Заразен компютър.Не може да се свали нищо антивирусно, защитната стена не работи

9 август 201016 г.

Значи на един приятел(БГ) му се е заразил компа.Казах му да свали мауеър байтс , ама го изхвърля от страницата.Защитната стена не работи, използва AVG 7.5 , уни хр .Това е всичко което мога да ви дам, той не знае повече...Едвам го накарах да каже това което написах...Ако знаех повече да напиша ...да , ама не .

9 август 201016 г.

свалете и запишете на диск този образ и успех Kaspersky Rescue Disk

9 август 201016 г.

Привет, ФодоР. Остави засега Kaspersky Rescue Disk. По-нататък може да се наложи да се използва. Кажи на твоя приятел да сканира и да ти изпрати лог от ComboFix. Ето инструкция:

1. Изтеглете ComboFix от следните миръри: от тук: или от тук: .

След изтегляне на файла го запишете (бутон Save -> Save as) ComboFix на вашия десктоп, снимка:

След като изтеглите ComboFix на десктопа, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения или отворени прозорци. Прекратете временно работата на антивирусната програма и на други програми за сигурност, ако има такива. За целта може да прегледате информацията от този линк: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

3. Преименувайте ComboFix.exe на ff1.exe

4. Стартирайте с двоен клик ff1.exe. За целта използвайте YES, за да се съгласите с условията за използване на програмата.

Важно: след като се стартира ComboFix не бива да се движи мишката или да се кликва върху отворения прозорец на програмата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

5. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката, моля да прочетете това: Manually restoring the Internet connection section.

Забележка: При проблеми с ComboFix копирайте (Copy) и поставете (Paste) съдържанието на C:\BUG.txt в следващия си коментар.

6. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad, виж снимката:

Копирайте (Copy) и поставете (Paste) съдържанието на лога в следващия си коментар.

9 август 201016 г.

ФодоР, ако твоят приятел не може да пусне ComboFix, нека да пробва предложението на gaffer. Пиши за резултата.

P.S. Отново едно и също, току-що изтрих поредния офтопик. За не знам кой път предупреждавам потребителите на форума да се съобразяват с правилата на този раздел и по-точно с ето това:

2. Не пишете в чужда тема, а само във вашата.
5. Всички коментари и съвети за работа със специализирани инструменти за отстраняване на зловреден код, както и за инсталация или преинсталация на операционна система, които не са дадени от членовете на HJT Team се изтриват без предупреждение.

Всяко мнение извън тези правила заминава в коша!

9 август 201016 г.

Автор

Combofix:

ComboFix 10-08-08.02 - -- 9.08.2010   16:39:07.1.1 - x86

Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.447.192 [GMT 3:00]

Running from: c:\documents and settings\--\Desktop\ComboFix.exe

AV: AVG 7.5.560 *On-access scanning enabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}

.


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.


C:\autorun.inf

c:\docume~1\--\LOCALS~1\Temp\tkavedpgtjwmepiv.exe

c:\docume~1\--\LOCALS~1\Temp\uohfrticslbupdzprdy.exe

c:\documents and settings\--\Application Data\.#

c:\documents and settings\--\Application Data\.#\MBX@944@3587E0.###

c:\documents and settings\--\Recent\%C4%E8%F0%E5%EA%F2%EE%F0%E8-purataa-%D1%EE%F4%E8 %CC%E0%F0%E8%ED%EE%E2%E0.url

c:\documents and settings\All Users\Application Data\Toolbar4

c:\documents and settings\All Users\Start Menu\HP Image Zone .lnk

C:\jsanofjs.bat

C:\lykbgbjwfram.bat

c:\progra~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

c:\program files\FunWebProducts

c:\program files\FunWebProducts\Shared\005B7266.dat

c:\program files\FunWebProducts\Shared\Cache\CursorManiaBtn.html

c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html

c:\program files\MyWebSearch

c:\program files\MyWebSearch\bar\1.bin\CHROME.MANIFEST

c:\program files\MyWebSearch\bar\1.bin\chrome\M3FFXTBR.JAR

c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG

c:\program files\MyWebSearch\bar\1.bin\F3CJpeg.dll

c:\program files\MyWebSearch\bar\1.bin\F3DTactl.dll

c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL

c:\program files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL

c:\program files\MyWebSearch\bar\1.bin\F3HTmlmu.dll

c:\program files\MyWebSearch\bar\1.bin\F3HTtpct.dll

c:\program files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL

c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL

c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR

c:\program files\MyWebSearch\bar\1.bin\F3REGHK.DLL

c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL

c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL

c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE

c:\program files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL

c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV

c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT

c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL

c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG

c:\program files\MyWebSearch\bar\1.bin\INSTALL.RDF

c:\program files\MyWebSearch\bar\1.bin\M3AUXSTB.DLL

c:\program files\MyWebSearch\bar\1.bin\M3DLGHK.DLL

c:\program files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE

c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL

c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL

c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE

c:\program files\MyWebSearch\bar\1.bin\M3MEDINT.EXE

c:\program files\MyWebSearch\bar\1.bin\M3MSG.DLL

c:\program files\MyWebSearch\bar\1.bin\M3OUtlcn.dll

c:\program files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL

c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL

c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE

c:\program files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE

c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE

c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL

c:\program files\MyWebSearch\bar\1.bin\MWSMLBTN.DLL

c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL

c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL

c:\program files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL

c:\program files\MyWebSearch\bar\1.bin\MWSSVC.EXE

c:\program files\MyWebSearch\bar\1.bin\MWSUABTN.DLL

c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL

c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S

c:\program files\MyWebSearch\bar\Cache\0002BF3F

c:\program files\MyWebSearch\bar\Cache\00566EA5.bin

c:\program files\MyWebSearch\bar\Cache\00567201.bin

c:\program files\MyWebSearch\bar\Cache\0056751E.bin

c:\program files\MyWebSearch\bar\Cache\00568327.bin

c:\program files\MyWebSearch\bar\Cache\03035FDC.bin

c:\program files\MyWebSearch\bar\Cache\03038259.bin

c:\program files\MyWebSearch\bar\Cache\030382C6.bin

c:\program files\MyWebSearch\bar\Cache\03038314.bin

c:\program files\MyWebSearch\bar\Cache\files.ini

c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S

c:\program files\MyWebSearch\bar\Game\CHESS.F3S

c:\program files\MyWebSearch\bar\Game\REVERSI.F3S

c:\program files\MyWebSearch\bar\History\search3

c:\program files\MyWebSearch\bar\icons\CM.ICO

c:\program files\MyWebSearch\bar\icons\MFC.ICO

c:\program files\MyWebSearch\bar\icons\PSS.ICO

c:\program files\MyWebSearch\bar\icons\SMILEY.ICO

c:\program files\MyWebSearch\bar\icons\WB.ICO

c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO

c:\program files\MyWebSearch\bar\Message\COMMON.F3S

c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S

c:\program files\MyWebSearch\bar\Notifier\DOG.F3S

c:\program files\MyWebSearch\bar\Notifier\FISH.F3S

c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S

c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S

c:\program files\MyWebSearch\bar\Notifier\MAID.F3S

c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S

c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S

c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S

c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S

c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S

c:\program files\MyWebSearch\bar\Settings\prevcfg2.htm

c:\program files\MyWebSearch\bar\Settings\s_pid.dat

c:\program files\MyWebSearch\bar\Settings\setting2.htm

c:\program files\MyWebSearch\bar\Settings\settings.dat

c:\program files\RelevantKnowledge

c:\program files\RelevantKnowledge\install.rdf

c:\program files\RelevantKnowledge\rlls(2).dll

c:\program files\RelevantKnowledge\rloci.bin

C:\teodgzfqxh.bat

c:\windows\asjfppcuiznexjdrr.exe

c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf

c:\windows\hcwvilbwnhysodaruhdy.exe

c:\windows\jcurcdrkzrgysfapqb.exe

c:\windows\nkghwbtqjfyusjibgvtqmn.exe

c:\windows\system32\asjfppcuiznexjdrr.exe

c:\windows\system32\f3PSSavr.scr

c:\windows\tkavedpgtjwmepiv.exe

c:\windows\uohfrticslbupdzprdy.exe

c:\windows\wsnnbfwskfxspfdvznkgb.exe

D:\autorun.inf

D:\jsanofjs.bat

D:\lykbgbjwfram.bat

D:\teodgzfqxh.bat


.

(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.


-------\Legacy_MYWEBSEARCHSERVICE

-------\Service_MyWebSearchService



(((((((((((((((((((((((((   Files Created from 2010-07-09 to 2010-08-09  )))))))))))))))))))))))))))))))

.


