Проблем със скайп вирус [РЕШЕН]

15 ноември 200916 г.

Системата е сериозно инфектирана !

Моля изпратете следните 3 файла за анализ на адрес => VIRUSTOTAL и публикувайте резултатите.

c:\windows\system32\wmispacs.exe

c:\windows\system32\drivers\wvgrhrnt.sys

c:\windows\system32\drivers\debug32.sys

Надявам се имате инсталационен диск на Windows, защото трябва да поправим MBR таблицата и да възстановим 3 моднати от вируса файла...

15 ноември 200916 г.

Автор

Диск на Windows нямам ,защото давам на по-рабиращи от мен да ми го слагат ,а сега ще пратя файловете и ще пиша след малко.

Като се опитам да upload първият файл avast се активира и го засича като malware цъкам да не предприема действие и като натисна да качи файла ,казва ,че не е качило нищо ??

Така е и с другите 2 файла ,изписва следното : 0 bytes size received / Se ha recibido un archivo vacio

Редактирано 15 ноември 200916 г. от prandzhev (преглед на промените)

15 ноември 200916 г.

' date='15 ноември 2009 - 20:14 ' timestamp='1258308842' post='1559526']
Системата е сериозно инфектирана !

Моля изпратете следните 3 файла за анализ на адрес => VIRUSTOTAL и публикувайте резултатите.

c:\windows\system32\wmispacs.exe
c:\windows\system32\drivers\wvgrhrnt.sys
c:\windows\system32\drivers\debug32.sys

Надявам се имате инсталационен диск на Windows, защото трябва да поправим MBR таблицата и да възстановим 3 моднати от вируса файла...

Извинявай за глупавия въпрос, но как разбра, че точно тия 3 файла са заразени!

15 ноември 200916 г.

Автор

Не знам как е разбрал ,но и аваст засича първия и третия като malware за втория нищо.Но не мога да ги кача в VIRUSTOTAL .... ->0 bytes size received / Se ha recibido un archivo vacio

15 ноември 200916 г.

Извинявай за глупавия въпрос, но как разбра, че точно тия 3 файла са заразени!

С години практика и с много сериозен интерес. Тук сме да помагаме, не да обучаваме.

П.П.: prandzhev, човекът е на работа дай му малко време за реакция. Гарантирам успех!

2

15 ноември 200916 г.

Автор

А иначе като не става това ,което каза B-boy[sTYLE] какво правя ?

15 ноември 200916 г.

А иначе като не става това ,което каза B-boy[sTYLE] какво правя ?

Пробвай да ги качиш тука http://www.novirusthanks.com/

1

15 ноември 200916 г.

Автор

Пробвай да ги качиш тука http://www.novirusthanks.com/

По-точно къде тук.

15 ноември 200916 г.

Моля, отворете Notepad.exe и с copy/paste въведете следната информация:

KILLALL::

Driver::

wvgrhrnt

debug32

File::

c:\windows\system32\wmispacs.exe

c:\windows\system32\drivers\wvgrhrnt.sys

c:\windows\system32\drivers\debug32.sys

Folder::

c:\program files\Trend Micro

SRPeek::

c:\windows\system32\mshtml.dll

c:\windows\system32\dllcache\mshtml.dll

c:\windows\system32\wininet.dll

c:\windows\system32\dllcache\wininet.dll

c:\windows\explorer.exe

c:\windows\system32\dllcache\explorer.exe

MIA::

c:\windows\system32\mshtml.dll

c:\windows\system32\dllcache\mshtml.dll

c:\windows\system32\wininet.dll

c:\windows\system32\dllcache\wininet.dll

c:\windows\explorer.exe

c:\windows\system32\dllcache\explorer.exe

RESTORE::

c:\windows\system32\mshtml.dll

c:\windows\system32\dllcache\mshtml.dll

c:\windows\system32\wininet.dll

c:\windows\system32\dllcache\wininet.dll

c:\windows\explorer.exe

c:\windows\system32\dllcache\explorer.exe

Registry::

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"ShowDeskFix"=-

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoSecurityTab"=-

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wvgrhrnt.sys]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\system32\\wmispacs.exe"=-

Запазете файла с име CFScript (както е на картинката) и го провлачете и го пуснете в Combofix.

