Да имаме инсталационен диск Използваме XP Home Edition

Приятели, има два варианта:

1.Да използваме инструмента sfc.exe ....поставяте инсталационния диск и изпълнявате :

Start ==> Run ==> cmd ==> sfc /scannow

2.Да надградите системата си със Windows XP Service Pack 3 - аз ви препоръчвам втория вариант и за четирите компютъра

п.п.Преди да започнете е необходимо да деинсталирате ComboFix и OTL по инструкцията в пост 23....!

Пропуснах за втория вариант не е нужен диск.....изтегляте пакета от линка който съм ви дал,запомняте на десктопа,затваряте всички приложения,двоен клик,Service Pack 3 се инсталира,рестарт и готово..!

Тъй като не съм запознат със Service Pack 3 какво точно се случва с Windows, след нейната инсталация има ли нужда от други процедури

http://windows.microsoft.com/bg-bg/windows/help/learn-how-to-install-windows-xp-service-pack-3-sp3

http://translate.google.bg/translate?hl=bg&langpair=en|bg&u=http://en.wikipedia.org/wiki/Windows_XP

Благодаря ти за инфото. Тъй като трябва да се прибирам вечерта съм пуснал последни тестове за компютър 3 и 4 и утре сутринта ще ти изпратя лог файловете да ги диагностираш. Лека Вечер.

Лека вечер .....!

Ето и резултатите от компютър 3

Добро утро..!Тези логове са от един и същ компютър ....Надявам се не е вързан към другите,които почистихме вчера...!Подготвяй лог от ComboFix..! п.п.Налага ми се да изляза но като си свърша работата ще продължим...!

Ето го и резултата от компютър 3 Всички компютри са разкачени от мрежата ComboFix 11-01-28.02 - Administrator 01.2011 г. 11:08:46.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.190.113 [GMT 2:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66} . ((((((((((((((((((((((((( Files Created from 2010-12-28 to 2011-01-29 ))))))))))))))))))))))))))))))) . 2011-01-28 16:14 . 2011-01-28 16:14 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AVG Security Toolbar 2011-01-27 15:04 . 2011-01-27 15:04 -------- d-----w- C:\$AVG 2011-01-27 14:30 . 2011-01-27 14:30 -------- d-----w- c:\documents and settings\Administrator\Application Data\AVG10 2011-01-27 14:26 . 2011-01-27 14:26 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files 2011-01-27 14:17 . 2011-01-27 14:22 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData 2011-01-27 14:01 . 2011-01-27 14:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2011-01-27 14:01 . 2011-01-27 14:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2011-01-27 14:01 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-01-27 14:01 . 2011-01-27 14:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-01-27 14:01 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-01-27 13:58 . 2011-01-27 13:58 -------- d-----w- C:\_OTL 2011-01-27 13:53 . 2011-01-27 13:53 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "VTTimer"="VTTimer.exe" [2005-03-07 53248] "VTTrayp"="VTtrayp.exe" [2005-10-31 163840] "SoundMan"="SOUNDMAN.EXE" [2006-03-01 577536] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Start Menu\Programs\Startup\ FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2007-1-5 95232] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 0 (0x0) "EnableInstallerDetection"= 0 (0x0) "EnableSecureUIAPaths"= 0 (0x0) "EnableVirtualization"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [27.1.2011 і. 16:01 38224] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uInternet Connection Wizard,ShellNext = hxxp://fly.to/pct Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7xq9nu1b.default\ FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4d418086&v=6.011.025.001&i=26&tp=ab&iy=&ychte=us&lng=bg&q= FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-01-29 11:11 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2011-01-29 11:12:43 ComboFix-quarantined-files.txt 2011-01-29 09:12 Pre-Run: 29 159 292 928 bytes free Post-Run: 29 117 358 080 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - 62B06AE89566D4B22F1704443678CC7D