2018-02-06 09:58 . 2018-02-06 09:58	--------	d-----w-	c:\documents and settings\All Users\Application Data\ESET

2018-02-06 08:27 . 2018-02-06 13:11	--------	d-----w-	c:\documents and settings\--\Local Settings\Application Data\AskToolbar

2018-02-06 08:27 . 2018-02-06 08:27	--------	d-----w-	c:\program files\Ask.com

2018-02-06 08:26 . 2010-08-09 13:50	--------	d-----w-	c:\documents and settings\--\Application Data\uTorrent

2018-02-06 08:14 . 2010-07-31 09:33	--------	d-----w-	c:\documents and settings\All Users\Application Data\Alwil Software

2010-08-09 13:47 . 2010-08-09 13:49	577536	--sh--r-	c:\windows\hcwvilbwnhysodaruhdy.exe

2010-08-09 13:47 . 2010-08-09 13:49	577536	--sh--r-	c:\windows\asjfppcuiznexjdrr.exe

2010-08-09 13:47 . 2010-08-09 13:48	577536	----a-w-	c:\windows\system32\asjfppcuiznexjdrr.exe

2010-08-09 12:58 . 2010-08-09 12:58	--------	d-----w-	c:\documents and settings\All Users\Application Data\Awem

2010-08-09 12:57 . 2010-08-09 12:57	--------	d-----w-	c:\program files\Cradle Of Persia

2010-08-09 11:59 . 2010-08-09 12:13	--------	d-----w-	c:\documents and settings\--\Application Data\TeamViewer

2010-08-09 11:58 . 2010-08-09 11:58	--------	d-----w-	c:\program files\TeamViewer

2010-08-09 08:14 . 2010-08-09 08:18	--------	d-----w-	c:\program files\Roadworks Simulator

2010-08-08 22:28 . 2010-08-08 22:29	--------	d-----w-	c:\windows\system32\NtmsData

2010-08-07 12:27 . 2010-08-09 13:48	577536	--sh--r-	c:\windows\system32\nkghwbtqjfyusjibgvtqmn.exe

2010-08-07 12:27 . 2010-08-09 13:48	577536	--sh--r-	c:\windows\system32\wsnnbfwskfxspfdvznkgb.exe

2010-08-07 12:27 . 2010-08-09 13:47	577536	--sh--r-	c:\windows\system32\uohfrticslbupdzprdy.exe

2010-08-07 12:27 . 2010-08-09 13:47	577536	--sh--r-	c:\windows\system32\jcurcdrkzrgysfapqb.exe

2010-08-07 12:27 . 2010-08-09 13:47	577536	--sh--r-	c:\windows\system32\hcwvilbwnhysodaruhdy.exe

2010-08-07 12:27 . 2010-08-09 13:47	577536	--sh--r-	c:\windows\system32\tkavedpgtjwmepiv.exe

2010-08-07 09:04 . 2010-08-07 09:04	--------	d-----w-	c:\documents and settings\--\Application Data\UseNeXT

2010-08-07 07:38 . 2010-08-07 07:38	--------	d-----w-	c:\windows\system32\XPSViewer

2010-08-07 07:38 . 2010-08-07 07:38	--------	d-----w-	c:\program files\MSBuild

2010-08-07 07:38 . 2010-08-07 07:38	--------	d-----w-	c:\program files\Reference Assemblies

2010-08-07 07:37 . 2008-07-06 12:06	89088	----a-w-	c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll

2010-08-07 07:36 . 2008-07-06 12:06	89088	-c----w-	c:\windows\system32\dllcache\filterpipelineprintproc.dll

2010-08-07 07:36 . 2008-07-06 12:06	117760	------w-	c:\windows\system32\prntvpt.dll

2010-08-07 07:36 . 2008-07-06 12:06	575488	-c----w-	c:\windows\system32\dllcache\xpsshhdr.dll

2010-08-07 07:36 . 2008-07-06 12:06	575488	------w-	c:\windows\system32\xpsshhdr.dll

2010-08-07 07:36 . 2008-07-06 10:50	597504	-c----w-	c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2010-08-07 07:36 . 2008-07-06 10:50	597504	------w-	c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe

2010-08-07 07:36 . 2008-07-06 12:06	1676288	-c----w-	c:\windows\system32\dllcache\xpssvcs.dll

2010-08-07 07:36 . 2008-07-06 12:06	1676288	------w-	c:\windows\system32\xpssvcs.dll

2010-08-06 11:49 . 2010-08-06 11:49	--------	d-----w-	c:\documents and settings\--\Application Data\RigNRoll_eng

2010-08-06 11:48 . 2010-08-06 11:48	413696	----a-w-	c:\windows\system32\wrap_oal.dll

2010-08-06 11:48 . 2010-08-06 11:48	110592	----a-w-	c:\windows\system32\OpenAL32.dll

2010-08-06 11:48 . 2010-08-06 11:48	--------	d-----w-	c:\program files\OpenAL

2010-08-06 08:01 . 2010-06-14 14:31	744448	-c----w-	c:\windows\system32\dllcache\helpsvc.exe

2010-07-31 09:26 . 2010-08-09 07:35	--------	d-----w-	c:\documents and settings\--\Application Data\AVG7

2010-07-31 09:25 . 2010-07-31 09:25	--------	d-----w-	c:\documents and settings\LocalService\Application Data\AVG7

2010-07-31 09:25 . 2010-08-08 05:47	10760	----a-w-	c:\windows\system32\drivers\avgclean.sys

2010-07-31 09:25 . 2010-08-08 05:47	26952	----a-w-	c:\windows\system32\drivers\avgmfx86.sys

2010-07-31 09:25 . 2010-07-31 09:25	4960	----a-w-	c:\windows\system32\drivers\avgtdi.sys

2010-07-31 09:25 . 2010-07-31 09:25	4224	----a-w-	c:\windows\system32\drivers\avg7rsw.sys

2010-07-31 09:25 . 2010-07-31 09:25	27776	----a-w-	c:\windows\system32\drivers\avg7rsxp.sys

2010-07-31 09:25 . 2010-08-08 05:47	821856	----a-w-	c:\windows\system32\drivers\avg7core.sys

2010-07-31 09:25 . 2010-08-09 12:03	--------	d-----w-	c:\documents and settings\All Users\Application Data\avg7

2010-07-31 09:25 . 2010-07-31 09:25	--------	d-----w-	c:\documents and settings\All Users\Application Data\Grisoft

2010-07-30 12:15 . 2010-07-30 12:15	--------	d-----w-	c:\documents and settings\--\Application Data\catalyst

2010-07-29 18:50 . 2010-07-29 18:50	--------	d-----w-	c:\program files\SkyCode

2010-07-16 07:18 . 2010-07-16 07:18	--------	d-----w-	c:\windows\system32\wbem\Repository


.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2018-07-23 04:15 . 2018-07-23 04:15	501936	----a-w-	c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb4.tmp.exe

2018-02-06 13:10 . 2010-01-24 12:02	--------	d-----w-	c:\program files\McAfee Security Scan

2010-08-09 13:53 . 2010-08-07 12:28	2408	---h--w-	c:\program files\oalbfzgsalterxltnreqbrvpwiqbjuhnb.dhu

2010-08-09 13:53 . 2010-08-07 12:28	280	---h--w-	c:\program files\yabhblikijhilhljtnqstzt.aca

2010-08-09 13:52 . 2010-08-07 12:28	316	---h--w-	c:\program files\laoholvkvjuiyhyjgndsgzgdncnbmaqzqbyf.kyr

2010-08-09 13:52 . 2010-08-09 13:49	577536	--sh--r-	c:\windows\nkghwbtqjfyusjibgvtqmn.exe

2010-08-09 13:52 . 2010-08-09 13:49	577536	--sh--r-	c:\windows\wsnnbfwskfxspfdvznkgb.exe

2010-08-09 13:52 . 2010-08-09 13:49	577536	--sh--r-	c:\windows\uohfrticslbupdzprdy.exe

2010-08-09 13:51 . 2010-08-09 13:49	577536	--sh--r-	c:\windows\jcurcdrkzrgysfapqb.exe

2010-08-09 13:51 . 2010-08-09 13:49	577536	--sh--r-	c:\windows\tkavedpgtjwmepiv.exe

2010-08-09 13:51 . 2009-09-09 14:24	--------	d-----w-	c:\documents and settings\--\Application Data\Skype

2010-08-09 13:50 . 2010-02-28 08:58	--------	d-----w-	c:\program files\Common Files\Akamai

2010-08-09 07:37 . 2010-08-09 07:37	9216	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgwlntf.dll

