Накратко - Един приятел ми донесе компютъра му за пре-инсталация и реших вместо да му сменям мак-адреса, за да пусна моя интернет на неговия компютър да сваля всички драйвери и програми на моя и да ги прехвърля на неговия през флашката, обаче на него компа му е пълен с разни щуротии и какво стана нещо флашката се зарази и от там в моето РС... И сега 2 пъти реинсталирам Уиндоус на извадени кабели щуротии и йок, пак разни програмки. Лог от Malware Bytes

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360sd.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rp.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360se.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360softmgrsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360speedld.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ast.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avmailc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwebgrd.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ðþ¸´¹¤¾ß.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kswebshield.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmscsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcnasvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcods.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcproxy.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsacore.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsysmon.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfsrv.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpmon.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpsvc1.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpsvc2.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msksrver.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qutmserv.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsagent.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstray.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxtray.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanfrm.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sfctlcom.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmbmsrv.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmproxy.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ufseagnt.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krnl360svc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zhudongfangyu.exe (Security.Hijack) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msnsc (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdAgent.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\msnsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\cmt.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\appmgmts.dll (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\37596566.tmp (Spyware.OnlineGames) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\50679781.dll (Trojan.GamesThief) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\80668656.dll (Spyware.OnLineGames) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\tl.dll (Spyware.OnLineGames) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\www.dll (Trojan.GamesThief) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\qq.dll (Trojan.GamesThief) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\jxsjwsasystem.gif (Spyware.OnlineGames) -> Quarantined and deleted successfully.

C:\WINDOWS\ctfmon.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\ww.dll (Trojan.GamesThief) -> Quarantined and deleted successfully.

Смисъл всичко това се трие под нормално пускане на Уин, после влизам под сейф-мод и пак повтарям процедурата + СмитФрауд и после като влезна по нормалния начин в Уиндоуса пак се появяват...

Някой да може да ми помогне ?

Phobos, изчакай мнение на някой от екипа на HJT Team, НЕ обръщай внимание на " пишман " хакери !

Накратко - Един приятел ми донесе компютъра му за пре-инсталация и реших вместо да му сменям мак-адреса, за да пусна моя интернет на неговия компютър да сваля всички драйвери и програми на моя и да ги прехвърля на неговия през флашката, обаче на него компа му е пълен с разни щуротии и какво стана нещо флашката се зарази и от там в моето РС... И сега 2 пъти реинсталирам Уиндоус на извадени кабели щуротии и йок, пак разни програмки. Лог от Malware Bytes

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360sd.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rp.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360se.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360softmgrsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360speedld.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ast.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avmailc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwebgrd.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ðþ¸´¹¤¾ß.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kswebshield.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmscsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcnasvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcods.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcproxy.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsacore.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsysmon.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfsrv.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpmon.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpsvc1.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpsvc2.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msksrver.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qutmserv.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsagent.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstray.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxtray.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanfrm.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sfctlcom.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmbmsrv.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmproxy.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ufseagnt.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krnl360svc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zhudongfangyu.exe (Security.Hijack) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msnsc (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdAgent.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\msnsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\cmt.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\appmgmts.dll (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\37596566.tmp (Spyware.OnlineGames) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\50679781.dll (Trojan.GamesThief) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\80668656.dll (Spyware.OnLineGames) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\tl.dll (Spyware.OnLineGames) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\www.dll (Trojan.GamesThief) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\qq.dll (Trojan.GamesThief) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\jxsjwsasystem.gif (Spyware.OnlineGames) -> Quarantined and deleted successfully.

C:\WINDOWS\ctfmon.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\ww.dll (Trojan.GamesThief) -> Quarantined and deleted successfully.

Смисъл всичко това се трие под нормално пускане на Уин, после влизам под сейф-мод и пак повтарям процедурата + СмитФрауд и после като влезна по нормалния начин в Уиндоуса пак се появяват...

Някой да може да ми помогне ?

не беше зле преди почистването да спреш system restore,за което нищо не споменаваш и чак тогава да чистиш в safe mode.изчакай HJT да реагират и следвай препоръките,които се дават.преинстал се прави тогава когато положението е неспасяемо.успех!

