Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

Вирус от facebook [РЕШЕН]

Последователи

4 август 201016 г.

Автор

Ето резултатите http://www.virustotal.com/ru/analisis/4450f2369b7a155180e126f00d322c67d79975913721e38525e7028fdb11fc48-1280272753

http://www.virustotal.com/ru/analisis/c18da95e9a5a6d193a0b46d4456a558b2a425c09cae5a58771edd2b3980c4827-1280911281

http://www.virustotal.com/ru/analisis/c20c4d1813e888efe5002f9e07777360fe14b6764f18cfafa7105cf6e2681b1e-1279770090

http://www.virustotal.com/ru/analisis/ad8425bb38a81cf4b4fdebb0d28d81c8ed5b984f33d9069390b172f27cd7040e-1271097584

Редактирано 4 август 201016 г. от lqlq94 (преглед на промените)

Отговори 52
Прегледи 7k
Създадено 16 г.16 г.
Последен отговор 16 г.16 г.

Потребители с най-много отговори

icotonev 26 поста
lqlq94 24 поста
B-boy/StyLe/ 1 пост
dimitrov09 1 пост

Най-популярни публикации

icotonev

4 август 201016 г.

Приятелю...вие сте изпълнили стандартен скрипт 3 ..след това се изпълнява аналогично и сандартен скрипт 2 и ще се генерир искания от мен лог..аз съм ви описъл всичко с думи и с шотове..!Сега внимателн
B-boy/StyLe/

4 август 201016 г.

Извинявам се на колегата, че се намесвам, но файла наистина се засича от MBAM като Trojan.Downloader...Вие едно и също лице ли сте с това тук А колкото до файла е публикуван тук и вече се лови...
icotonev

4 август 201016 г.

Не сме свършили ...бързо искаш да избягаш..... Но ако имаш работа може да продължим по късно или утре...?

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

4 август 201016 г.

Благодаря ...всичко е добре..!Кажи ми сега как чустваш системата си...Имаш ли проблеми..?

4 август 201016 г.

Автор

Сега е добре Мерси много ! Ако имам проблеми знам къде да пиша

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

4 август 201016 г.

Не сме свършили ...бързо искаш да избягаш..... Но ако имаш работа може да продължим по късно или утре...?

4 август 201016 г.

Автор

Нямам работа с какво ще продължим ?

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

4 август 201016 г.

AVZ, меню "Файл -- Выполнить скрипт" -- Копирате долунаписания скрипт-- Натиснете бутон "Запустить".

var

ICounter : Integer;


function IsFileBuldLow(VulnFileName: string; IMinVer: integer) : boolean;

var

ARes : string;

IPos, IBuild : Integer;

begin

  ARes := GetFileVersion(VulnFileName, 6);

  IPos := Pos('.', ARes);

  while IPos > 0 do

  begin

	Delete(ARes, 1, IPos);

	IPos := Pos('.', ARes);

  end;

  Result := False; 

  if ValidInt(ARes) then

  begin

	IBuild := StrToInt(ARes);

	if IBuild < IMinVer then

  	Result := True

  end;

end;



   AddToLog('Обнаружено уязвимостей: '+IntToStr(ICounter));

   SaveLog(GetAVZDirectory+'log\avz_log.txt');

   if FileExists(GetAVZDirectory+'log\avz_log.txt') then

 	AddToLog('Протокол сохранён в под-папке log')

   else

   begin

	SaveLog('c:\avz_log.txt');

	AddToLog('Протокол сохранён в файле c:\avz_log.txt');

   end;

  end;

end.

В резултат на изпълнението на скрипта в папка avz /log щесе генерира avz_log.txt Прикачете го в следващия си пост..! С този скрипт ще проверим стемата за потенциални уязвимости..!

4 август 201016 г.

Автор

Пак да спра интернета,антивирусната и защитната стена нали

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

4 август 201016 г.

Да...този скрипт става за секунди..!

4 август 201016 г.