Това ще стартира Combofix още веднъж. Моля не местете мишката, не натискайте клавиши от клавиатурата по време на проверката.

След рестарта, ще се създаде нов лог файл. Публикувайте го в следващия си пост.

15 ноември 200916 г.

Автор

ComboFix 09-11-16.01 - Dron445 11.2009 г. 20:56..2 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.2046.1129 [GMT 2:00]

Running from: c:\documents and settings\Dron445\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Dron445\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

"c:\windows\system32\drivers\debug32.sys"

"c:\windows\system32\drivers\wvgrhrnt.sys"

"c:\windows\system32\wmispacs.exe"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\Trend Micro

c:\program files\Trend Micro\HijackThis\HijackThis.exe

c:\program files\Trend Micro\HijackThis\hijackthis.log

c:\windows\system32\drivers\debug32.sys

c:\windows\system32\drivers\wvgrhrnt.sys

c:\windows\system32\wmispacs.exe

c:\windows\explorer.exe . . . is infected!!

c:\windows\system32\dllcache\mshtml.dll . . . is infected!!

c:\windows\system32\dllcache\wininet.dll . . . is infected!!

c:\windows\system32\dllcache\mshtml.dll . . . is missing!!

c:\windows\system32\dllcache\wininet.dll . . . is missing!!

c:\windows\system32\dllcache\explorer.exe . . . is missing!!

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_DEBUG32

-------\Legacy_WVGRHRNT

-------\Service_debug32

-------\Service_Passthru

-------\Service_wvgrhrnt

((((((((((((((((((((((((( Files Created from 2009-10-15 to 2009-11-15 )))))))))))))))))))))))))))))))

.

2009-11-15 17:57 . 2009-11-15 18:00 -------- d-----w- c:\windows\system32\CatRoot_bak

2009-11-15 16:13 . 2009-09-15 11:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2009-11-15 16:13 . 2009-09-15 11:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2009-11-15 16:13 . 2009-09-15 11:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2009-11-15 16:13 . 2009-09-15 11:56 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys

2009-11-15 16:13 . 2009-09-15 11:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2009-11-15 16:13 . 2009-09-15 11:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys

2009-11-15 16:13 . 2009-09-15 11:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2009-11-15 16:13 . 2009-09-15 11:53 97480 ----a-w- c:\windows\system32\AvastSS.scr

2009-11-15 16:12 . 2009-09-15 11:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe

2009-11-15 16:12 . 2009-11-15 16:12 -------- d-----w- c:\program files\Alwil Software

2009-11-15 11:18 . 2009-11-15 11:18 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2009-11-14 13:06 . 2009-11-14 13:06 -------- d-----w- c:\documents and settings\Administrator\Application Data\TuneUp Software

2009-11-14 13:06 . 2009-11-14 13:06 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla

2009-11-14 11:01 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-11-14 11:01 . 2009-11-14 11:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-11-14 11:01 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-11-13 23:25 . 2009-11-15 19:01 -------- d-----w- c:\documents and settings\Dron445\Application Data\Skype

2009-11-13 23:25 . 2009-11-13 23:25 -------- d-----w- c:\program files\Common Files\Skype

2009-11-09 09:54 . 2009-11-09 09:54 -------- d-----w- c:\program files\Common Files\PCSuite

2009-11-09 09:54 . 2009-11-09 09:54 -------- d-----w- c:\program files\Common Files\Nokia

2009-11-09 09:54 . 2009-11-09 09:54 -------- d-----w- c:\program files\PC Connectivity Solution

2009-11-09 09:53 . 2009-02-09 06:37 7808 ----a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys

2009-11-09 09:53 . 2009-02-09 06:37 7808 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys

2009-11-09 09:53 . 2009-02-09 06:37 22016 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys

2009-11-09 09:53 . 2009-02-09 06:37 659968 ----a-w- c:\windows\system32\nmwcdcocls.dll

2009-11-09 09:53 . 2009-02-09 06:37 17664 ----a-w- c:\windows\system32\drivers\ccdcmb.sys

2009-11-09 09:53 . 2009-02-09 06:32 1112288 ----a-w- c:\windows\system32\wdfcoinstaller01007.dll

2009-11-09 09:53 . 2009-11-09 09:52 33773208 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_eng.exe