2010-08-09 07:37 . 2010-08-09 07:37	24328	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgtdiit.sys

2010-08-09 07:37 . 2010-08-09 07:37	24064	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgwlx64.dll

2010-08-09 07:37 . 2010-08-09 07:37	17928	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgclnit.sys

2010-08-09 07:37 . 2010-08-09 07:37	16136	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgtdi64.sys

2010-08-09 07:37 . 2010-08-09 07:37	13832	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgcln64.sys

2010-08-09 07:37 . 2010-08-09 07:37	40448	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgwli64.dll

2010-08-09 07:37 . 2009-09-09 14:26	--------	d-----w-	c:\documents and settings\--\Application Data\skypePM

2010-08-09 07:37 . 2010-08-09 07:37	121352	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgwsc.exe

2010-08-09 07:36 . 2010-08-09 07:36	36352	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgsea64.dll

2010-08-08 15:30 . 2010-02-27 12:11	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard

2010-08-08 05:47 . 2010-08-08 05:45	389632	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgvv.exe

2010-08-08 05:47 . 2010-08-08 05:45	1282560	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgres.dll

2010-08-08 05:47 . 2010-08-08 05:45	510976	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avginet.exe

2010-08-08 05:47 . 2010-08-08 05:45	131072	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avginet.dll

2010-08-08 05:47 . 2010-08-08 05:44	582656	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgcckrn.dll

2010-08-08 05:47 . 2010-08-08 05:44	579072	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgcc.exe

2010-08-08 05:47 . 2010-08-08 05:44	435712	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgabout.dll

2010-08-08 05:47 . 2010-08-08 05:44	905728	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgctrl.dll

2010-08-08 05:46 . 2010-08-08 05:45	620032	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgupd.dll

2010-08-07 12:28 . 2010-08-07 12:28	73	---h--w-	c:\program files\oetnvteugvhwnxpbzhyodxfdoeqfrgxhzljri.nhp

2010-08-07 12:28 . 2010-08-07 12:28	4248	---h--w-	c:\program files\lykbgbjwframahwfaftgsjojrenziuipen.nbo

2010-08-07 08:14 . 2009-09-09 11:17	74728	----a-w-	c:\documents and settings\--\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-29 21:37 . 2009-09-09 10:59	--------	d--h--w-	c:\program files\InstallShield Installation Information

2010-06-14 14:31 . 2009-09-09 10:44	744448	----a-w-	c:\windows\pchealth\helpctr\binaries\helpsvc.exe

.


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4


[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}"= "c:\program files\Softonic-Eng7\tbSof1.dll" [2010-05-24 2515552]

"{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce}"= "c:\program files\OnRPG\tbOnR1.dll" [2010-05-28 2515552]


[HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]


[HKEY_CLASSES_ROOT\clsid\{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce}]


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]

2010-05-24 13:33	2515552	----a-w-	c:\program files\Softonic-Eng7\tbSof1.dll


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce}]

2010-05-28 09:34	2515552	----a-w-	c:\program files\OnRPG\tbOnR1.dll


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2009-09-02 12:56	1175944	----a-w-	c:\program files\Ask.com\GenericAskToolbar.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-09-02 1175944]

"{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}"= "c:\program files\Softonic-Eng7\tbSof1.dll" [2010-05-24 2515552]

"{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce}"= "c:\program files\OnRPG\tbOnR1.dll" [2010-05-28 2515552]


[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]


[HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]


[HKEY_CLASSES_ROOT\clsid\{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce}]


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-09 39408]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-14 482760]

"DAEMON Tools"="c:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-14 482760]

"uTorrent"="d:\utorrent\uTorrent.exe" [2010-05-17 322352]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]

"jsanofjs"="tkavedpgtjwmepiv.exe" [2010-08-09 577536]

"wchrp"="c:\docume~1\--\LOCALS~1\Temp\tkavedpgtjwmepiv.exe" [2010-08-09 577536]


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"akthjbgqw"="hcwvilbwnhysodaruhdy.exe ." [X]

"houfet"="c:\docume~1\--\LOCALS~1\Temp\hcwvilbwnhysodaruhdy.exe" [2010-08-09 577536]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]

"VTTimer"="VTTimer.exe" [2005-03-07 53248]

"VTTrayp"="VTtrayp.exe" [2005-08-03 163840]

"RaidTool"="c:\program files\VIA\RAID\raid_tool.exe" [2005-06-20 1056768]

"SoundMan"="SOUNDMAN.EXE" [2005-07-22 81920]

"WinampAgent"="c:\program files\Winamp\Winampa.exe" [2003-04-02 12288]

"QuickTime Task"="c:\windows\system32\qttask.exe" [2009-09-09 98304]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"VVSN"="c:\program files\VVSN\VVSN.exe" [2005-10-25 107520]

"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-12-06 122368]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]

"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2010-08-09 590848]

"wchrp"="jcurcdrkzrgysfapqb.exe" [2010-08-09 577536]

"oalbfzgsalt"="c:\docume~1\--\LOCALS~1\Temp\hcwvilbwnhysodaruhdy.exe" [2010-08-09 577536]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"houfet"="jcurcdrkzrgysfapqb.exe ." [X]

"teodgzfqxh"="c:\docume~1\--\LOCALS~1\Temp\jcurcdrkzrgysfapqb.exe" [2010-08-09 577536]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2010-08-08 219136]


[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]

"ucjvvlo"="tkavedpgtjwmepiv.exe" [2010-08-09 577536]

"nswf"="c:\docume~1\--\LOCALS~1\Temp\wsnnbfwskfxspfdvznkgb.exe" [2010-08-09 577536]


c:\documents and settings\--\Start Menu\Programs\Startup\

startup.cmd [2009-10-13 409]


c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728]

McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"= 1 (0x1)

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableInstallerDetection"= 0 (0x0)

"EnableSecureUIAPaths"= 0 (0x0)

"EnableVirtualization"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

"EnableLUA"= 0 (0x0)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"= 1 (0x1)


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=

"d:\\Игри\\Cs\\hl.exe"=

"d:\\utorrent\\uTorrent.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"56309:TCP"= 56309:TCP:Pando Media Booster

"56309:UDP"= 56309:UDP:Pando Media Booster

"17090:TCP"= 17090:TCP:BitComet 17090 TCP

"17090:UDP"= 17090:UDP:BitComet 17090 UDP

"2875:TCP"= 2875:TCP:Akamai NetSession Interface

"5000:UDP"= 5000:UDP:Akamai NetSession Interface


R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [04.8.2004  01:56:58 14336]

S2 gupdate;Услуга Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [05.2.2010  10:58:32 135664]

S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\--\LOCALS~1\Temp\TRW31.tmp --> c:\docume~1\--\LOCALS~1\Temp\TRW31.tmp [?]

S3 K320bus;Sony Ericsson K320 driver (WDM);c:\windows\system32\drivers\K320bus.sys [01.12.2009  16:13:30 61504]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [23.4.2007  14:54:46 83208]

S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [23.4.2007  14:54:48 15112]

S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [23.4.2007  14:54:48 108680]

S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [23.4.2007  14:54:50 100488]

S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [23.4.2007  14:54:50 98568]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.9.2009  09:28:00 721904]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai	REG_MULTI_SZ   	Akamai

.

Contents of the 'Scheduled Tasks' folder


2010-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 07:58]


2010-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 07:58]


2010-08-09 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job

- c:\program files\Ask.com\UpdateTask.exe [2009-09-02 12:56]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://myfastwebsearch.com/

mStart Page = hxxp://www.myfastwebsearch.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: {{60237576-b24c-4ba9-9740-c9f3ec9db557} - {EAADF17C-B6EA-4511-8549-A67CFD406EAF} - c:\progra~1\SkyCode\WEBTRA~1\wt2ie.dll

TCP: {A616E3F0-ABA1-4109-9538-527A2F3B3134} = 62.213.190.1

.

