (NTFS) - 60 GiB total, 0,189 GiB free.

E: is CDROM ()

F: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: Hamachi Network Interface

Device ID: ROOT\NET\0000

Manufacturer: LogMeIn, Inc.

Name: Hamachi Network Interface

PNP Device ID: ROOT\NET\0000

Service: hamachi

==== System Restore Points ===================

RP517: 06.11.2009 . 00:20:19 - Контролна точка на системата

RP518: 07.11.2009 . 01:25:13 - Контролна точка на системата

RP519: 08.11.2009 . 13:23:18 - Контролна точка на системата

RP520: 10.11.2009 . 09:07:29 - Контролна точка на системата

RP521: 11.11.2009 . 12:41:20 - Контролна точка на системата

RP522: 12.11.2009 . 14:42:13 - Контролна точка на системата

RP523: 13.11.2009 . 15:25:39 - Контролна точка на системата

RP524: 14.11.2009 . 13:58:40 - Installed Windows Media Format 9 Series Runtime Setup

RP525: 14.11.2009 . 17:40:27 - Removed Need for Speed™ ProStreet

RP526: 15.11.2009 . 16:01:21 - Installed DirectX

==== Installed Programs ======================

Архиватор WinRAR

µTorrent

4 Elements

ACE Mega CoDecS Pack

Adobe Flash Player 10 Plugin

Adobe Flash Player ActiveX

Adobe Reader 7.0.5

Adobe® Photoshop® Album Starter Edition 3.0

Any Video Converter 2.5.3

avast! Antivirus

AVI Joiner

AVI Splitter

Bad CD Repair v3.0

Bulgarian Phonetic for WinXP

Calculator.NET

Call of Duty

Call of Duty - United Offensive

Call of Duty Modern Warfare 2

Call of Duty® - World at War 1.1 Patch

Call of Duty® 2

Call of Duty® 2 Patch 1.3

Call of Duty® 4 - Modern Warfare

Call of Duty® 4 - Modern Warfare 1.3 Patch

Call of Duty® 4 - Modern Warfare 1.4 Patch

Call of Duty® 4 - Modern Warfare 1.5 Multiplayer Patch

Call of Duty® 4 - Modern Warfare 1.5 Patch

Call of Duty® 4 - Modern Warfare 1.6 Patch

Call of Duty® 4 - Modern Warfare 1.7 Patch

CCleaner (remove only)

Defraggler (remove only)

EAX4 Unified Redist

Favorite-Games Sounds

Halo 2 for Windows Vista

Hamachi 1.0.1.5

High Definition Audio Driver Package - KB888111

HijackThis 2.0.2

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Windows XP (KB954550-v5)

LIVE gaming on Windows Runtime Version 1.0.6027

Malwarebytes' Anti-Malware

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Software Update for Web Folders (English) 12

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 Redistributable

Mozilla Firefox (3.0.15)

MSXML 4.0 SP2 Parser and SDK

MSXML 6.0 Parser (KB933579)

Nero 7 Ultra Edition

Nokia Connectivity Cable Driver

Nokia Flashing Cable Driver

Nokia Home Media Server

Nokia Map Loader

Nokia Ovi Application Installer

Nokia Ovi Application Installer 6.85.3010

Nokia Ovi Content Copier

Nokia Ovi Content Copier 6.85.3010

Nokia Ovi Suite

Nokia Ovi System Utilities

Nokia Ovi System Utilities 6.85.3010

Nokia PC Suite

Nokia Software Updater

NVIDIA Drivers

NVIDIA PhysX v8.04.25

OpenAL

PC Connectivity Solution

Prince of Persia T2T

PunkBuster Services

Realtek High Definition Audio Driver

Skype™ 3.8

System Requirements Lab

The KMPlayer (remove only)

TrackerPro 1.0

Ultra Video Converter 4.1.1008

Ultra Video Joiner 5.2.0822

Ventrilo Client

WebFldrs XP

WebTrance3.0 (деинсталиране)

Winamp

WinASO Registry Optimizer 4.0

Windows Bulgarian Interface Pack

Windows Driver Package - Nokia Modem (06/12/2006 6.81.0.21)

Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)

Windows Imaging Component

Windows Media Format 11 runtime

Windows XP Service Pack 3

Xfire (remove only)

==== Event Viewer Messages From Past Week ========

16.11.2009 . 23:51:16, error: Service Control Manager [7034] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s).

16.11.2009 . 23:51:16, error: Service Control Manager [7034] - The PnkBstrB service terminated unexpectedly. It has done this 1 time(s).

16.11.2009 . 23:51:16, error: Service Control Manager [7034] - The PnkBstrA service terminated unexpectedly. It has done this 1 time(s).

16.11.2009 . 23:51:16, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).

16.11.2009 . 23:51:16, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).