Ето резултатите http://www.virustotal.com/ru/analisis/4450f2369b7a155180e126f00d322c67d79975913721e38525e7028fdb11fc48-1280272753

http://www.virustotal.com/ru/analisis/c18da95e9a5a6d193a0b46d4456a558b2a425c09cae5a58771edd2b3980c4827-1280911281

http://www.virustotal.com/ru/analisis/c20c4d1813e888efe5002f9e07777360fe14b6764f18cfafa7105cf6e2681b1e-1279770090

http://www.virustotal.com/ru/analisis/ad8425bb38a81cf4b4fdebb0d28d81c8ed5b984f33d9069390b172f27cd7040e-1271097584

Аз ще те помоля нещо...

Би ли ги архивирал тези файлове и ги качи в dox.bg и дай линк за сваляне.

Искам да ги пратя тук там за анализ!

4 август 201016 г.

Автор

Ето го резултата

avz_log.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

4 август 201016 г.

Предполагам прочете че имаш една потенциална уязвимост:

Adobe Acrobat Reader версии 9.2.0. +>>>>> необходимо е да обновиш до в.9.3

Има линк ....!

4 август 201016 г.

Автор

От официалния сайт със сигурност трябва да я обновя

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

4 август 201016 г.

Има линк ....!

Той е на официалния сайт само го копираш и обновяваш

4 август 201016 г.

Автор

Аз изтеглих ъпдейта от сайта и ся се ъпдейтва

Редактирано 4 август 201016 г. от lqlq94 (преглед на промените)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

4 август 201016 г.

http://get.adobe.com.../otherversions/ - ето....!

Изтеглете ComboFix от тук, тук или тук и го запазете на десктопа си.

1. Внимание!Задължително затворете браузера си,временно изключете антивирусната си програма,firewall и друг защитен софтуер.Не стартирайте други програми по време на работа на ComboFix.Combofix може да изключи интернета ви след известно време от началото на стартирането и.Не го включвайте докато Combofix не завърши работата си.Ако интернета не тръгне след завършване на сканирането,рестартирайте компютъра си.По време на работата на Combofix не натискайте бутоните на мишката,това може да стане причина Combofix да увисне.

2.Старирайте combofix.exe,и когат процесът на сканиране завърши,копирайте текста от C:\ComboFix.txt и го прикачете в следвашия си пост.

- ако ComboFix не се стартира преименувайте combofix.exe в combo-fix.exe.

Ще трябва да поизляза за малко ........по късно ще съм на линия....!

4 август 201016 г.

Автор

Ето го резултата : ComboFix 10-08-03.04 - Name 08.2010 г. 19:35:56.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.959.670 [GMT 3:00]

Running from: c:\documents and settings\Name\Desktop\ComboFix.exe

AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\program files\Search Settings

