Ами....я да сложим на първо време Avira AntiVir Personal - Free Antivirus .А ако нещо не ви се понрави винаги можем да я сменим..!

По втория въпрос...: Системни изисквания на Windows 7

Ето го лога от mbam, изтри доста троянци. Аз сега трябва да изляза малко, инструктирал съм майка ми само в скайп да влиза да не прихване нещо ново докато още няма антивирусна, а междо другото приятелите ми предлагат аваст, какво ще кажете за нея ?

mbam-log-2011-02-04 (18-32-27).txt

avast! Free Antivirus 5.1.889 също е хубава идея и добро безплатно решение...!

Между другото задължително трябва да рестартирате компютъра си ...след сканирането с МБАМ......някои засечени зловреди ще се изтрият след рестарт..!

Деинсталирайте OTL така:

Стартирайте OTL.exe още веднъж и натиснете бутона CleanUp!

При дeинсталацията на OTL ще бъдат почистени някои инструменти и файлове, които използвахме в темата.

---

Изтеглете ComboFix от тук и го запазете на десктопа си.

• Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

• Стартирайте Combo-Fix.com и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

• Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

• Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

• Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
• ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
• ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
• ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
• В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

Забравих да спомена, че преди година-две имах на компютъра ESET Smart Security, който изведнъж излезе out of date и още предният път като се обърнах към вашият сайт за профилактика ми дадоха някакъв деинсталатор, който не успя да я махне и от тогава като трябва да използвам ComboFix просто пренебрегвам предупреждението. И сега ли да направя така ?

Да разбирам..!След като ще слагате Авира или Аваст...най-добрия вариант е да деинсталираме ESET Smart Security..!Изтеглете ESET Uninstaller и го запазете на декстопа си.След това преминавате в Safe Mode. .и съгласно тази

инсртукция ..премахвате ESET Smart Security

Ами този ESET е голяма простотия, uninstallera не го намира за това ше пусна ComboFix както всички останали пъти през предупреждението...

Редактирано 4 февруари 201115 г. от darkman93 (преглед на промените)

Добре...!

