Как се държи системата в момента?

Как се държи системата в момента?

ъпдейтнах пак malwarebytes, при сканирането откри разни нови троянци, бяха в system restore. иначе нета пак си спира през 2 мин... иначе като цяло компютъра ми е доста по-бърз от преди. Ти как мислиш, вирус ли е? Техниците ми казаха, че може да е от lan картата

Отворете Notepad и чрез комбинацията copy/paste поставете следния текст:

Killall::


Rootkit::

WWW


NetSvc::

txiur


Registry::

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"4126:TCP"=-

Запазете файла с името CFScript.txt и го поставете върху ComboFix.

След като, програмата приключи ще Ви изведе лог файла. Отново чрез комбинацията от Copy/Paste поставете информацията тук.

не става така, като слойа файла от notepad върху комбото то се стартира но нищо не прави. пише. че сканира, но не се появяват надолу другите работи...

Изтеглете OTL (от OldTimer) и го запазете на вашия десктоп.

Кликнете два пъти върху OTL.exe, за да стартирате програмата.

Сложете отметки преди следните неща:

• 
  
• Scan all users
  
• Lop check
  
• Purity check
  

Под секцията Extra Registry, изберете Use SafeList

Кликнете на Run Scan и изчакайте да завърши сканирането. (може да отнеме 10-15 минути)

Когато завърши, публикувайте следните два лог файла:

• OTL.txt (намира се на вашия десктоп)
  
• Extras.txt (ще Ви се отвори автоматично)
  

OTL logfile created on: 26.1.2010 г. 19:23:54 - Run 1

OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\Dessy\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.'

255,00 Mb Total Physical Memory | 21,00 Mb Available Physical Memory | 8,00% Memory free

618,00 Mb Paging File | 355,00 Mb Available in Paging File | 57,00% Paging File free

Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 14,65 Gb Total Space | 2,87 Gb Free Space | 19,59% Space Free | Partition Type: NTFS

Drive D: | 14,63 Gb Total Space | 1,04 Gb Free Space | 7,10% Space Free | Partition Type: FAT32

Drive E: | 8,98 Gb Total Space | 0,09 Gb Free Space | 1,05% Space Free | Partition Type: FAT32

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: HOME-45875AAC73

Current User Name: Dessy

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.01.26 19:21:53 | 00,548,352 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dessy\Desktop\OTL.exe

PRC - [2010.01.24 15:31:37 | 00,594,712 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVGLS\avgnsx.exe

PRC - [2010.01.24 15:31:28 | 01,950,488 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVGLS\avgtray.exe

PRC - [2010.01.24 15:31:22 | 00,298,776 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVGLS\avgwdsvc.exe

PRC - [2010.01.19 16:54:01 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2010.01.07 16:07:10 | 00,429,392 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\desekashe\mbamgui.exe

PRC - [2010.01.07 16:07:10 | 00,236,368 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\desekashe\mbamservice.exe

PRC - [2009.02.14 17:47:04 | 00,603,904 | ---- | M] (TuneUp Software) -- C:\WINDOWS\system32\TUProgSt.exe

PRC - [2006.05.03 18:43:46 | 00,413,696 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe

PRC - [2004.08.04 00:56:50 | 01,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2002.05.19 09:24:00 | 00,095,232 | ---- | M] () -- C:\Program Files\Datecs\FlexType 2K\FType2K.exe

========== Modules (SafeList) ==========

MOD - [2010.01.26 19:21:53 | 00,548,352 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dessy\Desktop\OTL.exe

MOD - [2004.08.04 00:57:02 | 01,050,624 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

MOD - [2002.04.23 00:17:06 | 00,045,056 | ---- | M] () -- C:\WINDOWS\system32\newdll.dll

========== Win32 Services (SafeList) ==========

SRV - [2010.01.24 15:31:22 | 00,298,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVGLS\avgwdsvc.exe -- (avg8wd)

SRV - [2010.01.07 16:07:10 | 00,236,368 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\desekashe\mbamservice.exe -- (MBAMService)

SRV - [2009.02.14 17:47:04 | 00,603,904 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\WINDOWS\system32\TUProgSt.exe -- (TuneUp.ProgramStatisticsSvc)

SRV - [2009.02.14 17:46:39 | 00,362,240 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\WINDOWS\system32\TuneUpDefragService.exe -- (TuneUp.Defrag)

SRV - [2008.11.12 16:44:18 | 00,027,904 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)

SRV - [2006.05.03 18:43:46 | 00,413,696 | ---- | M] (ATI Technologies Inc.) [Auto | Running] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller)

SRV - [2006.05.03 10:57:00 | 00,520,192 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart)

SRV - [2003.07.28 12:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

========== Driver Services (SafeList) ==========

DRV - [2010.01.24 15:32:04 | 00,253,576 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)

DRV - [2010.01.24 15:32:03 | 00,108,296 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)

DRV - [2010.01.07 16:07:04 | 00,019,160 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2008.12.16 14:47:00 | 00,013,976 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\videX32.sys -- (videX32)

DRV - [2008.12.03 13:32:06 | 01,519,424 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cmudax3.sys -- (cmuda3)

DRV - [2007.03.08 01:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\PxHelp20.sys -- (PxHelp20)

DRV - [2006.05.03 18:50:42 | 01,540,608 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2005.07.11 09:31:18 | 00,018,004 | R--- | M] (Silan Micro-Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\slnt.sys -- (slnt)

DRV - [2005.06.06 16:51:38 | 00,011,264 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\vulfntr.sys -- (vulfntrs)

DRV - [2005.01.05 17:02:10 | 00,006,912 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\vulfnth.sys -- (vulfnths)

DRV - [2004.10.15 11:50:20 | 00,015,295 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BrScnUsb.sys -- (BrScnUsb)

DRV - [2004.08.04 00:41:56 | 01,041,536 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFDPSP2.sys -- (HSF_DP)

DRV - [2004.08.04 00:41:56 | 00,011,868 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mdmxsdk.sys -- (mdmxsdk)

DRV - [2004.08.04 00:41:50 | 00,685,056 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFCXTS2.sys -- (winachsf)

DRV - [2004.08.04 00:41:48 | 00,220,032 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFBS2S2.sys -- (HSFHWBS2)