c:\program files\Search Settings\FF\chrome.manifest

c:\program files\Search Settings\FF\chrome\content\plugin.js

c:\program files\Search Settings\FF\chrome\content\plugin.xul

c:\program files\Search Settings\FF\chrome\content\protection.js

c:\program files\Search Settings\FF\chrome\content\utils.js

c:\program files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.dtd

c:\program files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.properties

c:\program files\Search Settings\FF\components\IFBHOSearch.xpt

c:\program files\Search Settings\FF\components\IFBHOSearchHelperEngine.xpt

c:\program files\Search Settings\FF\components\IFHelperPreferences.xpt

c:\program files\Search Settings\FF\components\SearchSettingsFF.dll

c:\program files\Search Settings\FF\install.rdf

c:\program files\Search Settings\SearchSettings.dll

c:\program files\Search Settings\SearchSettings.exe

c:\program files\Search Settings\SearchSettingsRes409.dll

c:\windows\system32\klipxm32.dll

c:\windows\system32\system

c:\windows\system32\system\AVICAP.DLL

c:\windows\system32\system\AVIFILE.DLL

c:\windows\system32\system\COMMDLG.DLL

c:\windows\system32\system\KEYBOARD.DRV

c:\windows\system32\system\LZEXPAND.DLL

c:\windows\system32\system\MCIAVI.DRV

c:\windows\system32\system\MCISEQ.DRV

c:\windows\system32\system\MCIWAVE.DRV

c:\windows\system32\system\MMSYSTEM.DLL

c:\windows\system32\system\MMTASK.TSK

c:\windows\system32\system\MOUSE.DRV

c:\windows\system32\system\MSVIDEO.DLL

c:\windows\system32\system\OLECLI.DLL

c:\windows\system32\system\OLESVR.DLL

c:\windows\system32\system\setup.inf

c:\windows\system32\system\SHELL.DLL

c:\windows\system32\system\SOUND.DRV

c:\windows\system32\system\stdole.tlb

c:\windows\system32\system\SYSTEM.DRV

c:\windows\system32\system\TAPI.DLL

c:\windows\system32\system\TIMER.DRV

c:\windows\system32\system\VER.DLL

c:\windows\system32\system\VGA.DRV

c:\windows\system32\system\WFWNET.DRV

c:\windows\system32\system\WINSPOOL.DRV

----- BITS: Possible infected sites -----

hxxp://au.download.windowsupdatej+|Cv+@J:NGD_DQ{zcxLJS@$OHR*?WU Client DownloadS-1-5-18`HT4?? 6VwoQZCDHM6VwoQZCDHMXu2222a>ycxLJS@GD_DQ{zGD_DQ{zGD_DQ{z+@J:Nj+|Cv

((((((((((((((((((((((((( Files Created from 2010-07-04 to 2010-08-04 )))))))))))))))))))))))))))))))

2010-08-04 13:53 . 2010-08-04 13:53 13312 ----a-w- c:\windows\system32\drivers\vdi2ndyw.sys

2010-08-04 09:51 . 2010-08-04 13:56 -------- d-----w- C:\avz4

2010-07-31 18:23 . 2010-08-01 19:41 -------- d-----w- c:\documents and settings\Name\Application Data\Artogon

2010-07-31 06:17 . 2010-07-31 06:17 -------- d-----w- c:\documents and settings\Name\Application Data\Adobe Mini Bridge CS5

2010-07-31 06:17 . 2010-07-31 06:17 -------- d-----w- c:\documents and settings\Name\Application Data\StageManager.BD092818F67280F4B42B04877600987F0111B594.1

2010-07-29 20:00 . 2010-07-29 20:00 -------- d-----w- C:\New Folder

2010-07-29 16:32 . 2010-07-29 16:32 160704 ----a-w- c:\windows\system32\drivers\afcdp.sys

2010-07-29 16:32 . 2010-07-29 16:32 911680 ----a-w- c:\windows\system32\drivers\tdrpm258.sys

2010-07-29 16:32 . 2010-07-29 16:32 581984 ----a-w- c:\windows\system32\drivers\timntr.sys

2010-07-29 16:32 . 2010-07-29 16:32 166272 ----a-w- c:\windows\system32\drivers\snapman.sys

2010-07-29 16:32 . 2010-07-29 16:32 -------- d-----w- c:\program files\Acronis

2010-07-29 16:32 . 2010-07-29 16:32 -------- d-----w- c:\program files\Common Files\Acronis

2010-07-29 07:03 . 2010-07-29 07:10 -------- d-----w- c:\documents and settings\All Users\Application Data\regid.1986-12.com.adobe

2010-07-29 06:57 . 2010-07-29 06:57 -------- d-----w- c:\program files\Adobe Media Player

2010-07-29 06:55 . 2010-07-29 06:55 -------- d-----w- c:\program files\Common Files\Adobe AIR

2010-07-28 08:39 . 2010-07-28 08:40 -------- d-----w- C:\wamp

2010-07-27 18:07 . 2010-07-27 18:07 -------- d-----w- c:\program files\Timed Shutdown

2010-07-27 09:25 . 2010-07-27 09:28 -------- d-----w- c:\documents and settings\Name\Application Data\Web Page Maker

2010-07-27 09:25 . 2010-07-27 09:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Web Page Maker

2010-07-27 09:24 . 2010-07-27 09:24 -------- d-----w- c:\program files\Web Page Maker

2010-07-25 13:35 . 2010-08-04 06:37 -------- d-----w- c:\documents and settings\Name\Application Data\PriceGong

2010-07-25 12:30 . 2010-07-25 12:31 -------- d-----w- c:\documents and settings\Name\Application Data\Notepad++