2009-11-09 09:52 . 2009-11-09 09:52 95232 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe

2009-11-09 09:52 . 2009-11-09 09:52 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe

2009-11-09 09:52 . 2009-11-09 09:52 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe

2009-11-09 09:52 . 2009-11-09 09:52 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe

2009-11-08 10:37 . 2009-11-08 10:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment

2009-11-07 16:07 . 2009-11-07 16:07 -------- d-----w- c:\documents and settings\Dron445\Patches

2009-11-02 13:29 . 2009-11-12 13:58 -------- d-----w- c:\program files\GRETECH

2009-10-30 12:23 . 2009-10-30 12:23 -------- d-----w- C:\ProgramData

2009-10-30 12:23 . 2009-10-30 12:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts

2009-10-29 16:07 . 2009-10-29 16:07 -------- d-----w- c:\program files\Electronic Arts

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-15 16:34 . 2007-12-25 10:43 -------- d-----w- c:\documents and settings\Dron445\Application Data\skypePM

2009-11-15 15:02 . 2007-12-20 11:07 15600 ----a-w- c:\windows\gdrv.sys

2009-11-14 14:15 . 2007-12-20 13:24 -------- d-----w- c:\documents and settings\Dron445\Application Data\uTorrent

2009-11-13 23:25 . 2007-12-20 13:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2009-11-13 23:25 . 2009-06-29 19:05 -------- d-----r- c:\program files\Skype

2009-11-13 23:03 . 2009-06-10 18:46 -------- d-----w- c:\program files\Winamp Toolbar

2009-11-12 13:57 . 2009-10-01 20:05 -------- d-----w- c:\program files\YouTube Downloader

2009-11-12 13:57 . 2009-10-01 20:03 -------- d-----w- c:\program files\Xvid

2009-11-09 22:36 . 2009-11-09 22:36 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf

2009-11-09 22:36 . 2009-11-09 22:36 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf

2009-11-09 19:53 . 2009-07-27 11:55 -------- d-----w- c:\documents and settings\Dron445\Application Data\Nokia

2009-11-09 10:18 . 2008-05-06 08:24 -------- d-----w- c:\program files\Common Files\Teleca Shared

2009-11-09 09:54 . 2009-07-27 11:54 -------- d-----w- c:\program files\Nokia

2009-11-09 09:54 . 2009-07-27 11:54 -------- d-----w- c:\program files\DIFX

2009-11-09 09:52 . 2009-07-27 11:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations

2009-11-08 10:37 . 2007-12-25 14:16 -------- d-----w- c:\program files\FlashGet

2009-11-08 09:53 . 2008-01-26 19:57 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment

2009-11-04 20:09 . 2007-12-20 11:41 -------- d-----w- c:\documents and settings\Dron445\Application Data\BSplayer PRO

2009-10-26 21:01 . 2008-10-19 14:40 -------- d-----w- c:\documents and settings\All Users\Application Data\KONAMI

2009-10-18 17:51 . 2009-07-27 11:55 -------- d-----w- c:\documents and settings\Dron445\Application Data\PC Suite

2009-10-15 16:17 . 2007-12-20 11:43 444952 ----a-w- c:\windows\system32\wrap_oal.dll

2009-10-15 16:17 . 2007-12-20 11:43 109080 ----a-w- c:\windows\system32\OpenAL32.dll

2009-10-13 19:04 . 2007-12-20 11:10 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-09-21 18:54 . 2007-12-20 13:22 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-09-21 18:53 . 2008-03-23 20:49 -------- d-----w- c:\program files\AGEIA Technologies

2009-09-09 14:46 . 2009-09-22 12:12 52224 ----a-w- c:\documents and settings\Dron445\Application Data\Mozilla\Firefox\Profiles\jetnxlm2.default\extensions\{127d5117-dcc8-4856-8288-9baa89e57c21}\components\FFExternalAlert.dll

2009-09-09 14:46 . 2009-09-22 12:12 114688 ----a-w- c:\documents and settings\Dron445\Application Data\Mozilla\Firefox\Profiles\jetnxlm2.default\extensions\{127d5117-dcc8-4856-8288-9baa89e57c21}\components\npmozax.dll

2009-08-18 20:03 . 2008-05-24 13:28 142265 ----a-w- c:\windows\War3Unin.dat

2008-10-21 19:16 . 2007-12-20 12:59 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys

.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

------- Sigcheck -------

[-] 2009-08-29 . EDAD55105DDD067AE3906011F297267C . 3600384 . . [7.00.6000.21115] . . c:\windows\SoftwareDistribution\Download\37f6297b42610206c3fdeaf1ae71345e\SP3QFE\mshtml.dll

[-] 2009-08-29 . E52A845DCE011D56B12B8F3F4606F956 . 3598336 . . [7.00.6000.16915] . . c:\windows\SoftwareDistribution\Download\37f6297b42610206c3fdeaf1ae71345e\SP3GDR\mshtml.dll

[-] 2007-07-22 . 5B278DB31D38AF8A5038EAB1BA162086 . 3856896 . . [7.00.6000.20591] . . c:\windows\system32\mshtml.dll

[-] 2009-08-29 . DB111200015F08DDDB8857E11C6A80E3 . 832512 . . [7.00.6000.16915] . . c:\windows\SoftwareDistribution\Download\37f6297b42610206c3fdeaf1ae71345e\SP3GDR\wininet.dll

[-] 2009-08-29 . A5885AF9BFBD942B828E6020AD326517 . 840704 . . [7.00.6000.21115] . . c:\windows\SoftwareDistribution\Download\37f6297b42610206c3fdeaf1ae71345e\SP3QFE\wininet.dll

[-] 2007-07-22 . 9B51CF581E9EA4752E747C3B950DD9C8 . 814592 . . [7.00.6000.20583] . . c:\windows\system32\wininet.dll

[-] 2007-07-22 . 1D23EB782291CB7D3ADB33C26EE9583B . 975360 . . [6.00.2900.3111] . . c:\windows\explorer.exe

.

((((((((((((((((((((((((((((( SnapShot@2009-11-14_15.02.56 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-11-15 19:00 . 2009-11-15 19:00 16384 c:\windows\temp\Perflib_Perfdata_6fc.dat

+ 2009-11-15 16:33 . 2009-11-15 16:33 16384 c:\windows\temp\Perflib_Perfdata_6b0.dat

+ 2009-07-08 02:05 . 2009-07-08 02:05 73728 c:\windows\system32\RtNicProp32.dll

+ 2009-11-15 15:39 . 2007-03-01 08:05 90496 c:\windows\system32\ReinstallBackups\0016\DriverFiles\Rtenicxp.sys

+ 2007-07-22 11:15 . 2009-08-06 17:23 215920 c:\windows\system32\muweb.dll

+ 2007-07-22 11:15 . 2009-08-06 17:23 274288 c:\windows\system32\mucltui.dll

+ 2007-12-20 11:11 . 2009-07-28 06:55 143360 c:\windows\system32\drivers\Rtenicxp.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2007-07-22 1694208]

"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-09-03 3342336]

"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" [2007-12-21 4382720]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]

"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-04-10 37888]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-04-12 16132608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2007-12-20 95232]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"RichVideo"=2 (0x2)

"ose"=3 (0x3)

"idsvc"=3 (0x3)

"Adobe LM Service"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"Comrade.exe"=c:\program files\GameSpy\Comrade\Comrade.exe

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe"

"Device Detector"=DevDetect.exe -autorun

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"36X Raid Configurer"=c:\windows\system32\JMRaidSetup.exe boot

"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe"

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\utorrent.exe"=

"e:\\Games\\area51\\Binaries\\BlackSite.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"f:\\Games\\Crysis\\Bin32\\Crysis.exe"=