DRV - [2004.08.03 22:08:22 | 00,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)

DRV - [2004.07.17 11:36:38 | 00,027,440 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)

DRV - [2003.07.02 03:42:00 | 00,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)

DRV - [2001.10.30 14:01:50 | 00,280,782 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cmaudio.sys -- (cmpci) C-Media PCI Audio Driver (WDM)

DRV - [2001.08.23 14:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1801674531-1580436667-1060284298-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-1801674531-1580436667-1060284298-1003\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found

IE - HKU\S-1-5-21-1801674531-1580436667-1060284298-1003\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVGLS\Toolbar\IEToolbar.dll ()

IE - HKU\S-1-5-21-1801674531-1580436667-1060284298-1003\S-1-5-21-1801674531-1580436667-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5.0.364

FF - prefs.js..extensions.enabledItems: avg@igeared:2.609.002.003

FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.0

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVGLS\Firefox [2010.01.25 18:32:26 | 00,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVGLS\Toolbar\Firefox\avg@igeared [2010.01.24 15:31:56 | 00,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.01.19 16:54:17 | 00,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.19 16:54:17 | 00,000,000 | ---D | M]

[2009.02.14 16:25:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Dessy\Application Data\Mozilla\Extensions

[2010.01.26 13:56:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Dessy\Application Data\Mozilla\Firefox\Profiles\i1rk4ooj.default\extensions

[2010.01.22 16:40:22 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Dessy\Application Data\Mozilla\Firefox\Profiles\i1rk4ooj.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

[2009.02.14 16:24:23 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010.01.19 16:54:07 | 00,001,083 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\911bg.xml

[2010.01.19 16:54:07 | 00,002,442 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\diribg.xml

[2010.01.19 16:54:07 | 00,001,515 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pe-bg.xml

[2010.01.19 16:54:07 | 00,001,857 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\portalbgdict.xml

[2010.01.19 16:54:07 | 00,001,220 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-bg.xml

O1 HOSTS File: ([2010.01.19 21:38:41 | 00,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVGLS\avgssie.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVGLS\Toolbar\IEToolbar.dll ()

O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - No CLSID value found.

O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVGLS\Toolbar\IEToolbar.dll ()

O3 - HKLM\..\Toolbar: (FlashGet Bar) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll (Amaze Soft)

O3 - HKU\S-1-5-21-1801674531-1580436667-1060284298-1003\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVGLS\Toolbar\IEToolbar.dll ()

O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVGLS\avgtray.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\desekashe\mbamgui.exe (Malwarebytes Corporation)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\FlexType 2K.lnk = C:\Program Files\Datecs\FlexType 2K\FType2K.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1801674531-1580436667-1060284298-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1801674531-1580436667-1060284298-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-1801674531-1580436667-1060284298-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1

O7 - HKU\S-1-5-21-1801674531-1580436667-1060284298-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-1801674531-1580436667-1060284298-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\S-1-5-21-1801674531-1580436667-1060284298-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm ()

O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm ()

O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (Amaze Soft)

O9 - Extra 'Tools' menuitem : &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (Amaze Soft)

O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVGLS\avgpp.dll (AVG Technologies CZ, s.r.o.)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O24 - Desktop WallPaper: C:\Documents and Settings\Dessy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Dessy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{a7474e42-4833-11de-b8d1-00a1b0021330}\Shell\AutoRun\command - "" = RECYCLER32\dmgr.exe

O33 - MountPoints2\{a7474e42-4833-11de-b8d1-00a1b0021330}\Shell\open\command - "" = RECYCLER32\dmgr.exe

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - comfile [open] -- "%1" %*

O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010.01.26 19:21:46 | 00,548,352 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Dessy\Desktop\OTL.exe

[2010.01.26 15:46:53 | 00,000,000 | --SD | C] -- C:\Tool18953T

[2010.01.24 22:20:59 | 00,000,000 | -HSD | C] -- C:\RECYCLER

[2010.01.24 20:25:31 | 00,000,000 | ---D | C] -- C:\WINDOWS\temp

[2010.01.24 15:35:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Dessy\Local Settings\Application Data\AVG Security Toolbar

[2010.01.24 15:32:04 | 00,253,576 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys

[2010.01.24 15:32:03 | 00,108,296 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys

[2010.01.24 15:31:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar

[2010.01.24 15:31:17 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avg8ls

[2010.01.24 15:24:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Dessy\Application Data\AVG8

[2010.01.24 12:21:28 | 00,000,000 | ---D | C] -- C:\Tool

[2010.01.24 11:12:15 | 00,000,000 | RHSD | C] -- C:\cmdcons

[2010.01.24 11:09:16 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010.01.24 11:09:16 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010.01.24 11:09:16 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010.01.24 11:09:16 | 00,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010.01.24 11:08:56 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010.01.24 11:07:53 | 00,000,000 | ---D | C] -- C:\Qoobox

[2010.01.24 10:56:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Dessy\Desktop\index.php_files

[2010.01.22 17:21:03 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro

[2010.01.22 16:41:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Dessy\Application Data\QuickScan

[2010.01.21 20:15:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Dessy\My Documents\istoriq na religiite

[2010.01.21 01:16:27 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft

[2010.01.21 01:16:27 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft

[2010.01.21 01:16:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft

[2010.01.21 01:16:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft

[2010.01.20 23:13:31 | 00,000,000 | ---D | C] -- C:\Program Files\AVG

[2010.01.20 23:13:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avg9

[2010.01.20 00:46:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Dessy\Local Settings\Application Data\Deployment

[2010.01.19 17:34:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Dessy\My Documents\Изтегляния

[2010.01.19 10:59:43 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData

[2010.01.04 21:06:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Dessy\Local Settings\Application Data\WMTools Downloaded Files

[2010.01.04 21:05:09 | 00,000,000 | R--D | C] -- C:\Documents and Settings\Dessy\My Documents\My Videos

[2009.02.03 18:43:06 | 07,356,400 | ---- | C] (Mozilla) -- C:\Documents and Settings\Dessy\Application Data\setup_.exe

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.01.26 19:21:53 | 00,548,352 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dessy\Desktop\OTL.exe

[2010.01.26 19:16:35 | 00,000,486 | ---- | M] () -- C:\WINDOWS\tasks\1-Click Maintenance.job