Ето лога от ComboFix. Сега готов ли съм да инсталирам антивирусната вече и тази антивирусна включва ли там всички задължителни работи : Firewall, realtime защита и други и също така да ви попитам на десктопа ми останаха : ESET unninstaler, SecurityChek i MCPR (което не помня какво е) какво да правя с тях, shift+delete ? ComboFix 11-01-31.02 - Goro 02.2011 г. 21:26:46.10.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1022.690 [GMT 2:00] Running from: c:\documents and settings\Goro.MS-GORO\Desktop\ComboFix.exe AV: ESET Smart Security 3.0 *Enabled/Outdated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} FW: ESET Personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0} . ((((((((((((((((((((((((( Files Created from 2011-01-04 to 2011-02-04 ))))))))))))))))))))))))))))))) . 2011-01-28 00:06 . 2011-01-28 00:19 -------- d-----w- c:\program files\Advanced PC Tweaker 2011-01-25 20:39 . 2011-01-25 20:39 151552 ----a-w- C:\mvwamp.exe 2011-01-25 13:22 . 2011-01-25 13:22 146 ----a-w- c:\windows\DelMR.bat 2011-01-25 13:07 . 2011-01-25 13:07 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Teleca 2011-01-25 12:56 . 2011-01-25 12:56 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Sony Ericsson 2011-01-25 12:55 . 2011-01-25 13:22 -------- d-----w- c:\program files\Common Files\Teleca Shared 2011-01-25 12:55 . 2011-01-25 12:55 -------- d-----w- c:\program files\MSXML 6.0 2011-01-24 19:58 . 2011-01-24 19:58 276 ----a-w- C:\cdlo.exe 2011-01-24 18:32 . 2011-01-24 18:32 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\bluesoleil 2011-01-24 18:29 . 2011-01-24 18:29 -------- d-----w- c:\program files\Nokia 2011-01-17 19:14 . 2011-01-17 20:50 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Mumble 2011-01-17 19:13 . 2011-01-17 19:13 -------- d-----w- c:\program files\Mumble 2011-01-09 12:49 . 2011-01-09 12:55 -------- d-----w- C:\Poker 2011-01-08 07:17 . 2011-01-08 07:17 -------- d-----w- c:\documents and settings\NetworkService.NT AUTHORITY.000\Local Settings\Application Data\Apple . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-12-20 16:09 . 2010-02-28 12:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-12-20 16:08 . 2010-02-28 12:22 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-11-11 14:40 . 2008-01-17 08:54 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2010-11-11 14:40 . 2008-01-17 08:54 103736 ----a-w- c:\windows\system32\PnkBstrB.exe 2010-11-11 01:21 . 2008-01-19 09:31 139152 ----a-w- c:\documents and settings\Goro.MS-GORO\Application Data\PnkBstrK.sys 2010-11-11 01:20 . 2008-11-15 11:26 794408 ----a-w- c:\windows\system32\pbsvc.exe 2009-07-22 18:19 . 2009-07-22 18:19 22285608 ----a-w- c:\program files\SkypeSetup_3.8.0.188.exe 2009-04-10 22:22 . 2009-04-10 22:22 17238008 ----a-w- c:\program files\SystemMechanic.exe 2008-02-03 19:06 . 2008-02-03 19:06 1156096 ----a-w- c:\program files\iview410_setup.exe 2007-08-11 09:00 . 2007-06-24 16:44 543000 ----a-w- c:\program files\TunaticSetup.exe 2007-03-08 19:17 . 2007-03-12 19:51 1077161 ----a-w- c:\program files\TSD_Install.exe 2007-01-14 05:17 . 2007-01-14 05:17 348160 ----a-w- c:\program files\MPUI.exe 2007-01-05 06:04 . 2007-01-05 06:02 11757720 ----a-w- c:\program files\nentenst.exe 2006-11-17 02:27 . 2007-01-05 06:05 229760 ----a-w- c:\program files\main.dll 1999-12-01 06:39 . 2007-01-05 06:05 995384 ----a-w- c:\program files\mfc42u.dll 1999-04-24 05:22 . 2007-01-05 06:05 266293 ----a-w- c:\program files\msvcrt.dll 1999-04-24 05:22 . 2007-01-05 06:05 995383 ----a-w- c:\program files\mfc42.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Update"="c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-05 133104] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-21 68856] "Steam"="e:\games\Steam\steam.exe" [2010-11-16 1242448] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "NVRaidService"="c:\windows\system32\nvraidservice.exe" [2004-06-11 83968] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536] "Logitech Utility"="Logi_MwX.Exe" [2003-03-04 19968] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "midi1"=s3usrdrv.dll "wave1"=s3usrdrv.dll "midi2"=s3fmdrv.dll "aux1"=s3usrdrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Garena\\Garena.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"= "e:\\GAMES\\Steam\\Steam.exe"= "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Opera\\opera.exe"= "e:\\GAMES\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4sp.exe"= "e:\\GAMES\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4mp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443 "443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443 "37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674 "37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674 "37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675 "139:TCP"= 139:TCP:@xpsp2res.dll,-22004 "445:TCP"= 445:TCP:@xpsp2res.dll,-22005 "137:UDP"= 137:UDP:@xpsp2res.dll,-22001 "138:UDP"= 138:UDP:@xpsp2res.dll,-22002 "57022:TCP"= 57022:TCP:Pando Media Booster "57022:UDP"= 57022:UDP:Pando Media Booster "8394:TCP"= 8394:TCP:League of Legends Launcher "8394:UDP"= 8394:UDP:League of Legends Launcher "6888:TCP"= 6888:TCP:League of Legends Launcher "6888:UDP"= 6888:UDP:League of Legends Launcher "9721:TCP"= 9721:TCP:tmimzxu [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\RemoteAdminSettings] "RemoteAddresses"= * "Enabled"= 