"f:\\Games\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=

"f:\\Games\\Warcraft III\\War3.exe"=

"f:\\Games\\Colin McRae DIRT\\DiRT.exe"=

"f:\\Games\\Assassin's CREED\\AssassinsCreed_Dx9.exe"=

"f:\\Games\\Assassin's CREED\\AssassinsCreed_Dx10.exe"=

"f:\\Games\\Assassin's CREED\\AssassinsCreed_Launcher.exe"=

"f:\\Games\\Cs 1.6\\hl.exe"=

"c:\\Program Files\\FlashGet\\FlashGet.exe"=

"f:\\Games\\FIFA 2009\\FIFA09.exe"=

"f:\\Games\\Cs 1.6\\hlds.exe"=

"c:\\Documents and Settings\\Dron445\\Desktop\\GaMeZzZ\\BELOT.EXE"=

"c:\\Program Files\\Valve\\04196913627172813654.exe"=

"f:\\Games\\cs 1.6\\52737450093923891757.exe"=

"f:\\Games\\cs 1.6\\85579586784859229411.exe"=

"f:\\Games\\cs 1.6\\02166227819973012660.exe"=

"f:\\Games\\cs 1.6\\90101726394596593518.exe"=

"f:\\Games\\cs 1.6\\09042378460279316935.exe"=

"f:\\Games\\cs 1.6\\29842430326340412015.exe"=

"f:\\Games\\cs 1.6\\21638571832561326646.exe"=

"f:\\Games\\cs 1.6\\69549157885926792444.exe"=

"f:\\Games\\cs 1.6\\49168354399811303324.exe"=

"c:\\Program Files\\Garena\\Garena.exe"=

"f:\\Games\\Street Fighter 4\\StreetFighterIV.exe"=

"c:\\Program Files\\Valve\\43962100680366902911.exe"=

"f:\\Games\\PES 2010\\pes2010.exe"=

"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=

"e:\\Games\\World of Warcraft\\World of Warcraft\\WoW-3.2.0-enUS-downloader.exe"=

"e:\\Games\\World of Warcraft\\World of Warcraft\\Launcher.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [15.11.2009 і. 18:13 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [15.11.2009 і. 18:13 20560]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [03.9.2009 і. 22:19 133104]

S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\Dron445\LOCALS~1\Temp\SLN24.tmp --> c:\docume~1\Dron445\LOCALS~1\Temp\SLN24.tmp [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Contents of the 'Scheduled Tasks' folder

2009-11-13 c:\windows\Tasks\1-Click Maintenance.job

- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 14:53]

2009-11-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-03 20:19]

2009-11-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-03 20:19]

2009-11-15 c:\windows\Tasks\User_Feed_Synchronization-{132E3A99-374B-420F-B7FE-679B47B2FD89}.job

- c:\windows\system32\msfeedssync.exe [2007-12-20 19:18]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.bg/

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

mStart Page = hxxp://www.yahoo.com

IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm

IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm

IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Dron445\Application Data\Mozilla\Firefox\Profiles\jetnxlm2.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2307307&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Liverpoolfctv Customized Web Search

FF - prefs.js: browser.startup.homepage - yahoo.com

FF - component: c:\documents and settings\Dron445\Application Data\Mozilla\Firefox\Profiles\jetnxlm2.default\extensions\{127d5117-dcc8-4856-8288-9baa89e57c21}\components\FFExternalAlert.dll

FF - plugin: c:\downloads\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

.

- - - - ORPHANS REMOVED - - - -

AddRemove-HijackThis - c:\program files\Trend Micro\HijackThis\HijackThis.exe

**************************************************************************

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]

"ImagePath"="\??\c:\docume~1\Dron445\LOCALS~1\Temp\SLN24.tmp"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(684)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3640)

c:\windows\system32\ntshrui.dll

c:\windows\system32\msi.dll

c:\windows\system32\wpdshserviceobj.dll

c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll

c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL

c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr

c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

c:\windows\system32\NETSHELL.dll

c:\windows\system32\credui.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Alwil Software\Avast4\aswUpdSv.exe

c:\program files\Alwil Software\Avast4\ashServ.exe

c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

c:\windows\system32\PnkBstrA.exe

c:\windows\system32\PnkBstrB.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

c:\program files\PC Connectivity Solution\ServiceLayer.exe

c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe

c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe

c:\program files\Skype\Plugin Manager\skypePM.exe

.

**************************************************************************

.

Completion time: 2009-11-15 21:04 - machine was rebooted

ComboFix-quarantined-files.txt 2009-11-15 19:03

ComboFix2.txt 2009-11-14 15:06

Pre-Run: 48 181 248 bytes free

Post-Run: 73 482 240 bytes free

- - End Of File - - F877C4B06DB0CA705BA138CED1D4A129

15 ноември 200916 г.

Не ми харесва това, че нямате инсталационен диск.

Нека да пробваме да възстановим липсващите и повредените файлове с този трик.

Изтеглете и инсталирайте Service Pack 3 за Windows.