[2010.01.26 19:16:27 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010.01.26 19:16:22 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.01.26 16:23:23 | 00,002,257 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk

[2010.01.26 15:45:09 | 03,837,063 | R--- | M] () -- C:\Documents and Settings\Dessy\Desktop\Tool.exe

[2010.01.26 15:44:21 | 04,980,736 | -H-- | M] () -- C:\Documents and Settings\Dessy\NTUSER.DAT

[2010.01.26 15:01:08 | 00,000,410 | ---- | M] () -- C:\WINDOWS\tasks\Malwarebytes' Scheduled Update for Dessy.job

[2010.01.26 14:16:36 | 00,056,832 | ---- | M] () -- C:\Documents and Settings\Dessy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.01.26 13:03:00 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\Dessy\ntuser.ini

[2010.01.24 21:34:06 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010.01.24 20:21:30 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini

[2010.01.24 19:57:39 | 00,724,952 | ---- | M] () -- C:\Documents and Settings\Dessy\Desktop\avenger.zip

[2010.01.24 15:32:06 | 00,001,514 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG LinkScanner®.lnk

[2010.01.24 15:32:04 | 00,253,576 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys

[2010.01.24 15:32:03 | 00,108,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys

[2010.01.24 11:12:24 | 00,000,281 | RHS- | M] () -- C:\boot.ini

[2010.01.24 10:56:38 | 00,100,002 | ---- | M] () -- C:\Documents and Settings\Dessy\Desktop\index.php.htm

[2010.01.22 17:45:51 | 00,000,536 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\telnet.lnk

[2010.01.22 17:21:04 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\Dessy\Desktop\HijackThis.lnk

[2010.01.20 19:40:35 | 00,036,864 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\gilgamesh.doc

[2010.01.19 21:36:06 | 00,029,360 | ---- | M] () -- C:\WINDOWS\_SETUPD_.EXE

[2010.01.07 16:07:14 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010.01.07 16:07:04 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010.01.03 14:37:16 | 00,048,020 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\4588_108410796046_639081046_3235851_7147308_n.jpg

[2010.01.02 14:54:59 | 04,219,826 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\IMG_8511.jpg

[2010.01.02 01:30:14 | 00,013,914 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\12662_187094486046_639081046_4361198_7796525_n.jpg

[2010.01.02 01:20:42 | 00,042,565 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\6048_114608721155_548581155_2920130_5072822_n.jpg

[2010.01.01 22:24:27 | 00,079,841 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\855281__.jpeg

[2009.12.29 22:21:07 | 03,661,093 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\DSC04876.JPG

[2009.12.29 22:16:13 | 00,087,718 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\barcelona_beach.jpg

[2009.12.29 20:12:55 | 00,032,000 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\image200911240036.jpg

[2009.12.29 00:30:06 | 00,318,371 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\Foto0118.jpg

[2009.12.29 00:27:19 | 00,324,523 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\Foto0117.jpg

[2009.12.29 00:00:58 | 01,918,549 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\DSC04165.JPG

[2009.12.28 23:54:52 | 03,418,368 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\DSC04877.JPG

[2009.12.28 23:54:49 | 03,593,800 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\DSC04875.JPG

[2009.12.28 00:59:03 | 02,577,173 | ---- | M] () -- C:\Documents and Settings\Dessy\My Documents\DSC00154.JPG

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.01.26 15:44:54 | 03,837,063 | R--- | C] () -- C:\Documents and Settings\Dessy\Desktop\Tool.exe

[2010.01.24 19:58:06 | 00,731,136 | ---- | C] () -- C:\Documents and Settings\Dessy\Desktop\avenger.exe

[2010.01.24 19:57:21 | 00,724,952 | ---- | C] () -- C:\Documents and Settings\Dessy\Desktop\avenger.zip

[2010.01.24 15:32:06 | 00,001,514 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG LinkScanner®.lnk

[2010.01.24 11:12:24 | 00,000,211 | ---- | C] () -- C:\Boot.bak

[2010.01.24 11:12:20 | 00,260,272 | ---- | C] () -- C:\cmldr

[2010.01.24 11:09:16 | 00,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010.01.24 11:09:16 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010.01.24 11:09:16 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010.01.24 11:09:16 | 00,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010.01.24 11:09:16 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010.01.24 10:56:26 | 00,100,002 | ---- | C] () -- C:\Documents and Settings\Dessy\Desktop\index.php.htm

[2010.01.22 17:21:03 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\Dessy\Desktop\HijackThis.lnk

[2010.01.20 19:40:34 | 00,036,864 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\gilgamesh.doc

[2010.01.03 14:37:12 | 00,048,020 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\4588_108410796046_639081046_3235851_7147308_n.jpg

[2010.01.02 14:53:49 | 04,219,826 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\IMG_8511.jpg

[2010.01.02 01:30:12 | 00,013,914 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\12662_187094486046_639081046_4361198_7796525_n.jpg

[2010.01.02 01:20:39 | 00,042,565 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\6048_114608721155_548581155_2920130_5072822_n.jpg

[2010.01.01 22:24:24 | 00,079,841 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\855281__.jpeg

[2009.12.29 22:16:01 | 00,087,718 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\barcelona_beach.jpg

[2009.12.29 20:12:48 | 00,032,000 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\image200911240036.jpg

[2009.12.29 00:29:48 | 00,318,371 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\Foto0118.jpg

[2009.12.29 00:27:04 | 00,324,523 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\Foto0117.jpg

[2009.12.29 00:00:52 | 01,918,549 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\DSC04165.JPG

[2009.12.28 23:50:04 | 03,418,368 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\DSC04877.JPG

[2009.12.28 23:50:01 | 03,593,800 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\DSC04875.JPG

[2009.12.28 23:49:57 | 03,661,093 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\DSC04876.JPG

[2009.12.28 00:58:54 | 02,577,173 | ---- | C] () -- C:\Documents and Settings\Dessy\My Documents\DSC00154.JPG

[2009.05.25 10:53:36 | 00,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2009.05.25 10:53:36 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2009.05.25 10:53:35 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll

[2009.05.25 10:53:31 | 00,005,120 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll

[2009.05.25 10:53:31 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest

[2009.05.24 11:54:14 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\vusetup.dll