Eто и резултати от последния компютър. Освен това прилагам тестовете от онлай скенера и лог файла от Malwarebytes Anti-Malware. Грешките или вирисуте от последните два компютъра system volume information........... какви са..... ComboFix 11-01-28.03 - Janeta 01.2011 г. 15:23:28.1.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.2.1251.359.1033.18.511.321 [GMT 2:00] Running from: c:\documents and settings\Janeta\Desktop\ComboFix.exe AV: Kaspersky Anti-Virus *Disabled/Outdated* {2C4D4BC6-0793-4956-A9F9-E252435469C0} FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66} * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_AVPsys ((((((((((((((((((((((((( Files Created from 2010-12-28 to 2011-01-29 ))))))))))))))))))))))))))))))) . 2011-01-29 11:41 . 2011-01-29 11:41 -------- d-----w- c:\program files\ESET 2011-01-29 09:33 . 2011-01-29 09:34 -------- d-----w- C:\Malwarebytes' Anti-Malware 2011-01-27 08:12 . 2011-01-27 08:12 -------- d-----w- C:\$AVG 2011-01-27 08:07 . 2011-01-27 08:07 -------- d-----w- c:\documents and settings\Janeta\Application Data\AVG10 2011-01-27 07:45 . 2011-01-27 07:45 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files 2011-01-27 07:33 . 2011-01-27 07:39 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData 2011-01-26 14:16 . 2011-01-26 14:16 -------- d-----w- c:\documents and settings\Janeta\Application Data\Malwarebytes 2011-01-26 14:16 . 2011-01-26 14:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2011-01-26 14:16 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-01-26 14:16 . 2011-01-26 14:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-01-26 14:16 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-01-26 13:42 . 2001-08-17 11:52 18688 -c--a-w- c:\windows\system32\dllcache\cdaudio.sys 2011-01-26 13:42 . 2001-08-17 11:52 18688 ----a-w- c:\windows\system32\drivers\cdaudio.sys 2011-01-26 13:22 . 2011-01-26 14:14 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla! 2011-01-24 14:46 . 2011-01-24 14:46 -------- d-----w- c:\windows\system32\Adobe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\Janeta\Start Menu\Programs\Startup\ 0B5527.lnk - c:\windows\system32\8FB47F\0B5527.EXE [N/A] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-2-16 113664] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] Command WorkStation.lnk - c:\program files\Fiery\CStation\cstation.exe [2010-2-16 2252848] FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2010-2-16 130048] WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-2-17 118784] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [17.2.2010 і. 16:28 721904] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [04.4.2007 і. 14:58 24344] S0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys --> c:\windows\system32\drivers\is3srv.sys [?] S0 szkg5;szkg5;c:\windows\system32\DRIVERS\szkg.sys --> c:\windows\system32\DRIVERS\szkg.sys [?] S0 szkgfs;szkgfs;c:\windows\system32\drivers\szkgfs.sys --> c:\windows\system32\drivers\szkgfs.sys [?] S3 QWEsys;QWEsys;c:\windows\system32\drivers\cdaudio.sys [26.1.2011 і. 15:42 18688] S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.bg/ uInternet Connection Wizard,ShellNext = iexplore IE: &Експортиране към Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Janeta\Application Data\Mozilla\Firefox\Profiles\6ematlyr.default\ FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - prefs.js: browser.startup.homepage - google.bg FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Bulgarian Dictionary: [email protected] - %profile%\extensions\[email protected] . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-01-29 15:30 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1116) c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll c:\windows\system32\klogon.dll - - - - - - - > 'lsass.exe'(1172) c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll - - - - - - - > 'explorer.exe'(2240) c:\windows\system32\newdll.dll c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\scrchpg.dll c:\windows\system32\msi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2011-01-29 15:33:48 - machine was rebooted ComboFix-quarantined-files.txt 2011-01-29 13:33 Pre-Run: 34 150 572 032 bytes free Post-Run: 34 075 385 856 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect - - End Of File - - 2A455D43945B34D454C8F35E71785E00

За компютър 3 пускал ли си онлайн скенер..? За компютър 4 ми кажи коя антивирусна е актуална ......виждам Касперски .....две антивирусни на един компютър е немислимо..възможен е конфликт....!