И аз се усетих преди да пусна темата, че тъпо направих с тоя ре-инстал и можеше да мина тънко със един Рестор, но късно вече

нищо бе,не се притеснявай.само малко удължаваш процедурата.

Здравейте, Phobos. Ще може ли логове от DDS, ето как:

• Изтеглете DDS: от bleepingcomputer.
  
• След изтегляне на файла го запишете (бутон Save -> Save as) DDS на вашия десктоп, снимка:
  
  
• След като изтеглите DDS на десктопа, иконката на програмата би трябвало да изглежда така:
  
• Прекратете временно работата на всички скрипт блокиращи приложения, ако има такива или разрешете изпълнението на dds.scr. След това стартирайте DDS с двоен клик на иконката, като потвърдите с Run.
  
• След приключване на работата на DDS копирайте с Copy текста от двата файлови лога, които ще се появят в Notepad: DDS.txt и Attach.txt и ги запазете (бутон Save -> Save as) на десктопа. После прикачете двата лога към следващия си коментар по темата (погледнете опцията "прикачени файлове", когато публикувате мнение).
  

P.S. Малко по-късно може да ви поеме друг колега.

Attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 5/13/2010 6:53:22 PM

System Uptime: 5/13/2010 7:11:47 PM (1 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. | | nVidia-nForce2

Processor: AMD Sempron 2800+ | Socket A | 2004/182mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 6 GiB total, 2.93 GiB free.

D: is FIXED (NTFS) - 32 GiB total, 2.906 GiB free.

E: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description: Multimedia Audio Controller

Device ID: PCI\VEN_13F6&DEV_0111&SUBSYS_011113F6&REV_10\4&3B1D9AB8&0&5040

Manufacturer:

Name: Multimedia Audio Controller

PNP Device ID: PCI\VEN_13F6&DEV_0111&SUBSYS_011113F6&REV_10\4&3B1D9AB8&0&5040

Service:

==== System Restore Points ===================

RP1: 5/13/2010 7:07:48 PM - System Checkpoint

RP2: 5/13/2010 7:18:11 PM - Installed Realtek AC'97 Audio

==== Installed Programs ======================

Adobe Flash Player 10 Plugin

Adobe Reader 7.0.5

BitComet 1.20

Bulgarian Keyboards XP by G. Atanasov

foobar2000 v1.0.3

Malwarebytes' Anti-Malware

Microsoft Office Professional Edition 2003

mIRC

Mozilla Firefox (3.6.3)

NVIDIA Drivers

QuickTime Alternative 1.67

Realtek AC'97 Audio

Skype™ 3.5

Software Update for Web Folders

SpeedFan (remove only)

The KMPlayer (remove only)

VentriloMIX

WinRAR archiver

==== Event Viewer Messages From Past Week ========

5/13/2010 8:01:05 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 1 time(s).

5/13/2010 7:05:16 PM, error: Service Control Manager [7000] - The ms-tl service failed to start due to the following error: The system cannot find the file specified.

5/13/2010 7:04:08 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified procedure could not be found.

5/13/2010 7:04:08 PM, error: RemoteAccess [20002] - Cannot access registry key values.

5/13/2010 6:58:29 PM, information: Windows File Protection [64032] - Windows File Protection is not active on this system.

5/13/2010 6:53:32 PM, error: Setup [60055] - Windows Setup encountered non-fatal errors during installation. Please check the setuperr.log found in your Windows directory for more information.

==== End Of File ===========================

DDS.txt

DDS (Ver_10-03-17.01) - NTFSx86

Run by X at 20:52:30.93 on Thu 05/13/2010

Internet Explorer: 6.0.2900.2180

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.174 [GMT 1:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\foobar2000\foobar2000.exe

C:\Program Files\mIRC\mirc.exe

D:\Games\Steam\steam.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\system32\CTFMON.EXE

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\X\Desktop\dds.scr

============== Pseudo HJT Report ===============

uWindow Title = Service Pack 3 Internet Explorer

mWinlogon: SfcDisable=-99 (0xffffff9d)

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.4.1.27.dll

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

uRun: [ctfmon.exe] c:\windows\system32\CTFMON.EXE

mRun: [soundMan] SOUNDMAN.EXE

mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

dRunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"

dRunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe

IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm

IE: &D&ownload all video with BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm

IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm

IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office11\EXCEL.EXE/3000

IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.4.1.27.dll/206

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office11\REFIEBAR.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

IFEO: avcenter.e - ntsd -d

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\x\applic~1\mozilla\firefox\profiles\jwobbgae.default\

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [2010-5-13 16640]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-5-13 304464]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-5-13 20952]

=============== Created Last 30 ================

2010-05-13 19:37:14 7680 ----a-w- c:\windows\system32\kbdBF.dll

2010-05-13 19:37:14 6416 ----a-w- c:\windows\system32\kbdbd.dll

2010-05-13 19:31:35 0 d-----w- c:\windows\pss

2010-05-13 19:27:14 45 ----a-w- c:\windows\system32\initdebug.nfo

2010-05-13 19:27:14 0 d-----w- c:\program files\SpeedFan

2010-05-13 18:58:07 0 d-----w- c:\program files\Skype

2010-05-13 18:38:26 0 d-----w- c:\program files\common files\ODBC

2010-05-13 18:38:00 0 d-----r- c:\documents and settings\all users\Documents

2010-05-13 18:34:36 0 d-----w- c:\program files\VentriloMIX

2010-05-13 18:34:29 0 d-----w- c:\program files\mIRC

2010-05-13 18:24:29 0 d-----w- c:\docume~1\x\applic~1\Malwarebytes

2010-05-13 18:24:10 0 d-----w- c:\docume~1\x\applic~1\foobar2000

2010-05-13 18:24:06 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-05-13 18:24:05 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-05-13 18:22:42 0 d-----w- c:\docume~1\x\applic~1\BitComet

2010-05-13 18:19:06 0 d-----w- c:\program files\BitComet

2010-05-13 18:18:58 0 d-----w- c:\program files\The KMPlayer

2010-05-13 18:18:13 0 d-----w- c:\program files\Realtek AC97

2010-05-13 18:16:42 0 d-----w- c:\program files\foobar2000

2010-05-13 18:00:06 0 d-----w- c:\program files\Microsoft ActiveSync

2010-05-13 17:52:38 0 d-----w- c:\program files\QuickTime Alternative

2010-05-13 17:50:13 0 d-sh--w- c:\documents and settings\all users\DRM

2010-05-13 17:49:44 0 d--h--w- c:\program files\WindowsUpdate

2010-05-13 17:49:39 0 d-----w- c:\program files\Online Services

2010-05-13 17:49:00 0 d-----w- c:\program files\common files\MSSoap

2010-05-13 17:47:24 0 d-----w- c:\program files\Unlocker

2010-05-13 17:43:31 0 d-----w- c:\program files\MSN Messenger

2010-05-13 17:43:10 0 d-----w- c:\program files\Windows NT

==================== Find3M ====================

2010-05-13 18:41:24 54016 ----a-w- c:\windows\system32\drivers\stlweqg.sys

2010-05-13 17:52:37 2293 ----a-w- c:\windows\mozver.dat

2010-05-13 17:52:37 107132 ----a-w- c:\windows\UninstallFirefox.exe

2010-05-13 17:48:00 21640 ----a-w- c:\windows\system32\emptyregdb.dat

2010-04-29 14:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 14:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

============= FINISH: 20:52:43.84 ===============

Добре, сега ще проверим за скрити процеси, услуги и файлове с GMER. Ето как:

• Изтеглете този файл и го разархивирайте на десктопа.
  
• Временно спрете Интернет и всички работещи програми, както и антивирусната си програма (ако има такава).
  
• Преименувайте GMER.exe на Tool.exe и го стартирайте.
  Забележка: Сканирането може да доведе до грешки, затова не предприемайте никакви действия върху редовете маркирани с "<--- ROOKIT" без да имате инструкция за това.
  
• Ако бъде открит Rootkit, ще последва въпрос дали желаете пълно сканиране на системата. Изберете NO.
  
• В десния панел на програмата ще видите какво е проверено, но не променяйте нищо. Убедете се, че на Show All няма отметка.
  
• Маркирайте всички устройства: C:, D: и пр.
  
• Натиснете бутона Scan и изчакайте програмата да завърши сканирането.
  