След това очаквам от вас нов лог от Combofix.

15 ноември 200916 г.

Автор

Връзката е много лоша,свалям едва с 80 кб/с така ,че сигурно ще ви дам лог утре ,ако не се увеличи скоростта.

15 ноември 200916 г.

Връзката е много лоша,свалям едва с 80 кб/с така ,че сигурно ще ви дам лог утре ,ако не се увеличи скоростта.

Няма проблеми. Аз ще проверявам темата честичко. Но е важна стъпка и трябва да го направите.

Ако не се получи, ще трябва да се сдобиете с инсталационен диск за да поправим поразиите.

Засега сме на прав път.

Поздрави :rolleyes:

15 ноември 200916 г.

Автор

@ B-boy[sTYLE] да попитам като инсталирам сървис пак 3 след това просто стартирам Combofix.exe или правя номера с текст документа ? Ще изчакам отговор и тогава ще започна с инасталацията на Service Pack 3 :super:

15 ноември 200916 г.

@ B-boy[sTYLE] да попитам като инсталирам сървис пак 3 след това просто стартирам Combofix.exe или правя номера с текст документа ? Ще изчакам отговор и тогава ще започна с инасталацията на Service Pack 3

След като инсталирате SP3, просто стартирайте с двукратен клик на мишката Combofix.exe (без никакви скриптове този път) и изчакайте проверката да завърши.

След рестарта публикувайте лог файла от тази проверка. :super:

15 ноември 200916 г.

Автор

С всички тези работи около вируса не знам как C:\\ ми се напълни цялото толкова бързо. Имам 20гб общо,1-2 свободни бяха ,а сега са само 150 и след като намера как да освободя още 300 за Service Pack 3 ще продължа.

15 ноември 200916 г.

С всички тези работи около вируса не знам как C:\\ ми се напълни цялото толкова бързо. Имам 20гб общо,1-2 свободни бяха ,а сега са само 150 и след като намера как да освободя още 300 за Service Pack 3 ще продължа.

Опитайте с CCleaner:

http://www.kaldata.com/comments.php?id=50934&catid=1&highlight=ccleaner

15 ноември 200916 г.

Автор

' date='15 ноември 2009 - 23:44 ' timestamp='1258321442' post='1559718']
Опитайте с CCleaner:

http://www.kaldata.com/comments.php?id=50934&catid=1&highlight=ccleaner

Мм изчистих едва 5мгб с нея някакви други идеи или по отделно да чиста ненужни програми? Пробвах и с Tune up utilities:) Благодаря предварително ,лека нощ утре ще довърша нещата и ще постна лог-а. :rolleyes:

15 ноември 200916 г.

Колко е обема на целия хардиск на машината ? Ако е разделен на няколко дяла, просто преместете (с CUT) инсталационния файл на SP3 на някой друг дял и опитайте отново.

Деинсталирайте програмите които не използвате. Можете да опитате и тази програма. Просто я инсталирайте и стартирайте. Със сигурност ще изтрие доста боклуци:

http://majorgeeks.com/DustBuster_d1182.html

За да я изтеглите просто посочете някой от линковете под "DOWNLOADS".

До скоро !

16 ноември 200916 г.

Автор

Да попитам за едни ъпдейти ,които иска да направи комютъра дали да ги допускам или не ?

Не съм инсталирал Service PAck 3 преди това.

Редактирано 16 ноември 200916 г. от prandzhev (преглед на промените)

16 ноември 200916 г.

Да попитам за едни ъпдейти ,които иска да направи комютъра дали да ги допускам или не ?

Не съм инсталирал Service PAck 3 преди това.

Това не го инсталирайте...ако windows-a ви е пиратски !!!

Инсталирайте само това, което съм ви дал !

Вече има ли място за него ?

PS: Заминавам на работа и чат-пат ще пиша оттам. Имайте го напредвид. Не съм ви забравил просто трябва да се бачка. :mad:

Редактирано 16 ноември 200916 г. от B-boy[StyLe]
Уточнение. :) (преглед на промените)

16 ноември 200916 г.

Автор

Инсталирах СП3 и ето лог-а от Комбофикс.Качвам файла ,защотое прекалено дълъг и не ми дава да го пост-на.

16 ноември 200916 г.

Много добре.