[2009.05.24 01:32:06 | 00,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI

[2009.05.23 17:45:23 | 00,000,132 | ---- | C] () -- C:\WINDOWS\Cmicnfg3.ini.cfl

[2009.05.23 17:44:15 | 00,001,480 | ---- | C] () -- C:\WINDOWS\Cmicnfg3.ini.cfg

[2009.05.23 17:43:58 | 00,002,532 | ---- | C] () -- C:\WINDOWS\cmudax3.ini

[2009.04.12 14:59:35 | 00,000,437 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI

[2009.04.12 14:59:35 | 00,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI

[2009.04.12 14:55:01 | 00,027,019 | ---- | C] () -- C:\WINDOWS\maxlink.ini

[2009.03.24 15:04:51 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\newdll.dll

[2009.02.18 22:17:28 | 00,031,831 | ---- | C] () -- C:\WINDOWS\unvpeye.ini

[2009.02.17 11:23:17 | 00,056,832 | ---- | C] () -- C:\Documents and Settings\Dessy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.02.16 21:25:12 | 00,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI

[2009.02.14 13:35:58 | 00,000,025 | ---- | C] () -- C:\WINDOWS\mixerdef.ini

[2009.02.14 13:21:16 | 00,001,125 | ---- | C] () -- C:\WINDOWS\winamp.ini

[2009.02.14 13:19:54 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2004.07.17 11:36:38 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys

[2003.01.07 15:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2002.03.04 09:16:34 | 00,110,592 | R--- | C] () -- C:\WINDOWS\System32\Jpeg32.dll

[2001.06.24 11:32:44 | 00,172,032 | ---- | C] () -- C:\WINDOWS\japi2.dll

[2000.07.28 12:48:12 | 00,102,400 | ---- | C] () -- C:\WINDOWS\japi.dll

========== LOP Check ==========

[2010.01.24 15:41:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar

[2010.01.21 01:15:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9

[2009.05.22 09:23:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters

[2009.04.12 14:54:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft

[2009.02.14 17:41:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software

[2009.02.14 17:24:35 | 00,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}

[2009.12.25 13:01:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Dessy\Application Data\GrabPro

[2010.01.24 18:15:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Dessy\Application Data\Orbit

[2010.01.24 15:08:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Dessy\Application Data\QuickScan

[2009.04.12 15:00:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Dessy\Application Data\ScanSoft

[2009.02.14 17:46:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Dessy\Application Data\TuneUp Software

[2010.01.26 19:07:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Dessy\Application Data\uTorrent

[2010.01.26 19:16:35 | 00,000,486 | ---- | M] () -- C:\WINDOWS\Tasks\1-Click Maintenance.job

========== Purity Check ==========

< End of report >

OTL Extras logfile created on: 26.1.2010 г. 19:23:54 - Run 1

OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\Dessy\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.'

255,00 Mb Total Physical Memory | 21,00 Mb Available Physical Memory | 8,00% Memory free

618,00 Mb Paging File | 355,00 Mb Available in Paging File | 57,00% Paging File free

Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 14,65 Gb Total Space | 2,87 Gb Free Space | 19,59% Space Free | Partition Type: NTFS

Drive D: | 14,63 Gb Total Space | 1,04 Gb Free Space | 7,10% Space Free | Partition Type: FAT32

Drive E: | 8,98 Gb Total Space | 0,09 Gb Free Space | 1,05% Space Free | Partition Type: FAT32

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: HOME-45875AAC73

Current User Name: Dessy

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.hta [@ = htafile] -- C:\Program Files\AnalogX\Script Defender\sdefend.exe (AnalogX, LLC)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

.jse [@ = JSEFile] -- C:\Program Files\AnalogX\Script Defender\sdefend.exe (AnalogX, LLC)

.wsf [@ = WSFFile] -- C:\Program Files\AnalogX\Script Defender\sdefend.exe (AnalogX, LLC)

.wsh [@ = WSHFile] -- C:\Program Files\AnalogX\Script Defender\sdefend.exe (AnalogX, LLC)

[HKEY_USERS\S-1-5-21-1801674531-1580436667-1060284298-1003\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htafile [open] -- C:\Program Files\AnalogX\Script Defender\sdefend.exe %1 %* (AnalogX, LLC)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)

jsefile [open] -- C:\Program Files\AnalogX\Script Defender\sdefend.exe %1 %* (AnalogX, LLC)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

wsffile [open] -- C:\Program Files\AnalogX\Script Defender\sdefend.exe %1 %* (AnalogX, LLC)

wshfile [open] -- C:\Program Files\AnalogX\Script Defender\sdefend.exe %1 %* (AnalogX, LLC)

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "%programfiles%\internet explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusOverride" = 1

"FirewallOverride" = 0

"AntiVirusDisableNotify" = 1

"FirewallDisableNotify" = 1

"UpdatesDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"4126:TCP" = 4126:TCP:*:Enabled:WWW

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\uTorrent\utorrent.exe" = C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)

"C:\Program Files\Orbitdownloader\orbitdm.exe" = C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)

"C:\Program Files\Orbitdownloader\orbitnet.exe" = C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)

"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)

"C:\Program Files\Soulseek-Test\slsk.exe" = C:\Program Files\Soulseek-Test\slsk.exe:*:Enabled:SoulSeek -- ()

"C:\Program Files\AVG\AVGLS\avgupd.exe" = C:\Program Files\AVG\AVGLS\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)

"C:\Program Files\AVG\AVGLS\avgnsx.exe" = C:\Program Files\AVG\AVGLS\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)

"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009

"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8

"{6AECFE2F-86D3-4EA8-B110-19CDAA343199}" = ItaEst - Taka e!