- - - - ORPHANS REMOVED - - - -


BHO-{9D78BE3F-575E-499E-9812-25F531816459} - c:\program files\IEToolbar\My Fast Web Search\tbcore3.dll

Toolbar-{F9C1FF30-602C-49A5-8DB2-E2510CC4BFB0} - c:\program files\IEToolbar\My Fast Web Search\tbcore3.dll

WebBrowser-{F9C1FF30-602C-49A5-8DB2-E2510CC4BFB0} - c:\program files\IEToolbar\My Fast Web Search\tbcore3.dll

HKCU-Run-BitComet - d:\bitcomet\BitComet.exe

AddRemove-18 стальных колес Кубанское раздолье 1.00 - d:\игри\Kuban_free\18 WoS Pedal to the Metal\Uninstall.exe

AddRemove-AirAssault_is1 - d:\игри\unins000.exe

AddRemove-Driver - d:\игри\Driver NoCD - Reflections Interactive 1999\Uninstal.exe

AddRemove-EuroDictXP - c:\program files\KoralSoft\EuroDictXP\Uninstall.exe

AddRemove-Ford Racing 3 - d:\152d~1\FORDRA~1\UNWISE.EXE

AddRemove-German Truck Simulator - d:\игри\ceci6852\German Truck Simulator\uninst.exe

AddRemove-GTASA_is1 - d:\игри\GTASA\unins000.exe

AddRemove-McAfee Security Scan - c:\program files\McAfee Security Scan\uninstall.exe

AddRemove-Mob Enforcer - d:\152d~1\MOBENF~1\UNWISE.EXE

AddRemove-MOP - c:\program files\MOP\uninstall.exe

AddRemove-MuZone Season 5 - d:\игри\Uninstal.exe

AddRemove-Nano Pack for Pocket Tanks Deluxe_is1 - d:\игри\Pocket Tanks Deluxe\unins000.exe

AddRemove-Out Of The World_is1 - d:\игри\Out Of The World\unins000.exe

AddRemove-Pet Racer - d:\игри\uninstall Pet Racer.exe

AddRemove-Pirates_Battle_for_the_Caribbean_is1 - d:\игри\unins000.exe

AddRemove-PlayRixGameManger - c:\program files\Playrix Gameplayer\Uninstall.exe

AddRemove-Septerra Core - d:\игри\Uninst.isu

AddRemove-Superstars V8 NC_is1 - d:\игри\Superstars V8 NC\unins000.exe

AddRemove-Thunderbolt - d:\игри\setup\uninst.exe

AddRemove-UseNeXT_is1 - c:\program files\UseNeXT\unins000.exe

AddRemove-Wacky Races - d:\l+¦l\Uninstal.exe

AddRemove-{E51B2490-055D-4505-91C4-99D284590923}_is1 - d:\игри\TVM_RNR_ENG\RigNRoll\unins000.exe

AddRemove-Мерседес-Бенц - d:\152d~1\-0482~1\UNWISE.EXE

AddRemove-Перевозчик 2 - d:\игри\Перевозчик 2\uninst.exe




**************************************************************************


catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-08-09 16:48

Windows 5.1.2600 Service Pack 3 NTFS


scanning hidden processes ...  


scanning hidden autostart entries ... 


scanning hidden files ...  


scan completed successfully

hidden files: 0


**************************************************************************


[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]

"ImagePath"="\??\c:\docume~1\--\LOCALS~1\Temp\TRW31.tmp"


[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- DLLs Loaded Under Running Processes ---------------------


- - - - - - - > 'explorer.exe'(2668)

c:\windows\system32\WININET.dll

c:\program files\Google\Quick Search Box\bin\1.2.1151.245\qsb.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

.

------------------------ Other Running Processes ------------------------

.

c:\progra~1\Grisoft\AVG7\avgamsvr.exe

c:\progra~1\Grisoft\AVG7\avgupsvc.exe

c:\progra~1\Grisoft\AVG7\avgemc.exe

c:\windows\system32\HPZipm12.exe

c:\windows\system32\hcwvilbwnhysodaruhdy.exe

c:\windows\system32\VTTimer.exe

c:\windows\system32\VTtrayp.exe

c:\windows\SOUNDMAN.EXE

c:\docume~1\--\LOCALS~1\Temp\houfet.exe

c:\docume~1\--\LOCALS~1\Temp\houfet.exe

c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

c:\program files\HP\Digital Imaging\bin\hpqimzone.exe

c:\program files\Skype\Plugin Manager\skypePM.exe

.

**************************************************************************

.

Completion time: 2010-08-09  16:59:32 - machine was rebooted

ComboFix-quarantined-files.txt  2010-08-09 13:59


Pre-Run: 4 674 277 376 bytes free

Post-Run: 10 179 969 024 bytes free


WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect


- - End Of File - - E34C30C8969704643BD125B06E9301CF

1

9 август 201016 г.

Сега отворете notepad.exe и с copy/paste въведете следната информация:

Kilall::
File::

c:\windows\hcwvilbwnhysodaruhdy.exe

c:\windows\asjfppcuiznexjdrr.exe

c:\windows\system32\asjfppcuiznexjdrr.exe

c:\windows\system32\nkghwbtqjfyusjibgvtqmn.exe

c:\windows\system32\wsnnbfwskfxspfdvznkgb.exe

c:\windows\system32\uohfrticslbupdzprdy.exe

c:\windows\system32\jcurcdrkzrgysfapqb.exe

c:\windows\system32\hcwvilbwnhysodaruhdy.exe

c:\windows\system32\tkavedpgtjwmepiv.exe

c:\program files\oalbfzgsalterxltnreqbrvpwiqbjuhnb.dhu

c:\program files\yabhblikijhilhljtnqstzt.aca

c:\program files\laoholvkvjuiyhyjgndsgzgdncnbmaqzqbyf.kyr

c:\windows\nkghwbtqjfyusjibgvtqmn.exe

c:\windows\wsnnbfwskfxspfdvznkgb.exe

c:\windows\uohfrticslbupdzprdy.exe

c:\windows\jcurcdrkzrgysfapqb.exe

c:\windows\tkavedpgtjwmepiv.exe

c:\program files\oetnvteugvhwnxpbzhyodxfdoeqfrgxhzljri.nhp

c:\program files\lykbgbjwframahwfaftgsjojrenziuipen.nbo

Folder::

c:\program files\Ask.com

Registry::

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"wchrp"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"akthjbgqw"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"wchrp"=-

"oalbfzgsalt"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"houfet"=-

"teodgzfqxh"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]

"ucjvvlo"=-

"nswf"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}"=-

"{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce}"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"=-

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"=-

[-HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]

[-HKEY_CLASSES_ROOT\clsid\{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser\{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser\{D4027C7F-154A-4066-A1AD-4243D8127440}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-

"{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}"=-

"{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce}"=-

[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[-HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]

[-HKEY_CLASSES_ROOT\clsid\{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce}]

DDS::

uStart Page = hxxp://myfastwebsearch.com/

mStart Page = hxxp://www.myfastwebsearch.com/

Запазете файла с име CFScript и го провлачете и пуснете в Combofix, както е показано на снимката:

Забележка: По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си коментар.

P.S. За всеки случай запазвам CFSript като файл, който може да пратиш на приятеля си. Виж файла към този коментар.

9 август 201016 г.

Автор

Утре ще кажа резултатите, в момента не е онлайн .

9 август 201016 г.

O.K. Като пусне скрипта на ComboFix нека да качи папката C:\Qoobox на този адрес: rapidshare.com. След това дай линк за download.

10 август 201016 г.

Автор

Qoobox.rar

Редактирано 10 август 201016 г. от nologo
Премахване на опасен линк. Благодарности на ФодоР! (преглед на промените)

1

10 август 201016 г.

Благодаря ти много. Ще може ли последния лог от ComboFix?

Следва:

Стъпка 1

Изтеглете FixPolicies и го запазете на декстопа. Кликнете два пъти върху файла и изберете Install. Ще се създаде папка с името FixPolicies на десктопа. Отворете я и стартирайте файла Fix_policies.cmd.

Стъпка 2

Следвайте следната инструкция за работа със Win32kDiag:

Изтеглете Win32kDiag от някой от следните линкове и го запазете на десктопа
Ето линкове: Линк 1, Линк 2 и Линк 3
Кликнете два пъти върху Win32kDiag.exe (за Vista -> десен клик -> Run as Administrator), след което изчакайте да приключи работата си.
Когато се изпише "Finished! Press any key to exit...", натиснете произволен бутон от вашата клавиатура, за да се затвори прозореца.
Кликнете два пъти върху Win32kDiag.txt, който се намира на десктопа и поставете цялото съдържание на лог файла в следващия коментар в тази тема.

10 август 201016 г.