2010-07-25 12:30 . 2010-07-25 12:30 -------- d-----w- c:\program files\Notepad++

2010-07-21 08:32 . 2010-07-21 08:32 -------- d--h--w- c:\windows\PIF

2010-07-15 15:19 . 2010-07-15 15:19 -------- d-----w- c:\documents and settings\Name\Local Settings\Application Data\Help

2010-07-09 11:49 . 2010-04-12 14:29 411368 ----a-w- c:\windows\system32\deployJava1.dll

2010-07-07 16:01 . 2010-07-07 16:01 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2010-08-04 16:33 . 2010-05-19 04:31 -------- d-----w- c:\program files\Common Files\Akamai

2010-08-04 16:29 . 2010-06-17 16:35 -------- d-----w- c:\program files\YouTube Downloader Toolbar

2010-08-04 16:27 . 2010-04-14 11:42 -------- d-----w- c:\documents and settings\All Users\Application Data\BlazeVideo

2010-08-04 16:25 . 2010-01-19 08:50 -------- d-----w- c:\program files\Common Files\Adobe

2010-08-04 15:32 . 2010-01-19 08:52 -------- d-----w- c:\documents and settings\Name\Application Data\Skype

2010-08-04 15:15 . 2010-01-19 14:00 -------- d-----w- c:\documents and settings\Name\Application Data\skypePM

2010-08-04 06:38 . 2010-06-15 14:40 -------- d-----w- c:\program files\DVDVideoSoftTB

2010-08-03 11:49 . 2010-01-19 08:52 -------- d-----w- c:\documents and settings\Name\Application Data\uTorrent

2010-08-03 10:37 . 2010-01-19 08:54 -------- d-----w- c:\program files\Defraggler

2010-08-03 07:55 . 2010-06-06 18:33 -------- d-----w- c:\program files\AVS4YOU

2010-08-01 05:41 . 2010-01-19 08:53 -------- d-----w- c:\program files\uTorrent

2010-07-31 18:22 . 2010-01-19 08:03 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-07-29 07:09 . 2010-01-19 07:59 19536 ----a-w- c:\documents and settings\Name\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-10 16:35 . 2010-02-06 18:48 -------- d-----w- c:\program files\Tunatic

2010-07-09 12:29 . 2010-02-26 14:08 -------- d-----w- c:\program files\Cheat Engine

2010-07-09 11:49 . 2010-02-06 11:09 -------- d-----w- c:\program files\Java

2010-06-30 18:48 . 2010-01-19 08:44 -------- d-----w- c:\program files\K-Lite Codec Pack

2010-06-30 18:47 . 2010-03-31 13:58 -------- d-----w- c:\program files\Total Video Converter

2010-06-28 20:57 . 2010-06-29 09:48 38848 ----a-w- c:\windows\avastSS.scr

2010-06-28 20:57 . 2010-01-23 07:23 165032 ----a-w- c:\windows\system32\aswBoot.exe

2010-06-28 20:37 . 2010-01-23 07:23 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2010-06-28 20:37 . 2010-01-23 07:23 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys

2010-06-28 20:33 . 2010-01-23 07:23 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2010-06-28 20:32 . 2010-01-23 07:23 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2010-06-28 20:32 . 2010-01-23 07:23 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys

2010-06-28 20:32 . 2010-01-23 07:23 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2010-06-28 20:32 . 2010-01-23 07:23 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2010-06-27 08:35 . 2010-01-20 19:56 -------- d-----w- c:\documents and settings\Name\Application Data\TeamViewer

2010-06-27 05:22 . 2010-06-27 05:22 -------- d-----w- c:\program files\SystemRequirementsLab

2010-06-27 05:22 . 2010-06-27 05:22 85504 ----a-w- c:\documents and settings\Name\Application Data\SystemRequirementsLab\srlproxy_cyri_4.1.71.0A.dll

2010-06-27 05:22 . 2010-06-27 05:22 -------- d-----w- c:\documents and settings\Name\Application Data\SystemRequirementsLab

2010-06-22 19:52 . 2010-06-22 19:52 -------- dc----w- c:\documents and settings\All Users\Application Data\{8559AA91-0BFA-466B-9356-A5FBC7C0CEE9}

2010-06-22 19:52 . 2010-06-22 19:51 -------- d-----w- c:\documents and settings\All Users\Application Data\BearShare