Моля, отворете Notepad.exe и с copy/paste въведете следната информация:

KILLALL::

FCopy::

c:\windows\ServicePackFiles\i386\mshtml.dll | c:\windows\system32\mshtml.dll

c:\windows\ServicePackFiles\i386\mshtml.dll | c:\windows\SoftwareDistribution\Download\37f6297b42610206c3fdeaf1ae71345e\SP3QFE\mshtml.dll

c:\windows\ServicePackFiles\i386\mshtml.dll | c:\windows\SoftwareDistribution\Download\37f6297b42610206c3fdeaf1ae71345e\SP3GDR\mshtml.dll

c:\windows\ServicePackFiles\i386\wininet.dll | c:\windows\system32\wininet.dll

c:\windows\ServicePackFiles\i386\wininet.dll | c:\windows\SoftwareDistribution\Download\37f6297b42610206c3fdeaf1ae71345e\SP3GDR\wininet.dll

c:\windows\ServicePackFiles\i386\wininet.dll | c:\windows\SoftwareDistribution\Download\37f6297b42610206c3fdeaf1ae71345e\SP3QFE\wininet.dll

Запазете файла с име CFScript (както е на картинката) и го провлачете и го пуснете в Combofix.

Това ще стартира Combofix още веднъж. Моля не местете мишката, не натискайте клавиши от клавиатурата по време на проверката.

След рестарта, ще се създаде нов лог файл. Публикувайте го в следващия си пост.

16 ноември 200916 г.

Автор

' date='16 ноември 2009 - 17:41 ' timestamp='1258386091' post='1560213']
Много добре.

Моля, отворете Notepad.exe и с copy/paste въведете следната информация:

Запазете файла с име CFScript (както е на картинката) и го провлачете и го пуснете в Combofix.

Това ще стартира Combofix още веднъж. Моля не местете мишката, не натискайте клавиши от клавиатурата по време на проверката.

След рестарта, ще се създаде нов лог файл. Публикувайте го в следващия си пост.

Log-a ! :

ComboFix 09-11-16.05 - Dron445 11.2009 г. 17:47..2 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2046.1296 [GMT 2:00]

Running from: c:\documents and settings\Dron445\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Dron445\Desktop\CFScript.txt

AV: avast! antivirus 4.8.1356 [VPS 091116-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

--------------- FCopy ---------------

c:\windows\ServicePackFiles\i386\mshtml.dll --> c:\windows\system32\mshtml.dll

c:\windows\ServicePackFiles\i386\mshtml.dll --> c:\windows\SoftwareDistribution\Download\37f6297b42610206c3fdeaf1ae71345e\SP3QFE\mshtml.dll

c:\windows\ServicePackFiles\i386\mshtml.dll --> c:\windows\SoftwareDistribution\Download\37f6297b42610206c3fdeaf1ae71345e\SP3GDR\mshtml.dll

c:\windows\ServicePackFiles\i386\wininet.dll --> c:\windows\system32\wininet.dll

c:\windows\ServicePackFiles\i386\wininet.dll --> c:\windows\SoftwareDistribution\Download\37f6297b42610206c3fdeaf1ae71345e\SP3GDR\wininet.dll

c:\windows\ServicePackFiles\i386\wininet.dll --> c:\windows\SoftwareDistribution\Download\37f6297b42610206c3fdeaf1ae71345e\SP3QFE\wininet.dll

.

((((((((((((((((((((((((( Files Created from 2009-10-16 to 2009-11-16 )))))))))))))))))))))))))))))))

.

2009-11-16 15:47 . 2007-02-16 02:27 44928 ----a-w- c:\windows\system32\drivers\jraid.sys

2009-11-16 15:47 . 2008-04-13 22:10 96512 -c--a-w- c:\windows\system32\dllcache\atapi.sys

2009-11-16 15:47 . 2008-04-13 22:10 96512 ----a-w- c:\windows\system32\drivers\atapi.sys

2009-11-16 13:55 . 2004-08-03 23:56 221184 ----a-w- c:\windows\system32\wmpns.dll

2009-11-16 13:38 . 2008-04-14 03:41 4255 ------w- c:\windows\system32\drivers\adv01nt5.dll

2009-11-16 13:00 . 2009-11-16 13:00 -------- d-----w- c:\windows\system32\KB905474