Автор

Комбо фикс:


ComboFix 10-08-09.01 - -- 0.08.2010	0:36.2.1 - x86

Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.447.160 [GMT 3:00]

Running from: c:\documents and settings\--\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\--\Desktop\CFScript.txt

AV: AVG 7.5.560 *On-access scanning enabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}

 * Created a new restore point


FILE ::

"c:\program files\laoholvkvjuiyhyjgndsgzgdncnbmaqzqbyf.kyr"

"c:\program files\lykbgbjwframahwfaftgsjojrenziuipen.nbo"

"c:\program files\oalbfzgsalterxltnreqbrvpwiqbjuhnb.dhu"

"c:\program files\oetnvteugvhwnxpbzhyodxfdoeqfrgxhzljri.nhp"

"c:\program files\yabhblikijhilhljtnqstzt.aca"

"c:\windows\asjfppcuiznexjdrr.exe"

"c:\windows\hcwvilbwnhysodaruhdy.exe"

"c:\windows\jcurcdrkzrgysfapqb.exe"

"c:\windows\nkghwbtqjfyusjibgvtqmn.exe"

"c:\windows\system32\asjfppcuiznexjdrr.exe"

"c:\windows\system32\hcwvilbwnhysodaruhdy.exe"

"c:\windows\system32\jcurcdrkzrgysfapqb.exe"

"c:\windows\system32\nkghwbtqjfyusjibgvtqmn.exe"

"c:\windows\system32\tkavedpgtjwmepiv.exe"

"c:\windows\system32\uohfrticslbupdzprdy.exe"

"c:\windows\system32\wsnnbfwskfxspfdvznkgb.exe"

"c:\windows\tkavedpgtjwmepiv.exe"

"c:\windows\uohfrticslbupdzprdy.exe"

"c:\windows\wsnnbfwskfxspfdvznkgb.exe"

.


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.


C:\autorun.inf

c:\docume~1\--\LOCALS~1\Temp\uohfrticslbupdzprdy.exe

c:\docume~1\--\LOCALS~1\Temp\wsnnbfwskfxspfdvznkgb.exe

C:\jsanofjs.bat

C:\lykbgbjwfram.bat

c:\program files\Ask.com

c:\program files\Ask.com\cobrand.ico

c:\program files\Ask.com\config.xml

c:\program files\Ask.com\favicon.ico

c:\program files\Ask.com\GenericAskToolbar.dll

c:\program files\Ask.com\mupcfg.xml

c:\program files\Ask.com\SaUpdate.exe

c:\program files\Ask.com\UpdateTask.exe

c:\program files\laoholvkvjuiyhyjgndsgzgdncnbmaqzqbyf.kyr

c:\program files\lykbgbjwframahwfaftgsjojrenziuipen.nbo

c:\program files\oalbfzgsalterxltnreqbrvpwiqbjuhnb.dhu

c:\program files\oetnvteugvhwnxpbzhyodxfdoeqfrgxhzljri.nhp

c:\program files\yabhblikijhilhljtnqstzt.aca

C:\teodgzfqxh.bat

c:\windows\asjfppcuiznexjdrr.exe

c:\windows\hcwvilbwnhysodaruhdy.exe

c:\windows\jcurcdrkzrgysfapqb.exe

c:\windows\nkghwbtqjfyusjibgvtqmn.exe

c:\windows\system32\asjfppcuiznexjdrr.exe

c:\windows\system32\hcwvilbwnhysodaruhdy.exe

c:\windows\system32\jcurcdrkzrgysfapqb.exe

c:\windows\system32\nkghwbtqjfyusjibgvtqmn.exe

c:\windows\system32\tkavedpgtjwmepiv.exe

c:\windows\system32\uohfrticslbupdzprdy.exe

c:\windows\system32\wsnnbfwskfxspfdvznkgb.exe

c:\windows\tkavedpgtjwmepiv.exe

c:\windows\uohfrticslbupdzprdy.exe

c:\windows\wsnnbfwskfxspfdvznkgb.exe

D:\autorun.inf

D:\jsanofjs.bat

D:\lykbgbjwfram.bat

D:\teodgzfqxh.bat


.

(((((((((((((((((((((((((   Files Created from 2010-07-09 to 2010-08-09  )))))))))))))))))))))))))))))))

.


2018-07-23 04:15 . 2018-07-23 04:15	501936	----a-w-	c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb4.tmp.exe

2018-02-06 09:58 . 2018-02-06 09:58	--------	d-----w-	c:\documents and settings\All Users\Application Data\ESET

2018-02-06 08:27 . 2018-02-06 13:11	--------	d-----w-	c:\documents and settings\--\Local Settings\Application Data\AskToolbar

2018-02-06 08:26 . 2010-08-09 21:44	--------	d-----w-	c:\documents and settings\--\Application Data\uTorrent

2018-02-06 08:14 . 2010-07-31 09:33	--------	d-----w-	c:\documents and settings\All Users\Application Data\Alwil Software

2010-08-09 12:58 . 2010-08-09 12:58	--------	d-----w-	c:\documents and settings\All Users\Application Data\Awem

2010-08-09 12:57 . 2010-08-09 12:57	--------	d-----w-	c:\program files\Cradle Of Persia

2010-08-09 11:59 . 2010-08-09 12:13	--------	d-----w-	c:\documents and settings\--\Application Data\TeamViewer

2010-08-09 11:58 . 2010-08-09 11:58	--------	d-----w-	c:\program files\TeamViewer

2010-08-09 08:14 . 2010-08-09 08:18	--------	d-----w-	c:\program files\Roadworks Simulator

2010-08-09 07:37 . 2010-08-09 07:37	9216	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgwlntf.dll

2010-08-09 07:37 . 2010-08-09 07:37	24328	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgtdiit.sys

2010-08-09 07:37 . 2010-08-09 07:37	24064	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgwlx64.dll

2010-08-09 07:37 . 2010-08-09 07:37	17928	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgclnit.sys

2010-08-09 07:37 . 2010-08-09 07:37	16136	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgtdi64.sys

2010-08-09 07:37 . 2010-08-09 07:37	13832	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgcln64.sys

2010-08-09 07:37 . 2010-08-09 07:37	40448	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgwli64.dll

2010-08-09 07:37 . 2010-08-09 07:37	121352	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgwsc.exe

2010-08-09 07:36 . 2010-08-09 07:36	36352	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgsea64.dll

2010-08-08 22:28 . 2010-08-08 22:29	--------	d-----w-	c:\windows\system32\NtmsData

2010-08-08 05:45 . 2010-08-08 05:47	389632	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgvv.exe

2010-08-08 05:45 . 2010-08-08 05:46	620032	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgupd.dll

2010-08-08 05:45 . 2010-08-08 05:47	1282560	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgres.dll

2010-08-08 05:45 . 2010-08-08 05:47	510976	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avginet.exe

2010-08-08 05:45 . 2010-08-08 05:47	131072	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avginet.dll

2010-08-08 05:44 . 2010-08-08 05:47	905728	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgctrl.dll

2010-08-08 05:44 . 2010-08-08 05:47	582656	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgcckrn.dll

2010-08-08 05:44 . 2010-08-08 05:47	579072	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgcc.exe

2010-08-08 05:44 . 2010-08-08 05:47	435712	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgabout.dll

2010-08-07 09:04 . 2010-08-07 09:04	--------	d-----w-	c:\documents and settings\--\Application Data\UseNeXT

2010-08-07 07:38 . 2010-08-07 07:38	--------	d-----w-	c:\windows\system32\XPSViewer

2010-08-07 07:38 . 2010-08-07 07:38	--------	d-----w-	c:\program files\MSBuild

2010-08-07 07:38 . 2010-08-07 07:38	--------	d-----w-	c:\program files\Reference Assemblies

2010-08-07 07:37 . 2008-07-06 12:06	89088	----a-w-	c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll

2010-08-07 07:36 . 2008-07-06 12:06	89088	-c----w-	c:\windows\system32\dllcache\filterpipelineprintproc.dll

2010-08-07 07:36 . 2008-07-06 12:06	117760	------w-	c:\windows\system32\prntvpt.dll

2010-08-07 07:36 . 2008-07-06 12:06	575488	-c----w-	c:\windows\system32\dllcache\xpsshhdr.dll

2010-08-07 07:36 . 2008-07-06 12:06	575488	------w-	c:\windows\system32\xpsshhdr.dll

2010-08-07 07:36 . 2008-07-06 10:50	597504	-c----w-	c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2010-08-07 07:36 . 2008-07-06 10:50	597504	------w-	c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe

2010-08-07 07:36 . 2008-07-06 12:06	1676288	-c----w-	c:\windows\system32\dllcache\xpssvcs.dll

2010-08-07 07:36 . 2008-07-06 12:06	1676288	------w-	c:\windows\system32\xpssvcs.dll

2010-08-06 11:49 . 2010-08-06 11:49	--------	d-----w-	c:\documents and settings\--\Application Data\RigNRoll_eng

2010-08-06 11:48 . 2010-08-06 11:48	413696	----a-w-	c:\windows\system32\wrap_oal.dll