2010-06-22 19:51 . 2010-06-22 19:51 -------- d-----w- c:\program files\BearShare Applications

2010-06-17 17:21 . 2010-06-17 17:21 -------- d-----w- c:\documents and settings\Name\Application Data\YouTube Downloader

2010-06-17 16:35 . 2010-03-14 19:44 -------- d-----w- c:\program files\Application Updater

2010-06-17 16:27 . 2010-06-17 16:27 -------- d-----w- c:\documents and settings\Name\Application Data\AVS4YOU

2010-06-17 16:27 . 2010-06-06 18:34 -------- d-----w- c:\program files\Common Files\AVSMedia

2010-06-17 05:22 . 2010-06-17 05:22 -------- d-----w- c:\documents and settings\Name\Application Data\Red Kawa

2010-06-17 05:18 . 2010-06-17 05:18 -------- d-----w- c:\program files\AviSynth 2.5

2010-06-17 05:18 . 2010-06-17 05:18 -------- d-----w- c:\program files\Red Kawa

2010-06-17 05:17 . 2010-06-01 06:56 -------- d-----w- c:\program files\MyPlayCity.com

2010-06-16 06:46 . 2010-06-22 19:52 3437949 -c--a-w- c:\documents and settings\All Users\Application Data\{8559AA91-0BFA-466B-9356-A5FBC7C0CEE9}\BearShare_V9_en_Setup.exe

2010-06-15 14:40 . 2010-06-15 14:40 -------- d-----w- c:\program files\Conduit

2010-06-15 14:40 . 2010-06-15 14:40 52224 ----a-w- c:\documents and settings\Name\Application Data\Mozilla\Firefox\Profiles\tcyrxj3g.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll

2010-06-15 14:40 . 2010-06-15 14:40 101376 ----a-w- c:\documents and settings\Name\Application Data\Mozilla\Firefox\Profiles\tcyrxj3g.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll

2010-06-15 13:52 . 2010-06-15 13:52 -------- d-----w- c:\documents and settings\Name\Application Data\DVDVideoSoftIEHelpers

2010-06-15 13:52 . 2010-06-15 13:52 -------- d-----w- c:\program files\Common Files\DVDVideoSoft

2010-06-15 13:52 . 2010-06-15 13:52 -------- d-----w- c:\program files\DVDVideoSoft

2010-06-14 14:31 . 2010-01-19 07:45 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2010-06-13 18:50 . 2010-06-13 18:50 -------- d-----w- c:\program files\musicjacker

2010-06-13 18:50 . 2010-06-13 18:50 -------- d-----w- c:\documents and settings\All Users\Application Data\musicjacker

2010-06-12 05:57 . 2010-06-12 05:57 -------- d-----w- c:\program files\Ubisoft

2010-06-10 17:11 . 2010-04-08 10:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-06-07 09:12 . 2010-06-07 09:12 -------- d-----w- c:\documents and settings\Name\Application Data\Media Player Classic

2010-06-06 19:50 . 2010-06-06 18:01 -------- d-----w- c:\program files\NCH Software

2010-06-06 19:49 . 2010-06-06 18:02 -------- d-----w- c:\documents and settings\Name\Application Data\NCH Swift Sound

2010-06-06 18:35 . 2010-06-06 18:35 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU

2010-06-06 18:03 . 2010-06-06 18:03 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Software

2010-06-06 18:03 . 2010-06-06 18:03 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Swift Sound

2010-06-03 05:28 . 2010-06-04 12:24 52224 ----a-w- c:\documents and settings\Name\Application Data\Mozilla\Firefox\Profiles\tcyrxj3g.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll

2010-06-03 05:28 . 2010-06-04 12:24 101376 ----a-w- c:\documents and settings\Name\Application Data\Mozilla\Firefox\Profiles\tcyrxj3g.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll

2010-05-22 06:14 . 2010-05-22 06:14 503808 ----a-w- c:\documents and settings\Name\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-137c21a7-n\msvcp71.dll

2010-05-22 06:14 . 2010-05-22 06:14 499712 ----a-w- c:\documents and settings\Name\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-137c21a7-n\jmc.dll