1 (0x1) R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [17.6.2009 г. 14:01 20744] R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.4.2007 г. 11:46 682232] R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [08.1.2008 г. 17:03 16896] R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [08.1.2008 г. 17:03 52224] R1 s3knldrv;s3knldrv;c:\windows\system32\drivers\S3KNLDRV.SYS [22.5.2007 г. 19:39 309184] R1 XGIkp;XGIkp;c:\windows\system32\drivers\xrvkp.sys [08.1.2008 г. 19:23 4480] R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [17.7.2008 г. 22:26 2368] R3 N100;Compaq Ethernet or Fast Ethernet NIC Driver;c:\windows\system32\drivers\n100325.sys [08.1.2008 г. 22:31 128000] R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [01.9.2010 г. 22:58 17792] S1 s3knljs;s3knljs;c:\windows\system32\drivers\S3KNLJS.SYS [22.5.2007 г. 19:39 17376] S2 gupdate1c99dec842196aa;Google Update Service (gupdate1c99dec842196aa);c:\program files\Google\Update\GoogleUpdate.exe [06.3.2009 г. 01:45 133104] S3 BS_Flash;BS_Flash;\??\c:\program files\BIOS\BIOS Flash\BS_Flash.sys --> c:\program files\BIOS\BIOS Flash\BS_Flash.sys [?] S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [17.6.2009 г. 14:02 30088] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [21.2.2010 г. 04:26 129024] S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp --> c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp [?] S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\safedrv.sys --> c:\program files\Garena\safedrv.sys [?] S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [17.6.2009 г. 14:01 26248] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [02.8.2005 г. 23:10 32512] S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [23.1.2004 г. 15:33 13952] S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [23.1.2004 г. 15:32 28800] S3 RTCore32;RTCore32;c:\program files\RightMark Memory Analyzer\RTCore32.sys [09.3.2010 г. 11:06 4608] S3 XDva323;XDva323;\??\c:\windows\system32\XDva323.sys --> c:\windows\system32\XDva323.sys [?] S3 XGIGraphics;XGIGraphics;c:\windows\system32\drivers\xgigrp.sys [08.1.2008 г. 19:23 290432] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs uxtuneup . Contents of the 'Scheduled Tasks' folder 2011-02-04 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 12:37] 2011-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2011-02-04 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-26 19:55] 2011-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 23:45] 2011-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 23:45] 2011-01-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-920026266-725345543-1003Core.job - c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-05 16:35] 2011-02-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-920026266-725345543-1003UA.job - c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-05 16:35] 2011-01-28 c:\windows\Tasks\One-Click Tweak.job - c:\program files\Advanced PC Tweaker\OneClick.exe [2011-01-28 16:40] 2011-02-04 c:\windows\Tasks\User_Feed_Synchronization-{DABEA9C1-D771-436D-A4EA-9DFF20556F97}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 16:36] . . ------- Supplementary Scan ------- . uStart Page = hxxp://googleure.com uInternet Connection Wizard,ShellNext = iexplore IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {A920F5E5-C246-4587-8D29-420A73DE083F} = 94.155.112.12,94.155.112.13 DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} - hxxp://disteng.nefficient.com/disteng/neffy/NeffyLauncher.cab FF - ProfilePath - c:\documents and settings\Goro.MS-GORO\Application Data\Mozilla\Firefox\Profiles\wkqmrmxm.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.vbox7.com/ FF - prefs.js: network.proxy.type - 0 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . . ------- File Associations ------- . JSEFile=NOTEPAD.EXE %1 .scr=AutoCADScriptFile . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-02-04 21:33 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\GarenaPEngine] "ImagePath"="\??\c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-220523388-920026266-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DC984039-3D7D-1F4F-23B3-10F7E48F8E01}*] "hafgkichpgjodank"=hex:6b,61,6f,69,6e,6e,66,64,66,6e,62,65,61,65,67,67,66,6c, 70,6d,65,61,00,00 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\System\ControlSet002\Enum\Root\LEGACY_NETSTATS\0000] @DACL=(02 0000) "Service"="netstats" "Legacy"=dword:00000001 "ConfigFlags"=dword:00000000 "Class"="LegacyDriver" "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}" "DeviceDesc"="netstats" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(908) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(2008) c:\windows\system32\msi.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2011-02-04 21:37:39 ComboFix-quarantined-files.txt 2011-02-04 19:37 Pre-Run: 1 994 891 264 bytes free Post-Run: 1 970 647 040 bytes free Current=2 Default=2 Failed=1 LastKnownGood=3 Sets=1,2,3,4,5 - - End Of File - - 681C5F3C705A5BBAFA3E4EDAF333AE06 Машината се чувства по добре в сравнение с предишното и състояние но пак като искам да гледам, някое клипче въпреки, че е заредило пак насича и незнам на какво се дължи... П.С. В Windows Security Centre като Virus protection е посочена именно тази ESET, която същност я няма...