Ето и последния тест от компютър 3 system volume information ?????? това проблем ли е Касперски не е активна на компютър4 Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5633 Windows 5.1.2600 Service Pack 2 Internet Explorer 6.0.2900.2180 29.1.2011 г. 16:31:07 mbam-log-2011-01-29 (16-31-07).txt Scan type: Full scan (C:\|D:\|E:\|F:\|) Objects scanned: 323882 Time elapsed: 34 minute(s), 23 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 5 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: f:\system volume information\_restore{9b6c0c64-6f59-4dbf-83b9-242ae5aa92fb}\RP1135\A0115325.exe (Trojan.Chydo) -> Quarantined and deleted successfully. f:\system volume information\_restore{9b6c0c64-6f59-4dbf-83b9-242ae5aa92fb}\RP1135\A0115631.exe (Trojan.Chydo) -> Quarantined and deleted successfully. f:\system volume information\_restore{9b6c0c64-6f59-4dbf-83b9-242ae5aa92fb}\RP1135\A0115937.scr (Trojan.Chydo) -> Quarantined and deleted successfully. f:\system volume information\_restore{9b6c0c64-6f59-4dbf-83b9-242ae5aa92fb}\RP1135\A0116243.exe (Trojan.Chydo) -> Quarantined and deleted successfully. f:\system volume information\_restore{9b6c0c64-6f59-4dbf-83b9-242ae5aa92fb}\RP1135\A0116549.exe (Trojan.Chydo) -> Quarantined and deleted successfully.

За Компютър 4 :

Файлът c:\windows\system32\drivers\is3srv.sys изпрзтете на Virus Тotal за анализ и дайте резултата в следващия си пост..!

Деинсталирайте остатъците от Касперски като използвате kavremover - инструкция: http://support.kaspersky.com/faq/?qid=208279463

Прдължаваме да чистим остатъци от Trojan.Win32.KillAV......в този случай заразени точки на възстановяване...!

На компютър 4 касперски е премахнат, но този файл който го даваш не го откриваме. Нещо за компютър 3? И не разбрахме постояните грешки system volume information......... какви са?

И не разбрахме постояните грешки system volume information......... какви са?

Заразени точки на възстановяване...system restore point...но в случая МБАМ си е свършил работата .....почистени са....!

За компютър 4 изпълнете следния скрипт:

Копирайте текста в карето на notepad и го запазваш с име CFScript.txt на десктопа си:

KILLALL::

file::
c:\windows\system32\8FB47F\0B5527.EXE
c:\windows\system32\drivers\is3srv.sy

driver::
is3srv

След съхранението премести CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт прикачете в следващия си пост..!

А за компютър 3 направете едно бързо сканиране с МБАМ...!