2010-05-22 06:14 . 2010-05-22 06:14 348160 ----a-w- c:\documents and settings\Name\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-137c21a7-n\msvcr71.dll

2010-05-22 06:14 . 2010-05-22 06:14 61440 ----a-w- c:\documents and settings\Name\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-269c557c-n\decora-sse.dll

2010-05-22 06:14 . 2010-05-22 06:14 12800 ----a-w- c:\documents and settings\Name\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-269c557c-n\decora-d3d.dll

------- Sigcheck -------

[-] 2007-08-28 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVD1.dll" [2010-08-04 2736736]

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

2010-08-04 06:38 2736736 ----a-w- c:\program files\DVDVideoSoftTB\tbDVD1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVD1.dll" [2010-08-04 2736736]

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\tbDVD1.dll" [2010-08-04 2736736]

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-01 15872]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-10-10 7286784]

"nwiz"="nwiz.exe" [2005-10-10 1519616]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-10-10 86016]

"SoundMan"="SOUNDMAN.EXE" [2005-09-22 90112]

"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]

"Domino"="c:\windows\Domino.exe" [2006-08-18 49152]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

"TrueImageMonitor.exe"="d:\acronis true image home 13\TrueImageMonitor.exe" [2010-03-27 5107232]

"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2010-03-27 362232]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_3"="advpack.dll" [2008-04-14 99840]

"_nltide_3"="advpack.dll" [2008-04-14 99840]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2010-1-19 95232]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoSMMyPictures"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"NoSMMyPictures"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^Name^Start Menu^Programs^Startup^Ubisoft register.lnk]

backup=c:\windows\pss\Ubisoft register.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 10:42 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Opera\\opera.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"d:\\Counter-Strike 1.6 Sector Edition\\cstrike.exe"=

"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=

"d:\\Garena\\Garena.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"d:\\Counter-Strike 1.6 Sector Edition\\hl.exe"=

"d:\\Counter-Strike 1.6 Sector Edition\\hlds.exe"=

"c:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=

"c:\\Documents and Settings\\Name\\temp\\TeamViewer\\Version5\\TeamViewer.exe"=

"d:\\CS 1.6 Sector Edition (2)\\Counter-Strike 1.6 Sector Edition\\cstrike.exe"=

"c:\\Documents and Settings\\Name\\My Documents\\Изтегляния\\PIC6777658898-JPG-www.facebook.com"= c:\\WINDOWS\\jusched.exe

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 tdrpman258;Acronis Try&Decide and Restore Points filter (build 258);c:\windows\system32\drivers\tdrpm258.sys [29.7.2010 і. 19:32 911680]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [23.1.2010 і. 10:23 165456]

R2 afcdpsrv;Acronis Nonstop Backup service;c:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [29.7.2010 і. 19:32 2480048]

R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [14.4.2008 і. 04:42 14336]

R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [19.2.2010 і. 19:43 380928]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [23.1.2010 і. 10:23 17744]

R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [19.1.2010 і. 11:42 38144]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [08.4.2010 і. 13:45 304464]

R3 afcdp;afcdp;c:\windows\system32\drivers\afcdp.sys [29.7.2010 і. 19:32 160704]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [08.4.2010 і. 13:45 20952]

R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);c:\windows\system32\drivers\RMSPPPOE.SYS [19.1.2010 і. 12:02 33792]

S3 ESLvnic1;ESLvnic Virtual Network 32 Bit;c:\windows\system32\drivers\ESLvnic.sys [07.2.2010 і. 09:58 24504]

S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\Name\LOCALS~1\Temp\QLX40A.tmp --> c:\docume~1\Name\LOCALS~1\Temp\QLX40A.tmp [?]

S3 GenericMount;Generic Mount Driver;c:\windows\system32\DRIVERS\GenericMount.sys --> c:\windows\system32\DRIVERS\GenericMount.sys [?]

S3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys --> c:\windows\system32\DRIVERS\RTL8187B.sys [?]