==== End Of File ===========================

DDS (Ver_09-10-26.01) - NTFSx86

Run by Administrator at 1:19:37,28 on 17.11.2009 .

Internet Explorer: 6.0.2900.5512

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1535.1003 [GMT 2:00]

AV: avast! antivirus 4.8.1356 [VPS 091116-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.bg/

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

TB: {E0E899AB-F487-11D5-8D29-0050BA6940E3} - No File

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe

mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

mRun: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nokiao~1.lnk - c:\program files\nokia\ovi\suite\RunLauncher.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {60237576-b24c-4ba9-9740-c9f3ec9db557} - {EAADF17C-B6EA-4511-8549-A67CFD406EAF} - c:\progra~1\skycode\webtra~1\wt2ie.dll

IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

TCP: {E41804A5-FE00-4CAB-9961-9122584C9558} = 84.22.2.62 212.116.131.21

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\0dxjckpk.default\

FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://google.bg

FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=

FF - plugin: c:\program files\ace mega codecs pack\systems\realmedia\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\ace mega codecs pack\systems\realmedia\browser\plugins\nprpjplug.dll

============= SERVICES / DRIVERS ===============

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [2005-12-6 35328]

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-5-7 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-5-7 20560]

=============== Created Last 30 ================

2009-11-16 22:11:40 105088 ----a-w- c:\windows\system32\drivers\nvata.sys

2009-11-16 22:11:39 96512 -c--a-w- c:\windows\system32\dllcache\atapi.sys

2009-11-16 22:11:39 96512 ----a-w- c:\windows\system32\drivers\atapi.sys

2009-11-16 22:09:06 0 d-----w- C:\ComboFix

2009-11-16 22:00:21 187776 ----a-w- c:\windows\system32\drivers\ACPI_2.sys

2009-11-16 21:51:18 98816 ----a-w- c:\windows\sed.exe

2009-11-16 21:51:18 77312 ----a-w- c:\windows\MBR.exe

2009-11-16 21:51:18 260608 ----a-w- c:\windows\PEV.exe

2009-11-16 21:51:18 161792 ----a-w- c:\windows\SWREG.exe

2009-11-16 11:06:05 90112 ----a-w- c:\windows\system32\43.scr

2009-11-15 11:14:11 0 d-----w- c:\program files\4 Elements

2009-11-06 10:52:24 2560 ----a-w- c:\windows\_MSRSTRT.EXE

2009-11-06 02:14:42 41872 ----a-w- c:\windows\system32\xfcodec.dll

2009-11-05 20:34:58 377984 ------w- c:\windows\system32\ati2dvaa.dll

2009-11-05 20:32:30 0 d-----w- c:\windows\ServicePackFiles

2009-11-05 20:32:07 294912 -c----w- c:\windows\system32\dllcache\dlimport.exe

2009-11-05 20:28:50 19569 ----a-w- c:\windows\003228_.tmp

2009-11-04 13:14:00 0 d-----w- c:\windows\4 Elements

2009-11-04 10:45:23 0 d-----w- C:\winsockxpfix

2009-11-01 11:08:42 0 d-----w- C:\LinhaDefensiva

2009-11-01 10:22:36 0 d-----w- c:\windows\system32\SoftwareDistribution

2009-11-01 00:55:25 0 d-----w- c:\docume~1\admini~1\applic~1\Malwarebytes

2009-11-01 00:55:18 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-11-01 00:55:16 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-11-01 00:55:16 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-11-01 00:55:16 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

==================== Find3M ====================

2009-11-16 19:24:08 215104 ----a-w- c:\windows\system32\PnkBstrB.exe

2009-11-16 19:01:52 138576 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2009-11-15 21:39:55 75064 ----a-w- c:\windows\system32\PnkBstrA.exe

2009-09-04 15:44:40 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll

2009-09-04 15:44:40 515416 ----a-w- c:\windows\system32\XAudio2_5.dll

2009-09-04 15:44:40 238936 ----a-w- c:\windows\system32\xactengine3_5.dll

2009-09-04 15:29:34 453456 ----a-w- c:\windows\system32\d3dx10_42.dll

2009-09-04 15:29:34 235344 ----a-w- c:\windows\system32\d3dx11_42.dll

2009-09-04 15:29:32 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll

2009-09-04 15:29:32 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll

2009-09-04 15:29:30 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

============= FINISH: 1:20:02,20 ===============

16 ноември 200916 г.

СТЪПКА 1

Изтеглете HijackThis оттук => http://www.hijackthis.de/downloads/HJTInstall.exe

Стартирайте го и изберете "Do a system scan only"

Маркирайте следните обекти:

O3 - Toolbar: {E0E899AB-F487-11D5-8D29-0050BA6940E3} - No File

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

Натиснете Fix Checked.

Затворете програмата.

СТЪПКА 2

Изтеглете OTM.exe и я запазете не десктопа.