"{71C97545-E547-4A8B-B0C8-61FF853270AC}" = PaperPort

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90120000-0020-0402-0000-0000000FF1CE}" = Пакет за съвместимост за системата Office 2007

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9A912C12-A7DA-44D7-BD57-5CA85E2F33E1}" = Brother MFL-Pro Suite

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9 Lite

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{EA9FAF16-0E5C-42C4-9742-9AF8D5F6D69B}" = ATI Catalyst Control Center

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"All ATI Software" = ATI - Software Uninstall Utility

"AnalogX Script Defender" = AnalogX Script Defender

"ATI Display Driver" = ATI Display Driver

"Avg8LsUninstall" = AVG LinkScanner® 8.5

"C-Media PCI Sound" = C-Media PCI Audio Device

"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition

"FastStone Image Viewer" = FastStone Image Viewer 2.9

"FlashGet(JetCar)" = FlashGet(JetCar)

"FlexType 2K" = FlexType 2K

"HijackThis" = HijackThis 2.0.2

"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA п»ї

"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 1.63

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)

"Orbit_is1" = Orbit Downloader

"PCI Audio Driver" = PCI Audio Driver

"SA Dictionary 2004 Datacenter" = SA Dictionary 2004 Datacenter

"Soulseek2" = SoulSeek Client 157 test 12

"The KMPlayer" = The KMPlayer 2.9.4.1434

"uTorrent" = µTorrent

"WIC" = Windows Imaging Component

"Winamp" = Winamp

"Windows Media Format Runtime" = Windows Media Format Runtime

"WinRAR archiver" = WinRAR archiver

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 20.1.2010 г. 17:44:30 | Computer Name = HOME-45875AAC73 | Source = crypt32 | ID = 131080

Description = Failed auto update retrieval of third-party root list sequence number

from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

with error: This operation returned because the timeout period expired.

Error - 20.1.2010 г. 17:45:04 | Computer Name = HOME-45875AAC73 | Source = crypt32 | ID = 131083

Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>

with error: The data is invalid.

Error - 20.1.2010 г. 17:45:06 | Computer Name = HOME-45875AAC73 | Source = crypt32 | ID = 131080

Description = Failed auto update retrieval of third-party root list sequence number

from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

with error: This network connection does not exist.

Error - 20.1.2010 г. 17:45:36 | Computer Name = HOME-45875AAC73 | Source = crypt32 | ID = 131083

Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>

with error: The data is invalid.

Error - 23.1.2010 г. 06:05:59 | Computer Name = HOME-45875AAC73 | Source = Application Hang | ID = 1002

Description = Hanging application firefox.exe, version 1.9.1.3642, hang module hungapp,

version 0.0.0.0, hang address 0x00000000.

Error - 23.1.2010 г. 07:20:34 | Computer Name = HOME-45875AAC73 | Source = Application Hang | ID = 1002

Description = Hanging application firefox.exe, version 1.9.1.3642, hang module hungapp,

version 0.0.0.0, hang address 0x00000000.

Error - 24.1.2010 г. 15:57:27 | Computer Name = HOME-45875AAC73 | Source = Application Hang | ID = 1002

Description = Hanging application firefox.exe, version 1.9.1.3642, hang module hungapp,

version 0.0.0.0, hang address 0x00000000.

Error - 25.1.2010 г. 07:47:58 | Computer Name = HOME-45875AAC73 | Source = Application Error | ID = 1000

Description = Faulting application flashget.exe, version 1.7.1.0, faulting module

flashget.exe, version 1.7.1.0, fault address 0x00099c67.

Error - 26.1.2010 г. 07:02:43 | Computer Name = HOME-45875AAC73 | Source = Application Hang | ID = 1002

Description = Hanging application firefox.exe, version 1.9.1.3642, hang module hungapp,

version 0.0.0.0, hang address 0x00000000.

Error - 26.1.2010 г. 07:59:31 | Computer Name = HOME-45875AAC73 | Source = CardSpace 3.0.0.0 | ID = 327949

Description = The Windows CardSpace service is too busy to process this request.

User has too many outstanding requests. Additional Information: at System.Environment.GetStackTrace(Exception

e, Boolean needFileInfo) at System.Environment.get_StackTrace() at Microsoft.InfoCards.Diagnostics.InfoCardTrace.BuildMessage(InfoCardBaseException

ie) at Microsoft.InfoCards.Diagnostics.InfoCardTrace.TraceAndLogException(Exception

e) at Microsoft.InfoCards.Diagnostics.InfoCardTrace.ThrowHelperError(Exception

e) at Microsoft.InfoCards.UIAgentMonitor.AddNewClient(UIAgentMonitorHandle handle)

at Microsoft.InfoCards.UIAgentMonitorHandle.CreateAgent(Int32 callerPid, WindowsIdentity

callerIdentity, Int32 tsSessionId) at Microsoft.InfoCards.RequestFactory.CreateClientRequestInstance(UIAgentMonitorHandle

monitorHandle, String reqName, IntPtr rpcHandle, Stream inStream, Stream outStream)

at Microsoft.InfoCards.RequestFactory.ProcessNewRequest(Int32 parentRequestHandle,

IntPtr rpcHandle, IntPtr inArgs, IntPtr& outArgs)

[ System Events ]

Error - 26.1.2010 г. 11:26:40 | Computer Name = HOME-45875AAC73 | Source = W32Time | ID = 39452689

Description = Time Provider NtpClient: An error occurred during DNS lookup of the

manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup

again in 15 minutes. The error was: A socket operation was attempted to an unreachable

host. (0x80072751)

Error - 26.1.2010 г. 11:26:40 | Computer Name = HOME-45875AAC73 | Source = W32Time | ID = 39452701

Description = The time provider NtpClient is configured to acquire time from one

or more time sources, however none of the sources are currently accessible. No attempt

to contact a source will be made for 14 minutes. NtpClient has no source of accurate

time.

Error - 26.1.2010 г. 11:27:35 | Computer Name = HOME-45875AAC73 | Source = W32Time | ID = 39452689

Description = Time Provider NtpClient: An error occurred during DNS lookup of the

manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup

again in 15 minutes. The error was: A socket operation was attempted to an unreachable

host. (0x80072751)

Error - 26.1.2010 г. 11:27:35 | Computer Name = HOME-45875AAC73 | Source = W32Time | ID = 39452701

Description = The time provider NtpClient is configured to acquire time from one

or more time sources, however none of the sources are currently accessible. No attempt

to contact a source will be made for 14 minutes. NtpClient has no source of accurate

time.