2010-08-06 11:48 . 2010-08-06 11:48	110592	----a-w-	c:\windows\system32\OpenAL32.dll

2010-08-06 11:48 . 2010-08-06 11:48	--------	d-----w-	c:\program files\OpenAL

2010-08-06 08:01 . 2010-06-14 14:31	744448	-c----w-	c:\windows\system32\dllcache\helpsvc.exe

2010-07-31 09:26 . 2010-08-09 07:35	--------	d-----w-	c:\documents and settings\--\Application Data\AVG7

2010-07-31 09:25 . 2010-07-31 09:25	--------	d-----w-	c:\documents and settings\LocalService\Application Data\AVG7

2010-07-31 09:25 . 2010-08-08 05:47	10760	----a-w-	c:\windows\system32\drivers\avgclean.sys

2010-07-31 09:25 . 2010-08-08 05:47	26952	----a-w-	c:\windows\system32\drivers\avgmfx86.sys

2010-07-31 09:25 . 2010-07-31 09:25	4960	----a-w-	c:\windows\system32\drivers\avgtdi.sys

2010-07-31 09:25 . 2010-07-31 09:25	4224	----a-w-	c:\windows\system32\drivers\avg7rsw.sys

2010-07-31 09:25 . 2010-07-31 09:25	27776	----a-w-	c:\windows\system32\drivers\avg7rsxp.sys

2010-07-31 09:25 . 2010-08-08 05:47	821856	----a-w-	c:\windows\system32\drivers\avg7core.sys

2010-07-31 09:25 . 2010-08-09 12:03	--------	d-----w-	c:\documents and settings\All Users\Application Data\avg7

2010-07-31 09:25 . 2010-07-31 09:25	--------	d-----w-	c:\documents and settings\All Users\Application Data\Grisoft

2010-07-30 12:15 . 2010-07-30 12:15	--------	d-----w-	c:\documents and settings\--\Application Data\catalyst

2010-07-29 18:50 . 2010-07-29 18:50	--------	d-----w-	c:\program files\SkyCode

2010-07-16 07:18 . 2010-07-16 07:18	--------	d-----w-	c:\windows\system32\wbem\Repository


.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2018-02-06 13:10 . 2010-01-24 12:02	--------	d-----w-	c:\program files\McAfee Security Scan

2010-08-09 21:44 . 2009-09-09 14:24	--------	d-----w-	c:\documents and settings\--\Application Data\Skype

2010-08-09 21:00 . 2009-09-09 14:26	--------	d-----w-	c:\documents and settings\--\Application Data\skypePM

2010-08-09 20:47 . 2010-02-28 08:58	--------	d-----w-	c:\program files\Common Files\Akamai

2010-08-08 15:30 . 2010-02-27 12:11	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard

2010-08-07 08:14 . 2009-09-09 11:17	74728	----a-w-	c:\documents and settings\--\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-29 21:37 . 2009-09-09 10:59	--------	d--h--w-	c:\program files\InstallShield Installation Information

2010-06-14 14:31 . 2009-09-09 10:44	744448	----a-w-	c:\windows\pchealth\helpctr\binaries\helpsvc.exe

.


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-09 39408]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-14 482760]

"DAEMON Tools"="c:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-14 482760]

"uTorrent"="d:\utorrent\uTorrent.exe" [2010-05-17 322352]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]

"VTTimer"="VTTimer.exe" [2005-03-07 53248]

"VTTrayp"="VTtrayp.exe" [2005-08-03 163840]

"RaidTool"="c:\program files\VIA\RAID\raid_tool.exe" [2005-06-20 1056768]

"SoundMan"="SOUNDMAN.EXE" [2005-07-22 81920]

"WinampAgent"="c:\program files\Winamp\Winampa.exe" [2003-04-02 12288]

"QuickTime Task"="c:\windows\system32\qttask.exe" [2009-09-09 98304]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"VVSN"="c:\program files\VVSN\VVSN.exe" [2005-10-25 107520]

"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-12-06 122368]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]

"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2010-08-09 590848]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2010-08-08 219136]


c:\documents and settings\--\Start Menu\Programs\Startup\

startup.cmd [2009-10-13 409]


c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728]

McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableInstallerDetection"= 0 (0x0)

"EnableSecureUIAPaths"= 0 (0x0)

"EnableVirtualization"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)


[COLOR=RED] SafeBoot registry key needs repairs. This machine cannot enter Safe Mode. [/COLOR]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]

@="Driver Group"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]

@="Driver"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

@="DiskDrive"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

@="Hdc"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

@="Keyboard"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

@="Mouse"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

@="System"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

@="Volume"


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=

"d:\\Игри\\Cs\\hl.exe"=

"d:\\utorrent\\uTorrent.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"56309:TCP"= 56309:TCP:Pando Media Booster

"56309:UDP"= 56309:UDP:Pando Media Booster

"17090:TCP"= 17090:TCP:BitComet 17090 TCP

"17090:UDP"= 17090:UDP:BitComet 17090 UDP

"2875:TCP"= 2875:TCP:Akamai NetSession Interface

"5000:UDP"= 5000:UDP:Akamai NetSession Interface


R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [04.8.2004  01:56:58 14336]

S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.9.2009  09:28:00 721904]

S2 gupdate;Услуга Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [05.2.2010  10:58:32 135664]

S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\--\LOCALS~1\Temp\TRW31.tmp --> c:\docume~1\--\LOCALS~1\Temp\TRW31.tmp [?]

S3 K320bus;Sony Ericsson K320 driver (WDM);c:\windows\system32\drivers\K320bus.sys [01.12.2009  16:13:30 61504]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [23.4.2007  14:54:46 83208]

S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [23.4.2007  14:54:48 15112]

S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [23.4.2007  14:54:48 108680]

S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [23.4.2007  14:54:50 100488]

S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [23.4.2007  14:54:50 98568]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai	REG_MULTI_SZ   	Akamai

.

Contents of the 'Scheduled Tasks' folder


2010-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 07:58]


2010-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 07:58]

.

.

------- Supplementary Scan -------

.

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: {{60237576-b24c-4ba9-9740-c9f3ec9db557} - {EAADF17C-B6EA-4511-8549-A67CFD406EAF} - c:\progra~1\SkyCode\WEBTRA~1\wt2ie.dll

TCP: {A616E3F0-ABA1-4109-9538-527A2F3B3134} = 62.213.190.1

.

- - - - ORPHANS REMOVED - - - -


BHO-{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - (no file)

BHO-{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce} - (no file)

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKCU-Run-jsanofjs - jcurcdrkzrgysfapqb.exe

HKCU-RunOnce-houfet - c:\docume~1\--\LOCALS~1\Temp\tkavedpgtjwmepiv.exe

AddRemove-MuZone Season 5 - d:\игри\Uninstal.exe




**************************************************************************


catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-08-10 00:44

Windows 5.1.2600 Service Pack 3 NTFS


scanning hidden processes ...  


scanning hidden autostart entries ... 


scanning hidden files ...  


scan completed successfully

hidden files: 0


**************************************************************************


[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]

"ImagePath"="\??\c:\docume~1\--\LOCALS~1\Temp\TRW31.tmp"


[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

Completion time: 2010-08-10  00:48:45

ComboFix-quarantined-files.txt  2010-08-09 21:48

ComboFix2.txt  2010-08-09 13:59


Pre-Run: 9 934 381 056 bytes free

Post-Run: 10 139 025 408 bytes free


- - End Of File - - 8474814FC68C1B724C621116B9D99703

Другото:


Running from: C:\Documents and Settings\--\Desktop\Win32kDiag.exe


Log file at : C:\Documents and Settings\--\Desktop\Win32kDiag.txt


WARNING: Could not get backup privileges!


Searching 'C:\WINDOWS'...






Finished!