2009-11-16 13:00 . 2009-03-10 20:26 1403264 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe

2009-11-16 13:00 . 2009-03-10 20:18 453512 ----a-w- c:\windows\system32\KB905474\wgasetup.exe

2009-11-16 12:57 . 2009-11-16 13:39 -------- d-----w- c:\windows\ServicePackFiles

2009-11-16 12:56 . 2009-11-16 12:56 -------- d-----w- c:\program files\MSXML 6.0

2009-11-15 21:55 . 2009-11-15 21:55 -------- d-----w- c:\program files\MSXML 4.0

2009-11-15 21:55 . 2009-11-16 13:01 -------- d--h--w- c:\windows\$hf_mig$

2009-11-15 17:31 . 2008-06-24 16:43 74240 -c----w- c:\windows\system32\dllcache\mscms.dll

2009-11-15 17:31 . 2009-06-25 08:25 56832 -c----w- c:\windows\system32\dllcache\secur32.dll

2009-11-15 17:31 . 2009-03-21 14:06 989696 -c----w- c:\windows\system32\dllcache\kernel32.dll

2009-11-15 17:31 . 2009-06-12 12:31 80896 -c----w- c:\windows\system32\dllcache\tlntsess.exe

2009-11-15 17:31 . 2009-06-12 12:31 76288 -c----w- c:\windows\system32\dllcache\telnet.exe

2009-11-15 17:31 . 2009-07-17 16:22 1435648 -c----w- c:\windows\system32\dllcache\query.dll

2009-11-15 17:30 . 2009-07-29 04:37 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll

2009-11-15 17:30 . 2009-07-29 04:37 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll

2009-11-15 17:25 . 2008-07-07 20:26 253952 -c----w- c:\windows\system32\dllcache\es.dll

2009-11-15 17:25 . 2009-06-10 06:14 132096 -c----w- c:\windows\system32\dllcache\wkssvc.dll

2009-11-15 17:25 . 2009-06-10 14:13 84992 -c----w- c:\windows\system32\dllcache\avifil32.dll

2009-11-15 17:19 . 2009-05-07 15:32 345600 -c----w- c:\windows\system32\dllcache\localspl.dll

2009-11-15 17:13 . 2009-07-17 19:01 58880 -c----w- c:\windows\system32\dllcache\atl.dll

2009-11-15 17:12 . 2008-08-14 10:04 138496 -c----w- c:\windows\system32\dllcache\afd.sys

2009-11-15 17:12 . 2008-06-20 17:46 245248 -c----w- c:\windows\system32\dllcache\mswsock.dll

2009-11-15 17:12 . 2008-06-20 17:46 147968 -c----w- c:\windows\system32\dllcache\dnsapi.dll

2009-11-15 17:12 . 2008-06-20 11:51 361600 -c----w- c:\windows\system32\dllcache\tcpip.sys

2009-11-15 17:12 . 2008-06-20 11:08 225856 -c----w- c:\windows\system32\dllcache\tcpip6.sys

2009-11-15 17:11 . 2009-04-15 14:51 585216 -c----w- c:\windows\system32\dllcache\rpcrt4.dll

2009-11-15 17:11 . 2008-12-16 12:30 354304 -c----w- c:\windows\system32\dllcache\winhttp.dll

2009-11-15 17:10 . 2008-10-23 12:36 286720 -c----w- c:\windows\system32\dllcache\gdi32.dll

2009-11-15 17:09 . 2009-06-25 08:25 54272 -c----w- c:\windows\system32\dllcache\wdigest.dll

2009-11-15 17:09 . 2009-06-25 08:25 301568 -c----w- c:\windows\system32\dllcache\kerberos.dll

2009-11-15 17:09 . 2009-06-25 08:25 147456 -c----w- c:\windows\system32\dllcache\schannel.dll

2009-11-15 17:09 . 2009-06-25 08:25 136192 -c----w- c:\windows\system32\dllcache\msv1_0.dll

2009-11-15 17:09 . 2009-06-24 11:18 92928 -c----w- c:\windows\system32\dllcache\ksecdd.sys

2009-11-15 17:08 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys

2009-11-15 17:08 . 2008-06-13 11:05 272128 ------w- c:\windows\system32\drivers\bthport.sys