Error - 26.1.2010 г. 11:27:35 | Computer Name = HOME-45875AAC73 | Source = W32Time | ID = 39452689

Description = Time Provider NtpClient: An error occurred during DNS lookup of the

manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup

again in 15 minutes. The error was: A socket operation was attempted to an unreachable

host. (0x80072751)

Error - 26.1.2010 г. 11:27:35 | Computer Name = HOME-45875AAC73 | Source = W32Time | ID = 39452701

Description = The time provider NtpClient is configured to acquire time from one

or more time sources, however none of the sources are currently accessible. No attempt

to contact a source will be made for 14 minutes. NtpClient has no source of accurate

time.

Error - 26.1.2010 г. 11:28:22 | Computer Name = HOME-45875AAC73 | Source = W32Time | ID = 39452689

Description = Time Provider NtpClient: An error occurred during DNS lookup of the

manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup

again in 15 minutes. The error was: A socket operation was attempted to an unreachable

host. (0x80072751)

Error - 26.1.2010 г. 11:28:22 | Computer Name = HOME-45875AAC73 | Source = W32Time | ID = 39452701

Description = The time provider NtpClient is configured to acquire time from one

or more time sources, however none of the sources are currently accessible. No attempt

to contact a source will be made for 14 minutes. NtpClient has no source of accurate

time.

Error - 26.1.2010 г. 11:28:22 | Computer Name = HOME-45875AAC73 | Source = W32Time | ID = 39452689

Description = Time Provider NtpClient: An error occurred during DNS lookup of the

manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup

again in 15 minutes. The error was: A socket operation was attempted to an unreachable

host. (0x80072751)

Error - 26.1.2010 г. 11:28:22 | Computer Name = HOME-45875AAC73 | Source = W32Time | ID = 39452701

Description = The time provider NtpClient is configured to acquire time from one

or more time sources, however none of the sources are currently accessible. No attempt

to contact a source will be made for 14 minutes. NtpClient has no source of accurate

time.

[ TuneUp Events ]

Error - 25.12.2009 г. 09:10:46 | Computer Name = HOME-45875AAC73 | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2009-12-25 15:10:46', '\device\harddiskvolume1\downloads\malwarebytes'

anti-malware 1.42\mbam-setup.exe','2752',0)

Error - 25.12.2009 г. 09:12:54 | Computer Name = HOME-45875AAC73 | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2009-12-25 15:12:51', '\device\harddiskvolume1\downloads\malwarebytes'

anti-malware 1.42\mbam-setup.exe','2252',0)

Error - 25.12.2009 г. 09:13:54 | Computer Name = HOME-45875AAC73 | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2009-12-25 15:13:54', '\device\harddiskvolume1\downloads\malwarebytes'

anti-malware 1.42\keygen\keygen.exe','2560',0)

Error - 04.1.2010 г. 09:00:34 | Computer Name = HOME-45875AAC73 | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-01-04 15:00:34', '\device\harddiskvolume1\documents

and settings\all users\application data\malwarebytes\malwarebytes' anti-malware\mbam-setup.exe','2268',0)

< End of report >

Стъпка 1:

Изтеглете => FixPolicies

Запазете го някъде на декстопа.Кликнете два пъти върху файла и изберете Install.Ще се създаде папка с името FixPolicies на десктопа.Отворете я и стартирайте файла Fix_policies.cmd.

Стъпка 2:

• Стартирайте OTL.exe
  
• Под Custom Scans/Fixes поставете следния скрипт:
  

:OTL

IE - HKU\S-1-5-21-1801674531-1580436667-1060284298-1003\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found

O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - No CLSID value found.

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O33 - MountPoints2\{a7474e42-4833-11de-b8d1-00a1b0021330}\Shell\AutoRun\command - "" = RECYCLER32\dmgr.exe

O33 - MountPoints2\{a7474e42-4833-11de-b8d1-00a1b0021330}\Shell\open\command - "" = RECYCLER32\dmgr.exe


:reg

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"4126:TCP" =-


:services

WWW

txiur


:Commands

[purity]

[emptytemp]

[Reboot]

• След това, кликнете върху бутона Run Fix
  
• Търпеливо изчакайте, докато програмата приключи своята работа. След, като нейната работа приключи, компютърът Ви ще се рестартира.
  

След рестартирането на компютъра, стартирайте отново OTL.exe и кликнете върху бутона Quick Scan. Накрая ще бъде генериран лог файл, който е необходимо да копирате и публикувате в следващия Ви коментар в тази тема.

колко търпеливо трябва да изчакам? в смисъл, нормално ли е да отнеме часове? как да преценя дали изобщо работи или е забило?

Повече от 20 минути не е нормално!

колко търпеливо трябва да изчакам? в смисъл, нормално ли е да отнеме часове? как да преценя дали изобщо работи или е забило?

Имате ли нужда още от помощ ?

' date='28 януари 2010 - 23:42 ' timestamp='1264714943' post='1620381']

Имате ли нужда още от помощ ?

еми аз се отказах вече, сигурно ще го преинсталирам при първа възможност... но незнам дали е вирус изобщо

Преди да се откажете да пробваме да го оправим. Изглежда засега метода с превенцията работи.

Виновника е червея наречен - Conficker.

Колегата е малко зает и ме помоли да довършим.

СТЪПКА 1

1. Ваксинирайте машината с Panda USB Vaccine

(изтеглете и стартирайте приложението и натиснете Vaccinate computer).

2. Отворете Start => run => напишете => services.msc => намерете от списъка => Server => двукратен клик => Stop => и от Startup type => посочете => Disabled.

3. Изтеглете и инсталирайте Service Pack 3

+ следните 3 кръпки: KB958687, KB957097, KB958644.

Рестартирайте машината.

СТЪПКА 2

Изтеглете програмата - SvcQuery.exe от sUBs

Запазете я на десктопа.

Стартирайте файла - SvcQuery.exe

Въведете тази информация - txiur и натиснете [ENTER].

Натиснете клавиш Y за да се съгласите.

Би трябвало да се създаде лог файл от програмата.

Публикувайте го в следващия си пост.