• Когато завърши сканирането, натиснете бутона Save и запишете (save as) резултатите на десктопа с име: Results.log
  
• Вече можете да включите Интернет.
  
• Най-накрая прикачете Results.log към следващия си коментар по темата (погледнете опцията "прикачени файлове", когато публикувате мнение).
  

Готово.

1.zip

Може да пуснете един инструмент за почистване: PeeTechFix-Win32/PSW.OnlineGames 2.0.7 AVDB-075 & FixPacex.Gen. Ето как:

1.Разрхивирайте, после стартирайте приложението PeeTechFix-Win32.PSW.OnlineGames.

2.Рестартирайте.

P.S. Не забравяйте, че след това продължаваме.

Готово и с това, след рестарта сканирах отново с Malwarebytes и не намери нищо.

Много добре! Сега следвайте това, което е написано по-долу, стъпка по стъпка:

Стъпка 1

Следвайте следната инструкция за работа с TFC (програмата ще премахне ненужните временни файлове):

• Изтеглете TFC (Temp File Cleaner) от тук и го запишете на десктопа
  
• Стартирайте TFC.exe
  
• Имайте търпение и изчакайте програмата да завърши работата си
  
• Ако е необходимо, потвърдете с OK за рестартиране на Windows
  

Стъпка 2

Следвайте следната инструкция за работа с OTL:

• Изтеглете OTL.exe и го запазете на десктопа.
  
• Стартирайте файла с двукратен клик на мишката.
  
• Направете следните настройки:
  

• Под "Custom Scans/Fixes" с Copy/ Paste въведете следната информация от цитата по-долу:
  

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%SYSTEMDRIVE%\*.exe

%systemroot%\*. /mp /s

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

/md5start

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

sceclt.dll

ntelogon.dll

logevent.dll

iaStor.sys

nvstor.sys

atapi.sys

beep.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

ahcix86s.sys

KR10N.sys

nvstor32.sys

nvrd32.sys

explorer.exe

svchost.exe

userinit.exe

symmpi.sys

qmgr.dll

ws2_32.dll

proquota.exe

imm32.dll

kernel32.dll

ndis.sys

autochk.exe

spoolsv.exe

xmlprov.dll

ntmssvc.dll

mswsock.dll

ntfs.sys

tcpip.sys

termsrv.dll

sfcfiles.dll

st3shark.sys

srsvc.dll

adp3132.sys

mv61xx.sys

/md5stop

CREATERESTOREPOINT

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\drivers\*.sys /90

• Натиснете маркираният в синьо бутон: .
  
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt.
  

Стъпка 3

Прикачете в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение):

• Логовете от OTL: OTL.Txt, Extras.Txt
  

Готово.

Extras.Txt

OTL.Txt

Следва:

Стъпка 1

Стартирайте пак OTL.exe и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от цитата по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди OTL!

:OTL

O4 - HKU\S-1-5-19..\Run: [msnsc] C:\WINDOWS\System32\msnsc.exe File not found

O4 - HKU\S-1-5-20..\Run: [msnsc] C:\WINDOWS\System32\msnsc.exe File not found

O32 - AutoRun File - [2010.05.13 18:51:31 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

:commands

[purity]

[emptytemp]

[resethosts]

[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix. Ще се създаде лог файл.

Стъпка 2

Следвайте следната инструкция за проверка с ESET Online Scanner:

• Изтеглете: ESET Online Scanner
  
• Стартирайте esetsmartinstaller_enu.exe
  
• Сложете отметка на YES, I accept the Terms of Use и изберете Start
  
• Скенерът ще започне да изтегля компонентите, които са му необходими.
  
• Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:
  

• Remove found threats
  
  
• Scan archives
  
  
• Scan for potentially unwanted applications
  
  
• Scan for potentially unsafe applications
  
  
• Enable Anti-Stealth technology
  
  

• Накрая изберете Start
  
• Скенерът ще започне да изтегля последните дефиниции.
  
• След, като сканирането завърши, изберете Finish.
  
• Отидете в: C:\Program Files\ESET\ESET Online Scanner, отворете файла log.txt и го запишете на десктопа.
  