Стартирайте я и copy/paste под колонката "Paste instructions for items to be Moved" въведете това:

:Processes

explorer.exe

:files

C:\ComboFix

c:\windows\sed.exe

c:\windows\MBR.exe

c:\windows\PEV.exe

c:\windows\SWREG.exe

c:\windows\system32\43.scr

c:\windows\003228_.tmp

C:\winsockxpfix

C:\LinhaDefensiva

:Commands

[purity]

[emptytemp]

[start explorer]

[Reboot]

Натиснете бутона MoveIt!

Ще се създаде лог файл в зелената колонка. Копирай го в следващия си пост.

16 ноември 200916 г.

Автор

All processes killed

========== PROCESSES ==========

No active process named explorer.exe was found!

========== FILES ==========

C:\ComboFix\N_ folder moved successfully.

C:\ComboFix folder moved successfully.

c:\windows\sed.exe moved successfully.

c:\windows\MBR.exe moved successfully.

c:\windows\PEV.exe moved successfully.

c:\windows\SWREG.exe moved successfully.

c:\windows\system32\43.scr moved successfully.

c:\windows\003228_.tmp moved successfully.

C:\winsockxpfix folder moved successfully.

C:\LinhaDefensiva\rotinas\remocao folder moved successfully.

C:\LinhaDefensiva\rotinas folder moved successfully.

C:\LinhaDefensiva\relatorios folder moved successfully.

C:\LinhaDefensiva\reflist folder moved successfully.

C:\LinhaDefensiva\QUA\Pastas folder moved successfully.

C:\LinhaDefensiva\QUA\Arquivos folder moved successfully.

C:\LinhaDefensiva\QUA folder moved successfully.

C:\LinhaDefensiva\lang\vb folder moved successfully.

C:\LinhaDefensiva\lang\init folder moved successfully.

C:\LinhaDefensiva\lang\bat folder moved successfully.

C:\LinhaDefensiva\lang folder moved successfully.

C:\LinhaDefensiva\func folder moved successfully.

C:\LinhaDefensiva\exec folder moved successfully.

C:\LinhaDefensiva\credits folder moved successfully.

C:\LinhaDefensiva folder moved successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 13005 bytes

->Temporary Internet Files folder emptied: 1996882 bytes

->FireFox cache emptied: 75988468 bytes

->Google Chrome cache emptied: 8641534 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 32902 bytes

16 ноември 200916 г.

Изтегли OTL.exe и го запази на десктопа.

Стартирай го с двукратен клик на мишката.

Под "Custom Scan" въведи следната информация:

netsvcs

%SYSTEMDRIVE%\*.exe

%SYSTEMDRIVE%\atapi.sys /s /md5

%SYSTEMDRIVE%\iaStor.sys /s /md5

Натисни Quick Scan. (друго не променяй).

Kато приключи проверката публикувай лог файла - OTL.txt (другия Extras.txt не ни трябва).

16 ноември 200916 г.

Автор

OTL logfile created on: 17.11.2009 . 01:56:10 - Run 1

OTL by OldTimer - Version 3.1.5.0 Folder = C:\Documents and Settings\Administrator\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy '.'

1,50 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 66,77% Memory free

3,35 Gb Paging File | 2,93 Gb Available in Paging File | 87,41% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 14,65 Gb Total Space | 0,73 Gb Free Space | 4,96% Space Free | Partition Type: NTFS

Drive D: | 59,87 Gb Total Space | 0,19 Gb Free Space | 0,32% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: RISTO

Current User Name: Administrator

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 14 Days

Output = Standard

Quick Scan

========== Processes (SafeList) ==========

PRC - [2009.11.17 01:55:13 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe

PRC - [2009.11.16 21:24:08 | 00,215,104 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe

PRC - [2009.11.15 23:39:55 | 00,075,064 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe

PRC - [2009.10.30 01:53:10 | 00,307,704 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2009.09.15 13:56:48 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe

PRC - [2009.09.15 13:56:43 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe

PRC - [2009.09.15 13:56:28 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

PRC - [2009.09.15 13:54:13 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

PRC - [2009.09.15 13:49:40 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

PRC - [2009.04.10 19:30:40 | 01,435,488 | ---- | M] (Nullsoft) -- C:\Program Files\Winamp\winamp.exe

PRC - [2008.05.30 14:54:16 | 00,076,744 | R--- | M] (Skype Technologies) -- C:\Program Files\Skype\Plugin Manager\skypePM.exe

PRC - [2008.05.30 14:54:14 | 21,718,312 | R--- | M] (Skype Technologies S.A.) -- C:\Program Files\Skype\Phone\Skype.exe

PRC - [2008.04.14 05:42:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2006.10.31 14:35:00 | 00,155,715 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe

17 ноември 200916 г.

Това определено не е целия лог файл

17 ноември 200916 г.

Автор

Съжелявам ето го целия.