- - - - - - - - - - - BEFORE - - - - - - - - - - -

netsvcs REG_MULTI_SZ 6to4\0AppMgmt\0AudioSrv\0Browser\0CryptSvc\0DMServer\0DHCP\0ERSvc\0EventSystem\0FastUserSwitchingCompatibility\0HidServ\0Ias\0Iprip\0Irmon\0LanmanServer\0LanmanWorkstation\0Messenger\0Netman\0Nla\0Ntmssvc\0NWCWorkstation\0Nwsapagent\0Rasauto\0Rasman\0Remoteaccess\0Schedule\0Seclogon\0SENS\0Sharedaccess\0SRService\0Tapisrv\0Themes\0TrkWks\0UxTuneUp\0W32Time\0WZCSVC\0Wmi\0WmdmPmSp\0winmgmt\0wscsvc\0xmlprov\0BITS\0wuauserv\0ShellHWDetection\0helpsvc\0WmdmPmSN\0txiur\0napagent\0hkmsvc\0\0

- - - - - - - - - - - AFTER - - - - - - - - - - -

netsvcs REG_MULTI_SZ 6to4\0AppMgmt\0AudioSrv\0Browser\0CryptSvc\0DMServer\0DHCP\0ERSvc\0EventSystem\0FastUserSwitchingCompatibility\0HidServ\0Ias\0Iprip\0Irmon\0LanmanServer\0LanmanWorkstation\0Messenger\0Netman\0Nla\0Ntmssvc\0NWCWorkstation\0Nwsapagent\0Rasauto\0Rasman\0Remoteaccess\0Schedule\0Seclogon\0SENS\0Sharedaccess\0SRService\0Tapisrv\0Themes\0TrkWks\0UxTuneUp\0W32Time\0WZCSVC\0Wmi\0WmdmPmSp\0winmgmt\0wscsvc\0xmlprov\0BITS\0wuauserv\0ShellHWDetection\0helpsvc\0WmdmPmSN\0napagent\0hkmsvc\0\0

Добра работа.

Лог файла показва добри резултати. Предполагам сте изпълнили и всичко от стъпка 1.

Сега имам нужда от един финален лог файл за да проверя дали всичко е наред:

*. Временно спрете защитата на антивирусната си програма!.

*. Изтрийте наличната версия на Combofix.

*. Изтеглете нова версия на Combofix.

*. Запазете го на на декстопа.

*. Стартирайте инструмента с двукратен клик на мишката.

*. По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

*. Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

" Коментарът ви е прекалено дълъг. Моля върнете се и го съкратете."

за това го прикачвам отделно

интернета пак спира като пусна клипче или нещо да се тегли...

ComboFix.txt

Една финална стъпка.

Отворете notepad.exe.

Сега отидете на Format и сложете отметка (ако няма) пред Word Wrap.

Вече с copy/paste въведете това:

KILLALL::

Driver::

PPDrv

PPEMSCAN

Registry::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"D_V_T"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"4126:TCP"=-

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a7474e42-4833-11de-b8d1-00a1b0021330}]

Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както на картинката отдолу).

По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

заби

заби

Досега ли го чакахте ?

Добре, пропуснете стъпката с Combofix и го деинсталирайте по следния начин => Start => Run => въведете => Combofix /Uninstall => натиснете Enter. Това ще стартира Combofix още веднъж и ще го деинсталира, като така ще изтрие и всички файлове асоциирани с него. Включително и папката C:\Qoobox (карантината на Combofix).

(Бележка: Има празно място между Combofix и /Uninstall).

Отворете notepad.exe и с copy/paste въведете следната информация:

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"4126:TCP"=-

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a7474e42-4833-11de-b8d1-00a1b0021330}]

Запазете файла с име fix.reg и го стартирайте.

Файла трябва да изглежда така -

Изберете YES за да влезнат промените в сила.

Отидете до Start => Run => въведете => CMD => натиснете Enter. От конзолата вече въведете следната команда: sc delete PPDrv

=> натиснете Enter.

Отидете до Start => Run => въведете => CMD => натиснете Enter. От конзолата вече въведете следната команда: sc delete PPEMSCAN

=> натиснете Enter.

За финал направете една проверка с Eset Online Scanner:

1) Изтеглете: ESET Online Scanner

2) Стартирайте esetsmartinstaller_enu.exe

3) Сложете отметка на YES, I accept the Terms of Use и изберете Start

4) Скенерът ще започне да изтегля компонентите, които са му необходими.

5) Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

• 
  
• Remove found threats
  
• Scan archives
  
• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
  
• Enable Anti-Stealth technology
  

И накрая изберете Start

6) Скенерът ще започне да изтегля последните дефиниции.

7) След, като сканирането завърши изберете Finish.

8) Отидете в:

C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си пост тук.

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=1b1008c40989cf40bd468b694f8cd9eb

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2010-01-31 11:50:43

# local_time=2010-01-31 01:50:43 (+0200, FLE Standard Time)

# country="Bulgaria"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 760567 760567 0 0

# compatibility_mode=1024 16777215 100 0 594352 594352 0 0

# compatibility_mode=8192 67108863 100 0 3768 3768 0 0

# scanned=58046

# found=59

# cleaned=59

# scan_time=8023

C:\Driver Genius Professional 8\Keygen\keygen.exe probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\programi\FlashGet 1.71 Final + crack + patch\FlashGet 1.71 Final + crack + patch.zip probably a variant of Win32/Agent trojan (deleted - quarantined) 00000000000000000000000000000000 C

D:\programi\EVEREST Ultimate Edition final registered\EVEREST Ultimate Edition\Patch.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\programi\Mozilla Firefox 3.0.6 на Български\Firefox Setup 3.0.6.exe a variant of Win32/Injector.PW trojan (deleted - quarantined) 00000000000000000000000000000000 C

E:\E.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\jazz\jazz.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\hallucinogen\hallucinogen.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Hatebreed\Hatebreed.rar Win32/AutoRun.Agent.UD worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Korn\Korn.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Limp Bizkit\Bizkit.rar Win32/AutoRun.Agent.UD worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\System Volume Information\Volume Information.rar Win32/AutoRun.Agent.UD worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Massive Attack - Mezzanine (1998) [FLAC]\Attack - Mezzanine (1998) [FLAC].pif a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