Стъпка 3

Прикачете в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение):

• Лог от OTL
  
• Лог от ESET Online Scanner
  

Ами проблема е, че скенера на ESET не успява да сканира всичко. 2 пъти заби на .bc! файл и един път на .html и чаках по 10-на минути, но не ги премина... Иначе ето логовете. До колкото виждам май, май повечето ми exe файлове са заразени.

05152010_095805.zip

log.zip

Хм, като гледам ESET Online Scanner е затрил доста зарази: Win32/AutoRun.NAT, Win32/PSW (WOW.NOJ, WOW.DZI, OnLineGames.OLE) и др. не само на системния дял, но и на другия. Ще помисля кой вариант е най-бърз и ефективен за действия по-нататък и ще пиша след час-два.

Имам въпрос. Защо използвате Windows XP SP2, като има по-нов сервизен пакет - Service Pack 3? Ще може ли един лог от ComboFix? Ето линк с инструкция: http://www.kaldata.com/forums/index.php?showtopic=154858&view=findpost&p=1699407

Използвайте Стъпка 2 от този коментар.

Еми, малко е сложно за обяснение, но :

Отккато си взех нова видеокарта преди около 2 години (7300GT) имам проблем със нея и по - точно драйверите. Какъвто и друг Windows да сложа след като инсталирам видео драйвери (от най - стари до най - нови версии) имам проблем със филми и по - стари игри. Във игрите имам бели линии (артефакти май се наричаха) навсякъде, а със видео-файлове с това, че не вървят, а само товарят на 100% процесора. Пробвал съм SP2, SP3, дори взех оригинален диск от един приятел и пак същото. И ъпдейтите съм пускал да видя дали няма някой фикс случайно и пак е същото. Единствено със някакъв странен модван Windows нямам проблем и предполагам е заради някой фикс в него, но никаква идея кой. След малко ще кача лога.

Ето лога.

ComboFix.txt

С този моднат Windows може да има проблем, ако трябва да възстановяваме системни файлове. Ще може ли да опитате ето това:

Следвайте следната инструкция за поправяне на системни файлове със SFC:

• Start и пишете долу в празното поле cmd
  
• В отворения прозорец (Command prompt) напишете: sfc /scannow и натиснете ENTER. Необходимо е да разполагате с инсталационен диск на Windows XP, който трябва да е поставен в CD/DVD устройството.
  
• След като програмата завърши работата си, в отвореното поле на командния прозорец копирайте и поставате следното:
  

  findstr /c:"[sR]" %windir%\logs\cbs\cbs.log >%userprofile%\Desktop\sfcdetails.txt

• Затворете командния прозорец (Command prompt).
  
• Отворете sfcdetails.txt с Notepad и поставете съдържанието му в следващия си коментар.
  

Получавам грешка след като нпиша "sfc /scannow"

http://pics.data.bg/zoom/shared/5ef42e06b91e7f722fa935b38a68702d

Мда. Това е малък проблем, ще се опитаме да пуснем SFC. Само за проба:

Start -> Run -> cmd -> пишете net start (за проверка дали услугата RPC е спряна, като след всяка команда има ENTER) -> после пишете net start rpcss -> и отново проверка с net start дали RPC е пусната. После пак пробвайте инструкцията за поправяне на системни файлове със SFC от по-горе.

Редактирано 16 май 201016 г. от nologo (преглед на промените)

Има ги след net start

Remote Procedure Call (RPC)

Remote Procedure Call (RPC) Locator

След net start rpcss :

The requested service has already been started.

И след sfc /scannow пак същата грешка.

Има още два начина да се подкара SFC.

• Ето един:
  Start - > Run -> regedit -> отивате до ключа:
  HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows NT\ CurrentVersion\ Winlogon
  После стойността за SFCDisable трябва да се постави на 0 (нула). Рестарт и проба с SFC.
  
  
• Ето още един начин:
  Използвайте инсталационен диск, като отидете в Recovery Console. Пишете: enable RpcSs SYSTEM_AUTO_START. После рестартирате (може да се наложат няколко рестартирания) и проба с SFC.
  

Друг вариант е да инсталирате Service Pack 3. Но след като имате проблем с него, няма как да продължим. Почистихме доста зарази, но с тях бяха изтрити доста файлове от легитимни приложения. Остава последно да направите Repair Install на Windows XP SP2. Но засега опитайте все пак да стартирате SFC...