Ето резултата от компютър 4 При сканирането на компютър 3 с МБАМ не откри нищо ComboFix 11-01-28.03 - Janeta 01.2011 г. 18:01:24.2.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.2.1251.359.1033.18.511.310 [GMT 2:00] Running from: c:\documents and settings\Janeta\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Janeta\Desktop\CFScript.txt FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66} FILE :: "c:\windows\system32\8FB47F\0B5527.EXE" "c:\windows\system32\drivers\is3srv.sy" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_is3srv ((((((((((((((((((((((((( Files Created from 2010-12-28 to 2011-01-29 ))))))))))))))))))))))))))))))) . 2011-01-29 09:33 . 2011-01-29 09:34 -------- d-----w- C:\Malwarebytes' Anti-Malware 2011-01-27 08:07 . 2011-01-27 08:07 -------- d-----w- c:\documents and settings\Janeta\Application Data\AVG10 2011-01-27 07:45 . 2011-01-27 07:45 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files 2011-01-27 07:33 . 2011-01-27 07:39 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData 2011-01-26 14:16 . 2011-01-26 14:16 -------- d-----w- c:\documents and settings\Janeta\Application Data\Malwarebytes 2011-01-26 14:16 . 2011-01-26 14:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2011-01-26 14:16 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-01-26 14:16 . 2011-01-26 14:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-01-26 14:16 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-01-26 13:42 . 2001-08-17 11:52 18688 -c--a-w- c:\windows\system32\dllcache\cdaudio.sys 2011-01-26 13:42 . 2001-08-17 11:52 18688 ----a-w- c:\windows\system32\drivers\cdaudio.sys 2011-01-26 13:22 . 2011-01-26 14:14 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla! 2011-01-24 14:46 . 2011-01-24 14:46 -------- d-----w- c:\windows\system32\Adobe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\Janeta\Start Menu\Programs\Startup\ 0B5527.lnk - c:\windows\system32\8FB47F\0B5527.EXE [N/A] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-2-16 113664] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] Command WorkStation.lnk - c:\program files\Fiery\CStation\cstation.exe [2010-2-16 2252848] FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2010-2-16 130048] WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-2-17 118784] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [17.2.2010 і. 16:28 721904] S0 szkg5;szkg5;c:\windows\system32\DRIVERS\szkg.sys --> c:\windows\system32\DRIVERS\szkg.sys [?] S0 szkgfs;szkgfs;c:\windows\system32\drivers\szkgfs.sys --> c:\windows\system32\drivers\szkgfs.sys [?] S3 QWEsys;QWEsys;c:\windows\system32\drivers\cdaudio.sys [26.1.2011 і. 15:42 18688] S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.bg/ uInternet Connection Wizard,ShellNext = iexplore IE: &Експортиране към Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Janeta\Application Data\Mozilla\Firefox\Profiles\6ematlyr.default\ FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - prefs.js: browser.startup.homepage - google.bg FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Bulgarian Dictionary: [email protected] - %profile%\extensions\[email protected] . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-01-29 18:07 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(832) c:\windows\system32\newdll.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2011-01-29 18:10:34 - machine was rebooted ComboFix-quarantined-files.txt 2011-01-29 16:10 ComboFix2.txt 2011-01-29 13:33 Pre-Run: 34 666 098 688 bytes free Post-Run: 34 660 323 328 bytes free - - End Of File - - 59A400A1A220A9355875EDD70363675D

При сканирането на компютър 3 с МБАМ не откри нищо

А онлайн скенер пуска ли за Компютър 3 ....?

Налага ми се да излизам. Ще ти пратя вече утре тест от онлайн скенера. Лека вечер

За Компютър 4:

Копирайте текста в карето на notepad и го запазваш с име CFScript.txt на десктопа си:

KILLALL::

file::
0B5527.lnk
c:\windows\system32\8FB47F\0B5527.EXE

driver::

След съхранението премести CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт прикачете в следващия си пост..!

Ако може само изпълни този скрипт....и приключваме за тази вечер..!

Добро утро. Ето го и резултата от онлайн скенера за компютър 3.Тази папка с вируса съм я изтрил След малко ще те пратя резултата със скрипта от компютър 4 ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6419 # api_version=3.0.2 # EOSSerial=6147ac247d35d44f86388080b2478640 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-01-30 08:38:50 # local_time=2011-01-30 10:38:50 (+0200, FLE Standard Time) # country="Bulgaria" # lang=1033 # osver=5.1.2600 NT Service Pack 2 # compatibility_mode=8192 67108863 100 0 3723 3723 0 0 # scanned=204367 # found=1 # cleaned=1 # scan_time=2711 E:\install\Ad-Aware 2007 Pro\crack\update-cracked.exe probably a variant of Win32/TrojanDropper.Delf.JBFNDPK trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

С Компютър 3 приключихме.....не забравяйте - антивирусната програма и ваксинацията...!

1.Деинсталирайте ComboFix така:

- Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

- Изтеглете OTCleanIt или от тук,стартирайте и натиснете Clean up

2.Деинсталирайте OTL така:

Стартирайте OTL.exe още веднъж и натиснете бутона CleanUp!

При дeинсталацията на OTL ще бъдат почистени някои инструменти и файлове, които използвахме в темата.