E:\Massive Attack - Mezzanine (1998) [FLAC]\Attack - Mezzanine (1998) [FLAC].rar Win32/AutoRun.Agent.UD worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\eminem\eminem.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Portishead - Discography\- Discography.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Portishead - Discography\Studio Albums\Albums.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Portishead - Discography\Studio Albums\1994 - Dummy\- Dummy.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Portishead - Discography\Studio Albums\1997 - Portishead\- Portishead.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Portishead - Discography\Studio Albums\2008 - Third\- Third.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Prodigy\Prodigy.rar Win32/AutoRun.Agent.UD worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Slipknot\Slipknot.rar Win32/AutoRun.Agent.UD worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Video\Video.rar Win32/AutoRun.Agent.UD worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Jedi Mind Tricks\Mind Tricks.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Jedi Mind Tricks\Visions of Gandhi\of Gandhi.rar Win32/AutoRun.Agent.UD worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Jedi Mind Tricks\Violent By Design\By Design.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Jedi Mind Tricks\The Psycho-Social, Chemical, Biological, and Electro-Magnetic Manipulation of Human Consciousness\Psycho-Social, Chemical, Biological, and Electro-Magnetic Manipulation of Human Consciousness.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Jedi Mind Tricks\Servants in Heaven, Kings in Hell\in Heaven, Kings in Hell.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Jedi Mind Tricks\Legacy of Blood\of Blood.rar a variant of Win32/AutoRun.Agent.UD worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\chemical brothers\brothers.rar a variant of Win32/AutoRun.Agent.UD worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Bonobo Discography\Discography.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Bonobo Discography\Sweetness\Sweetness.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Bonobo Discography\Animal Magic\Magic.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Bonobo Discography\Solid Steel (It Came From The Sea)\Steel (It Came From The Sea).rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Bonobo Discography\Days To Come\To Come.rar Win32/AutoRun.Agent.UD worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Bonobo Discography\One Off's Remixes & B-Sides\Off's Remixes & B-Sides.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Bonobo Discography\Dial 'M' for Monkey\'M' for Monkey.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Dope Reach Squad\Reach Squad.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Dope Reach Squad\Defloraciq\Defloraciq.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Nokaut\Nokaut.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Spens i Slim\i Slim.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\DJ Krush\Krush.rar Win32/AutoRun.Agent.UD worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\DJ Krush\dj krush - zen\krush - zen.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\DJ Krush\dj krush - jaku [2004]\krush - jaku [2004].scr a variant of Win32/AutoRun.Agent.UA worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

E:\DJ Krush\dj krush - jaku [2004]\krush - jaku [2004].rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\DJ Krush\Code 4109\Code 4109.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Spor\Spor.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Atari Teenage Riot\Teenage Riot.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Atari Teenage Riot\The Future Of War\Future Of War.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Atari Teenage Riot\Delete Yourself\Yourself.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Atari Teenage Riot\60 Seconds Wipe Out\Seconds Wipe Out.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Bad Company\Company.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Bad Company\Bad Company - Unknown Album\Company - Unknown Album.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Black Sun Empire\Sun Empire.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\infected mushroom\mushroom.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\noiseshaper\noiseshaper.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Noisia Collection\Collection.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\digable planets - blowout comb\planets - blowout comb.rar Win32/AutoRun.Agent.UD worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Digable Planets - Reachin'\Planets - Reachin'.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

E:\Digable Planets - Reachin'\New Folder\Folder.rar a variant of Win32/AutoRun.Agent.UA worm (deleted - quarantined) 00000000000000000000000000000000 C

забравих да стартирам fix.reg когато трябваше и го направих чак накрая...проблема все още го има

а троянците в диск Е идват от нещо свързано със system restore, преди го бях изключила и спряха да се появяват но сега пак ги има...

И 3 страници за тоя мизерен проблем?

Такъв проблем не се решава така. Наличието на вирус е само един от многобройните проблеми, които могат да доведат до прекъсване на интернета.

Първата стъпка е отхвърлянето на хардуерен проблем. За целта се сваля Live CD - без значение уиндоус, линукс или нещо друго. Ако при ползването му проблеми с интернета няма - значи проблемът е софтуерен. Ако пък има - значи е хардуерен. Методика - сменя се мрежовата карта. Ако се оправи, значи е от нея. Ако ли не - става дума за сериозен хардуерен проблем, най-вероятно по дъното. Също така може да се провери дали слотът за картата не е повреден.

Ако е софтуерен - версиите са много - от вирус до несъвместим софтуер. Та търсенето на вируси преди хардуерен тест е неоправдано. Затова - първо с Live CD, а ако всичко е наред - една нова инсталация на уиндоус заема само няколко часа, но за сметка на това се сдобивате със свежа система с най-новите версии на софтуера, последните ъпдейти и т.н. Веднага след това трябва да се инсталира антивирусна програма - Аваст е идеална, предлага отлична защита, като същевременно е безплатна за лична употреба. Така вероятността за всякакви бъдещи проблеми с вируси се свежда до минимум, тъй като не са редки случаите, когато потребителят си мисли, че е изчистил вируса, а на практика той се спотайва някъде из компютъра и пак се появява след време.

moonclub,искаш ли да дойдеш да ми го оправиш? може и нова лан карта да ми купиш

За без пари толкова. Колкото си платиш - толкова получаваш.

За да спреш System Restore, използвай следния скрипт :

REGEDIT4


;Turn Off System Restore

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr]

"Start"=dword:00000004

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Parameters]

"FirstRun"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice]

"Start"=dword:00000004

Запази го с като DisableSR.reg . Стартирай го и потвърди с => Yes => OK

Рестартирай компютъра.

Не е късно и сега да изпълниш предишния .reg файл.

След това ако имаш желание направи още една проверка с ESET Online Scanner , като увериш , че има отметки на следните редове, включително и тези от менюто Advanced Settings:

Remove found threats

Scan archives

Scan for potentially unwanted applications

Scan for potentially unsafe applications

Enable Anti-Stealth technology

За без пари толкова. Колкото си платиш - толкова получаваш.

Ние сме от растафари сектата на Джа, живеем в аскетизъм мерси за съвета все пак

Ние сме от растафари сектата на Джа, живеем в аскетизъм мерси за съвета все пак

Положението при вас коренно се е променило. От Conficker на Win32.KillAV.

Conficker-a вече го няма, но за да сме сигурни, че другия няма да се върне ще се наложи малко да се потрудим.

Направете това което е написала palavata_tanq в предишния си пост.

След това направете тези стъпки за да спрете разпространението на червея:

http://www.kaldata.com/forums/index.php?showtopic=146043&view=findpost&p=1600963