Копирайте текста в карето на notepad и го запазваш с име CFScript.txt на десктопа си:

KILLALL::

SecCenter::
AV: ESET Smart Security 3.0 *Enabled/Outdated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

file::
c:\windows\system32\XDva323.sys
C:\cdlo.exe
C:\mvwamp.exe


driver::
XDva323


registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9721:TCP"=-


Fixcset::

След съхранението премести CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт прикачете в следващия си пост..!

ComboFix 11-01-31.02 - Goro 02.2011 г. 22:35:48.11.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1022.694 [GMT 2:00] Running from: c:\documents and settings\Goro.MS-GORO\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Goro.MS-GORO\Desktop\CFScript.txt.txt FILE :: "c:\windows\system32\XDva323.sys" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_XDVA323 -------\Service_XDva323 ((((((((((((((((((((((((( Files Created from 2011-01-04 to 2011-02-04 ))))))))))))))))))))))))))))))) . 2011-01-28 00:06 . 2011-01-28 00:19 -------- d-----w- c:\program files\Advanced PC Tweaker 2011-01-25 20:39 . 2011-01-25 20:39 151552 ----a-w- C:\mvwamp.exe 2011-01-25 13:22 . 2011-01-25 13:22 146 ----a-w- c:\windows\DelMR.bat 2011-01-25 13:07 . 2011-01-25 13:07 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Teleca 2011-01-25 12:56 . 2011-01-25 12:56 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Sony Ericsson 2011-01-25 12:55 . 2011-01-25 13:22 -------- d-----w- c:\program files\Common Files\Teleca Shared 2011-01-25 12:55 . 2011-01-25 12:55 -------- d-----w- c:\program files\MSXML 6.0 2011-01-24 19:58 . 2011-01-24 19:58 276 ----a-w- C:\cdlo.exe 2011-01-24 18:32 . 2011-01-24 18:32 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\bluesoleil 2011-01-24 18:29 . 2011-01-24 18:29 -------- d-----w- c:\program files\Nokia 2011-01-17 19:14 . 2011-01-17 20:50 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Mumble 2011-01-17 19:13 . 2011-01-17 19:13 -------- d-----w- c:\program files\Mumble 2011-01-09 12:49 . 2011-01-09 12:55 -------- d-----w- C:\Poker 2011-01-08 07:17 . 2011-01-08 07:17 -------- d-----w- c:\documents and settings\NetworkService.NT AUTHORITY.000\Local Settings\Application Data\Apple . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-12-20 16:09 . 2010-02-28 12:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-12-20 16:08 . 2010-02-28 12:22 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-11-11 14:40 . 2008-01-17 08:54 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2010-11-11 14:40 . 2008-01-17 08:54 103736 ----a-w- c:\windows\system32\PnkBstrB.exe 2010-11-11 01:21 . 2008-01-19 09:31 139152 ----a-w- c:\documents and settings\Goro.MS-GORO\Application Data\PnkBstrK.sys 2010-11-11 01:20 . 2008-11-15 11:26 794408 ----a-w- c:\windows\system32\pbsvc.exe 2009-07-22 18:19 . 2009-07-22 18:19 22285608 ----a-w- c:\program files\SkypeSetup_3.8.0.188.exe 2009-04-10 22:22 . 2009-04-10 22:22 17238008 ----a-w- c:\program files\SystemMechanic.exe 2008-02-03 19:06 . 2008-02-03 19:06 1156096 ----a-w- c:\program files\iview410_setup.exe 2007-08-11 09:00 . 2007-06-24 16:44 543000 ----a-w- c:\program files\TunaticSetup.exe 2007-03-08 19:17 . 2007-03-12 19:51 1077161 ----a-w- c:\program files\TSD_Install.exe 2007-01-14 05:17 . 2007-01-14 05:17 348160 ----a-w- c:\program files\MPUI.exe 2007-01-05 06:04 . 2007-01-05 06:02 11757720 ----a-w- c:\program files\nentenst.exe 2006-11-17 02:27 . 2007-01-05 06:05 229760 ----a-w- c:\program files\main.dll 1999-12-01 06:39 . 