Ето го резултата след прилагана на скрипта за компютър 4. Направихме няколко проверки със ант. програми за компютър 3 чист е. ComboFix 11-01-29.02 - Janeta 01.2011 г. 12:48:01.3.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.2.1251.359.1033.18.511.358 [GMT 2:00] Running from: c:\documents and settings\Janeta\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Janeta\Desktop\CFScript.txt FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66} . ((((((((((((((((((((((((( Files Created from 2010-12-28 to 2011-01-30 ))))))))))))))))))))))))))))))) . 2011-01-29 09:33 . 2011-01-29 09:34 -------- d-----w- C:\Malwarebytes' Anti-Malware 2011-01-27 08:07 . 2011-01-27 08:07 -------- d-----w- c:\documents and settings\Janeta\Application Data\AVG10 2011-01-27 07:45 . 2011-01-27 07:45 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files 2011-01-27 07:33 . 2011-01-27 07:39 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData 2011-01-26 14:16 . 2011-01-26 14:16 -------- d-----w- c:\documents and settings\Janeta\Application Data\Malwarebytes 2011-01-26 14:16 . 2011-01-26 14:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2011-01-26 14:16 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-01-26 14:16 . 2011-01-26 14:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-01-26 14:16 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-01-26 13:42 . 2001-08-17 11:52 18688 -c--a-w- c:\windows\system32\dllcache\cdaudio.sys 2011-01-26 13:42 . 2001-08-17 11:52 18688 ----a-w- c:\windows\system32\drivers\cdaudio.sys 2011-01-26 13:22 . 2011-01-26 14:14 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla! 2011-01-24 14:46 . 2011-01-24 14:46 -------- d-----w- c:\windows\system32\Adobe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\Janeta\Start Menu\Programs\Startup\ 0B5527.lnk - c:\windows\system32\8FB47F\0B5527.EXE [N/A] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-2-16 113664] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] Command WorkStation.lnk - c:\program files\Fiery\CStation\cstation.exe [2010-2-16 2252848] FlexType 2K.lnk - c:\windows\Datecs\Flex2K.exe [2010-2-16 130048] WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-2-17 118784] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [17.2.2010 і. 16:28 721904] S0 szkg5;szkg5;c:\windows\system32\DRIVERS\szkg.sys --> c:\windows\system32\DRIVERS\szkg.sys [?] S0 szkgfs;szkgfs;c:\windows\system32\drivers\szkgfs.sys --> c:\windows\system32\drivers\szkgfs.sys [?] S3 QWEsys;QWEsys;c:\windows\system32\drivers\cdaudio.sys [26.1.2011 і. 15:42 18688] S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.bg/ uInternet Connection Wizard,ShellNext = iexplore IE: &Експортиране към Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Janeta\Application Data\Mozilla\Firefox\Profiles\6ematlyr.default\ FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - prefs.js: browser.startup.homepage - google.bg FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Bulgarian Dictionary: [email protected] - %profile%\extensions\[email protected] . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-01-30 12:53 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(1372) c:\windows\system32\newdll.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2011-01-30 12:56:52 - machine was rebooted ComboFix-quarantined-files.txt 2011-01-30 10:56 ComboFix2.txt 2011-01-29 16:10 ComboFix3.txt 2011-01-29 13:33 Pre-Run: 34 656 575 488 bytes free Post-Run: 34 649 206 784 bytes free - - End Of File - - 83F8DCDF2A9D27B4A2F6DBA77A378160

За Компютър 4:

1.Деинсталирайте ComboFix така:

- Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

- Изтеглете OTCleanIt или от тук,стартирайте и натиснете Clean up

• Стартирайте файла с двукратен клик на мишката.
• Направете следните настройки:

• Натиснете маркираният в червено бутон:
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

Ето файловете за компютър 4

Здравейте..!Извинявам се за закъснението но бях на работа и сега имам достъп до интернет...!

Стартирайте пак OTL.exe и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от цитата по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:OTL
SRV - (HidServ) --  File not found
SRV - (AppMgmt) --  File not found
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O4 - Startup: C:\Documents and Settings\Janeta\Start Menu\Programs\Startup\0B5527.lnk =  File not found
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

recycler /alldrives
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[clearallrestorepoints]
[CreateRestorePoint]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено:

Ще се създаде лог файл. Копирайте и поставете този файл в следващия си коментар.

След изпълнението на скрипта искам да обобщим нещата....и четирите компютъра вече са чисти,имат антивирусна програма и са ваксинирани с PandaUSBVaccine.....?Имате ли някъкви притеснения относно системите..?