ComboFix 10-08-09.01 - -- 0.08.2010	0:36.2.1 - x86

Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.447.160 [GMT 3:00]

Running from: c:\documents and settings\--\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\--\Desktop\CFScript.txt

AV: AVG 7.5.560 *On-access scanning enabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}

 * Created a new restore point


FILE ::

"c:\program files\laoholvkvjuiyhyjgndsgzgdncnbmaqzqbyf.kyr"

"c:\program files\lykbgbjwframahwfaftgsjojrenziuipen.nbo"

"c:\program files\oalbfzgsalterxltnreqbrvpwiqbjuhnb.dhu"

"c:\program files\oetnvteugvhwnxpbzhyodxfdoeqfrgxhzljri.nhp"

"c:\program files\yabhblikijhilhljtnqstzt.aca"

"c:\windows\asjfppcuiznexjdrr.exe"

"c:\windows\hcwvilbwnhysodaruhdy.exe"

"c:\windows\jcurcdrkzrgysfapqb.exe"

"c:\windows\nkghwbtqjfyusjibgvtqmn.exe"

"c:\windows\system32\asjfppcuiznexjdrr.exe"

"c:\windows\system32\hcwvilbwnhysodaruhdy.exe"

"c:\windows\system32\jcurcdrkzrgysfapqb.exe"

"c:\windows\system32\nkghwbtqjfyusjibgvtqmn.exe"

"c:\windows\system32\tkavedpgtjwmepiv.exe"

"c:\windows\system32\uohfrticslbupdzprdy.exe"

"c:\windows\system32\wsnnbfwskfxspfdvznkgb.exe"

"c:\windows\tkavedpgtjwmepiv.exe"

"c:\windows\uohfrticslbupdzprdy.exe"

"c:\windows\wsnnbfwskfxspfdvznkgb.exe"

.


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.


C:\autorun.inf

c:\docume~1\--\LOCALS~1\Temp\uohfrticslbupdzprdy.exe

c:\docume~1\--\LOCALS~1\Temp\wsnnbfwskfxspfdvznkgb.exe

C:\jsanofjs.bat

C:\lykbgbjwfram.bat

c:\program files\Ask.com

c:\program files\Ask.com\cobrand.ico

c:\program files\Ask.com\config.xml

c:\program files\Ask.com\favicon.ico

c:\program files\Ask.com\GenericAskToolbar.dll

c:\program files\Ask.com\mupcfg.xml

c:\program files\Ask.com\SaUpdate.exe

c:\program files\Ask.com\UpdateTask.exe

c:\program files\laoholvkvjuiyhyjgndsgzgdncnbmaqzqbyf.kyr

c:\program files\lykbgbjwframahwfaftgsjojrenziuipen.nbo

c:\program files\oalbfzgsalterxltnreqbrvpwiqbjuhnb.dhu

c:\program files\oetnvteugvhwnxpbzhyodxfdoeqfrgxhzljri.nhp

c:\program files\yabhblikijhilhljtnqstzt.aca

C:\teodgzfqxh.bat

c:\windows\asjfppcuiznexjdrr.exe

c:\windows\hcwvilbwnhysodaruhdy.exe

c:\windows\jcurcdrkzrgysfapqb.exe

c:\windows\nkghwbtqjfyusjibgvtqmn.exe

c:\windows\system32\asjfppcuiznexjdrr.exe

c:\windows\system32\hcwvilbwnhysodaruhdy.exe

c:\windows\system32\jcurcdrkzrgysfapqb.exe

c:\windows\system32\nkghwbtqjfyusjibgvtqmn.exe

c:\windows\system32\tkavedpgtjwmepiv.exe

c:\windows\system32\uohfrticslbupdzprdy.exe

c:\windows\system32\wsnnbfwskfxspfdvznkgb.exe

c:\windows\tkavedpgtjwmepiv.exe

c:\windows\uohfrticslbupdzprdy.exe

c:\windows\wsnnbfwskfxspfdvznkgb.exe

D:\autorun.inf

D:\jsanofjs.bat

D:\lykbgbjwfram.bat

D:\teodgzfqxh.bat


.

(((((((((((((((((((((((((   Files Created from 2010-07-09 to 2010-08-09  )))))))))))))))))))))))))))))))

.


2018-07-23 04:15 . 2018-07-23 04:15	501936	----a-w-	c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb4.tmp.exe

2018-02-06 09:58 . 2018-02-06 09:58	--------	d-----w-	c:\documents and settings\All Users\Application Data\ESET

2018-02-06 08:27 . 2018-02-06 13:11	--------	d-----w-	c:\documents and settings\--\Local Settings\Application Data\AskToolbar

2018-02-06 08:26 . 2010-08-09 21:44	--------	d-----w-	c:\documents and settings\--\Application Data\uTorrent

2018-02-06 08:14 . 2010-07-31 09:33	--------	d-----w-	c:\documents and settings\All Users\Application Data\Alwil Software

2010-08-09 12:58 . 2010-08-09 12:58	--------	d-----w-	c:\documents and settings\All Users\Application Data\Awem

2010-08-09 12:57 . 2010-08-09 12:57	--------	d-----w-	c:\program files\Cradle Of Persia

2010-08-09 11:59 . 2010-08-09 12:13	--------	d-----w-	c:\documents and settings\--\Application Data\TeamViewer

2010-08-09 11:58 . 2010-08-09 11:58	--------	d-----w-	c:\program files\TeamViewer

2010-08-09 08:14 . 2010-08-09 08:18	--------	d-----w-	c:\program files\Roadworks Simulator

2010-08-09 07:37 . 2010-08-09 07:37	9216	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgwlntf.dll

2010-08-09 07:37 . 2010-08-09 07:37	24328	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgtdiit.sys

2010-08-09 07:37 . 2010-08-09 07:37	24064	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgwlx64.dll

2010-08-09 07:37 . 2010-08-09 07:37	17928	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgclnit.sys

2010-08-09 07:37 . 2010-08-09 07:37	16136	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgtdi64.sys

2010-08-09 07:37 . 2010-08-09 07:37	13832	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgcln64.sys

2010-08-09 07:37 . 2010-08-09 07:37	40448	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgwli64.dll

2010-08-09 07:37 . 2010-08-09 07:37	121352	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgwsc.exe

2010-08-09 07:36 . 2010-08-09 07:36	36352	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\install.1\avgsea64.dll

2010-08-08 22:28 . 2010-08-08 22:29	--------	d-----w-	c:\windows\system32\NtmsData

2010-08-08 05:45 . 2010-08-08 05:47	389632	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgvv.exe

2010-08-08 05:45 . 2010-08-08 05:46	620032	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgupd.dll

2010-08-08 05:45 . 2010-08-08 05:47	1282560	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgres.dll

2010-08-08 05:45 . 2010-08-08 05:47	510976	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avginet.exe

2010-08-08 05:45 . 2010-08-08 05:47	131072	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avginet.dll

2010-08-08 05:44 . 2010-08-08 05:47	905728	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgctrl.dll

2010-08-08 05:44 . 2010-08-08 05:47	582656	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgcckrn.dll

2010-08-08 05:44 . 2010-08-08 05:47	579072	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgcc.exe

2010-08-08 05:44 . 2010-08-08 05:47	435712	----a-w-	c:\documents and settings\All Users\Application Data\Grisoft\Avg7Data\avg7upd\backup\avgabout.dll

2010-08-07 09:04 . 2010-08-07 09:04	--------	d-----w-	c:\documents and settings\--\Application Data\UseNeXT

2010-08-07 07:38 . 2010-08-07 07:38	--------	d-----w-	c:\windows\system32\XPSViewer

2010-08-07 07:38 . 2010-08-07 07:38	--------	d-----w-	c:\program files\MSBuild

2010-08-07 07:38 . 2010-08-07 07:38	--------	d-----w-	c:\program files\Reference Assemblies

2010-08-07 07:37 . 2008-07-06 12:06	89088	----a-w-	c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll

2010-08-07 07:36 . 2008-07-06 12:06	89088	-c----w-	c:\windows\system32\dllcache\filterpipelineprintproc.dll

2010-08-07 07:36 . 2008-07-06 12:06	117760	------w-	c:\windows\system32\prntvpt.dll

2010-08-07 07:36 . 2008-07-06 12:06	575488	-c----w-	c:\windows\system32\dllcache\xpsshhdr.dll

2010-08-07 07:36 . 2008-07-06 12:06	575488	------w-	c:\windows\system32\xpsshhdr.dll

2010-08-07 07:36 . 2008-07-06 10:50	597504	-c----w-	c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2010-08-07 07:36 . 2008-07-06 10:50	597504	------w-	c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe

2010-08-07 07:36 . 2008-07-06 12:06	1676288	-c----w-	c:\windows\system32\dllcache\xpssvcs.dll

2010-08-07 07:36 . 2008-07-06 12:06	1676288	------w-	c:\windows\system32\xpssvcs.dll

2010-08-06 11:49 . 2010-08-06 11:49	--------	d-----w-	c:\documents and settings\--\Application Data\RigNRoll_eng

2010-08-06 11:48 . 2010-08-06 11:48	413696	----a-w-	c:\windows\system32\wrap_oal.dll

2010-08-06 11:48 . 2010-08-06 11:48	110592	----a-w-	c:\windows\system32\OpenAL32.dll