S3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 і. 13:37 517096]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.1.2010 і. 11:09 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai REG_MULTI_SZ Akamai

Contents of the 'Scheduled Tasks' folder

2010-07-29 c:\windows\Tasks\AdobeAAMUpdater-1.0-HOME-D066107554-Name.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2010-07-29 00:44]

------- Supplementary Scan -------

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

IE: Free YouTube to Mp3 Converter - c:\documents and settings\Name\Application Data\DVDVideoSoftIEHelpers\youtubetomp3.htm

FF - ProfilePath - c:\documents and settings\Name\Application Data\Mozilla\Firefox\Profiles\tcyrxj3g.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/

FF - prefs.js: network.proxy.type - 0

FF - component: c:\documents and settings\Name\Application Data\Mozilla\Firefox\Profiles\tcyrxj3g.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll

FF - component: c:\documents and settings\Name\Application Data\Mozilla\Firefox\Profiles\tcyrxj3g.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

FF - user.js: network.proxy.type - 0

FF - user.js: network.proxy.http -

user_pref(network.proxy.http_port,);

FF - user.js: network.proxy.no_proxies_on -

FF - user.js: browser.sessionstore.resume_from_crash - false

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

AddRemove-LVSMU_S3_EP1 - d:\muuuuuuuuuuu\Uninstal.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-08-04 19:40

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]

"ImagePath"="\??\c:\docume~1\Name\LOCALS~1\Temp\QLX40A.tmp"

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

Completion time: 2010-08-04 19:42:31

ComboFix-quarantined-files.txt 2010-08-04 16:42

Pre-Run: 3 533 856 768 bytes free

Post-Run: 3 603 300 352 bytes free

- - End Of File - - 047027612DC757ABBC33B398DC8B6F1D

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

5 август 201016 г.

Здравей..!

Копирайте текста в карето на notepad и го запазваш с име CFScript.txt на десктопа си:


KillAll::

Folder::

c:\program files\Conduit

Registry::

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"=-

[-HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"=-

[-HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"=-

[-HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\standardprofile\AuthorizedApplications\List]

"c:\\Documents and Settings\\Name\\My Documents\\Изтегляния\\PIC6777658898-JPG-www.facebook.com"=-

DDS::

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050

Firefox::

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}

След съхранението премести CFScript.txt на иконата на ComboFix.exe

Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост. :hit:

5 август 201016 г.

Автор

Ето го резултата

ComboFix.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

5 август 201016 г.

Всичко е наред..!Деинсталирайте Combofix така:

Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

Изтеглете OTCleanIt или от тук,стартирайте и натиснете Clean up

AVZ, меню "Файл -- Выполнить скрипт" -- Копирате долунаписания скрипт-- Натиснете бутон "Запустить".

begin

ExecuteStdScr(6);

RebootWindows(true);

end.

Изтеглете TFC (Temp File Cleaner) от тук и го запишете на десктопа

Стартирайте TFC.exe

Имайте търпение и изчакайте програмата да завърши работата си

Ако е необходимо, потвърдете с OK за рестартиране на Windows.

Иатрийте всички останало което ползвахме за лечението ръчно..с изключение на MBAM.Тя допълва другите програми за сигурност и периодически е хубаво да сканирате с нея.

Как чуствате системата си сега...?Някъкви проблеми..?

5 август 201016 г.

Автор

Системата я чувствам добре но трябва ли да се притеснявам че като покаже "добре дошли" спира на него и трябва да чакам поне 10секунди докато зареди ?

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

5 август 201016 г.

За сега не но май ще е неоходимо да направим една проверка на системните файлове:

START ==> Run ==> cmd ==> sfc /scannow

Възможно е да поиска инсталационен диск на вашата ОС..!

5 август 201016 г.

Автор

Е аз като нямам такъв диск Да зема ли това да го запиша на диск http://www.kaldata.com/modules.php?modid=1&action=show&id=1328 ?

Редактирано 5 август 201016 г. от lqlq94 (преглед на промените)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

5 август 201016 г.

Направи сканирането без диск ....когато потърси някой файл му давай да продължи.....да видим този много малък проблем -ако това въобще е проблем- дали ще се реши..... :cool:

5 август 201016 г.

Автор

Еми като прескачам файловете като давах на "Cancel" постоянно и цъках "Да" като гледах доста бавно става поне 30минути ще трябва да си играя сигурно ще трябва да направя това което писах в горния пост ? Или не сте съгласен ?