2010-08-06 11:48 . 2010-08-06 11:48	--------	d-----w-	c:\program files\OpenAL

2010-08-06 08:01 . 2010-06-14 14:31	744448	-c----w-	c:\windows\system32\dllcache\helpsvc.exe

2010-07-31 09:26 . 2010-08-09 07:35	--------	d-----w-	c:\documents and settings\--\Application Data\AVG7

2010-07-31 09:25 . 2010-07-31 09:25	--------	d-----w-	c:\documents and settings\LocalService\Application Data\AVG7

2010-07-31 09:25 . 2010-08-08 05:47	10760	----a-w-	c:\windows\system32\drivers\avgclean.sys

2010-07-31 09:25 . 2010-08-08 05:47	26952	----a-w-	c:\windows\system32\drivers\avgmfx86.sys

2010-07-31 09:25 . 2010-07-31 09:25	4960	----a-w-	c:\windows\system32\drivers\avgtdi.sys

2010-07-31 09:25 . 2010-07-31 09:25	4224	----a-w-	c:\windows\system32\drivers\avg7rsw.sys

2010-07-31 09:25 . 2010-07-31 09:25	27776	----a-w-	c:\windows\system32\drivers\avg7rsxp.sys

2010-07-31 09:25 . 2010-08-08 05:47	821856	----a-w-	c:\windows\system32\drivers\avg7core.sys

2010-07-31 09:25 . 2010-08-09 12:03	--------	d-----w-	c:\documents and settings\All Users\Application Data\avg7

2010-07-31 09:25 . 2010-07-31 09:25	--------	d-----w-	c:\documents and settings\All Users\Application Data\Grisoft

2010-07-30 12:15 . 2010-07-30 12:15	--------	d-----w-	c:\documents and settings\--\Application Data\catalyst

2010-07-29 18:50 . 2010-07-29 18:50	--------	d-----w-	c:\program files\SkyCode

2010-07-16 07:18 . 2010-07-16 07:18	--------	d-----w-	c:\windows\system32\wbem\Repository


.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2018-02-06 13:10 . 2010-01-24 12:02	--------	d-----w-	c:\program files\McAfee Security Scan

2010-08-09 21:44 . 2009-09-09 14:24	--------	d-----w-	c:\documents and settings\--\Application Data\Skype

2010-08-09 21:00 . 2009-09-09 14:26	--------	d-----w-	c:\documents and settings\--\Application Data\skypePM

2010-08-09 20:47 . 2010-02-28 08:58	--------	d-----w-	c:\program files\Common Files\Akamai

2010-08-08 15:30 . 2010-02-27 12:11	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard

2010-08-07 08:14 . 2009-09-09 11:17	74728	----a-w-	c:\documents and settings\--\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-29 21:37 . 2009-09-09 10:59	--------	d--h--w-	c:\program files\InstallShield Installation Information

2010-06-14 14:31 . 2009-09-09 10:44	744448	----a-w-	c:\windows\pchealth\helpctr\binaries\helpsvc.exe

.


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-09 39408]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-14 482760]

"DAEMON Tools"="c:\program files\DAEMON Tools Lite\daemon.exe" [2007-12-14 482760]

"uTorrent"="d:\utorrent\uTorrent.exe" [2010-05-17 322352]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]

"VTTimer"="VTTimer.exe" [2005-03-07 53248]

"VTTrayp"="VTtrayp.exe" [2005-08-03 163840]

"RaidTool"="c:\program files\VIA\RAID\raid_tool.exe" [2005-06-20 1056768]

"SoundMan"="SOUNDMAN.EXE" [2005-07-22 81920]

"WinampAgent"="c:\program files\Winamp\Winampa.exe" [2003-04-02 12288]

"QuickTime Task"="c:\windows\system32\qttask.exe" [2009-09-09 98304]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"VVSN"="c:\program files\VVSN\VVSN.exe" [2005-10-25 107520]

"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-12-06 122368]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]

"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2010-08-09 590848]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2010-08-08 219136]


c:\documents and settings\--\Start Menu\Programs\Startup\

startup.cmd [2009-10-13 409]


c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728]

McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableInstallerDetection"= 0 (0x0)

"EnableSecureUIAPaths"= 0 (0x0)

"EnableVirtualization"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)


[COLOR=RED] SafeBoot registry key needs repairs. This machine cannot enter Safe Mode. [/COLOR]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]

@="Driver Group"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]

@="Driver"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

@="DiskDrive"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

@="Hdc"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

@="Keyboard"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

@="Mouse"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

@="System"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

@="Volume"


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=

"d:\\Игри\\Cs\\hl.exe"=

"d:\\utorrent\\uTorrent.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"56309:TCP"= 56309:TCP:Pando Media Booster

"56309:UDP"= 56309:UDP:Pando Media Booster

"17090:TCP"= 17090:TCP:BitComet 17090 TCP

"17090:UDP"= 17090:UDP:BitComet 17090 UDP

"2875:TCP"= 2875:TCP:Akamai NetSession Interface

"5000:UDP"= 5000:UDP:Akamai NetSession Interface


R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [04.8.2004  01:56:58 14336]

S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.9.2009  09:28:00 721904]

S2 gupdate;Услуга Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [05.2.2010  10:58:32 135664]

S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\--\LOCALS~1\Temp\TRW31.tmp --> c:\docume~1\--\LOCALS~1\Temp\TRW31.tmp [?]

S3 K320bus;Sony Ericsson K320 driver (WDM);c:\windows\system32\drivers\K320bus.sys [01.12.2009  16:13:30 61504]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [23.4.2007  14:54:46 83208]

S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [23.4.2007  14:54:48 15112]

S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [23.4.2007  14:54:48 108680]

S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [23.4.2007  14:54:50 100488]

S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [23.4.2007  14:54:50 98568]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai	REG_MULTI_SZ   	Akamai

.

Contents of the 'Scheduled Tasks' folder


2010-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 07:58]


2010-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 07:58]

.

.

------- Supplementary Scan -------

.

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: {{60237576-b24c-4ba9-9740-c9f3ec9db557} - {EAADF17C-B6EA-4511-8549-A67CFD406EAF} - c:\progra~1\SkyCode\WEBTRA~1\wt2ie.dll

TCP: {A616E3F0-ABA1-4109-9538-527A2F3B3134} = 62.213.190.1

.

- - - - ORPHANS REMOVED - - - -


BHO-{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - (no file)

BHO-{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce} - (no file)

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKCU-Run-jsanofjs - jcurcdrkzrgysfapqb.exe

HKCU-RunOnce-houfet - c:\docume~1\--\LOCALS~1\Temp\tkavedpgtjwmepiv.exe

AddRemove-MuZone Season 5 - d:\игри\Uninstal.exe




**************************************************************************


catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-08-10 00:44

Windows 5.1.2600 Service Pack 3 NTFS


scanning hidden processes ...  


scanning hidden autostart entries ... 


scanning hidden files ...  


scan completed successfully

hidden files: 0


**************************************************************************


[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]

"ImagePath"="\??\c:\docume~1\--\LOCALS~1\Temp\TRW31.tmp"


[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

Completion time: 2010-08-10  00:48:45

ComboFix-quarantined-files.txt  2010-08-09 21:48

ComboFix2.txt  2010-08-09 13:59


Pre-Run: 9 934 381 056 bytes free

Post-Run: 10 139 025 408 bytes free


- - End Of File - - 8474814FC68C1B724C621116B9D99703

10 август 201016 г.

Супер!

Стъпка 1

Питай приятеля си дали може да инсталира и да пусне MBAM, ето как:

Изтеглете Malwarebytes' Anti-Malware от тук, като изберете Download Free Version.
Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата. При инсталацията изберете английски език (English).
Уверете се, че има отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware, след това кликнете на Finish. Ако има намерени по-нови обновления, тя ще ги изтегли и инсталира.
Стартирайте програмата и изберете Perform Quick Scan, след това кликнете на Scan.
Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Стъпка 2

Следвайте следната инструкция за работа със SafeBootKeyRepair:

Изтеглете този SafeBootKeyRepair, запазете го на десктопа и го стартирайте.
Следвайте инструкциите.
След като SafeBootKeyRepair завърши работата си, публикувайте съдържанието на лог файла: C:\SafeBoot_Repair.txt в следващия си коментар.

ФодоР, чакам два файла: от MBAM и от SafeBootKeyRepair.

12 август 201016 г.

Автор

Човека не ми е писал от 2 дни, когато е онлайн ще му кажа какво да прави.

Добре дошли!

Заразен компютър.Не може да се свали нищо антивирусно, защитната стена не работи

Featured Replies

Регистрирайте се или влезете в профила си за да коментирате

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)