2007-01-05 06:05 995384 ----a-w- c:\program files\mfc42u.dll 1999-04-24 05:22 . 2007-01-05 06:05 266293 ----a-w- c:\program files\msvcrt.dll 1999-04-24 05:22 . 2007-01-05 06:05 995383 ----a-w- c:\program files\mfc42.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Update"="c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-05 133104] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-21 68856] "Steam"="e:\games\Steam\steam.exe" [2010-11-16 1242448] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "NVRaidService"="c:\windows\system32\nvraidservice.exe" [2004-06-11 83968] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536] "Logitech Utility"="Logi_MwX.Exe" [2003-03-04 19968] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "midi1"=s3usrdrv.dll "wave1"=s3usrdrv.dll "midi2"=s3fmdrv.dll "aux1"=s3usrdrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Garena\\Garena.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"= "e:\\GAMES\\Steam\\Steam.exe"= "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Opera\\opera.exe"= "e:\\GAMES\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4sp.exe"= "e:\\GAMES\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4mp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443 "443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443 "37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674 "37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674 "37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675 "139:TCP"= 139:TCP:@xpsp2res.dll,-22004 "445:TCP"= 445:TCP:@xpsp2res.dll,-22005 "137:UDP"= 137:UDP:@xpsp2res.dll,-22001 "138:UDP"= 138:UDP:@xpsp2res.dll,-22002 "57022:TCP"= 57022:TCP:Pando Media Booster "57022:UDP"= 57022:UDP:Pando Media Booster "8394:TCP"= 8394:TCP:League of Legends Launcher "8394:UDP"= 8394:UDP:League of Legends Launcher "6888:TCP"= 6888:TCP:League of Legends Launcher "6888:UDP"= 6888:UDP:League of Legends Launcher "9721:TCP"= 9721:TCP:tmimzxu [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\RemoteAdminSettings] "RemoteAddresses"= * "Enabled"= 1 (0x1) R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [17.6.2009 г. 14:01 20744] R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.4.2007 г. 11:46 682232] R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [08.1.2008 г. 17:03 16896] R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [08.1.2008 г. 17:03 52224] R1 s3knldrv;s3knldrv;c:\windows\system32\drivers\S3KNLDRV.SYS [22.5.2007 г. 19:39 309184] R1 XGIkp;XGIkp;c:\windows\system32\drivers\xrvkp.sys [08.1.2008 г. 19:23 4480] R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [17.7.2008 г. 22:26 2368] R3 N100;Compaq Ethernet or Fast Ethernet NIC Driver;c:\windows\system32\drivers\n100325.sys [08.1.2008 г. 22:31 128000] R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [01.9.2010 г. 22:58 17792] S1 s3knljs;s3knljs;c:\windows\system32\drivers\S3KNLJS.SYS [22.5.2007 г. 19:39 17376] S2 gupdate1c99dec842196aa;Google Update Service (gupdate1c99dec842196aa);c:\program files\Google\Update\GoogleUpdate.exe [06.3.2009 г. 01:45 133104] S3 BS_Flash;BS_Flash;\??\c:\program files\BIOS\BIOS Flash\BS_Flash.sys --> c:\program files\BIOS\BIOS Flash\BS_Flash.sys [?] S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [17.6.2009 г. 14:02 30088] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [21.2.2010 г. 04:26 129024] S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp --> c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp [?] S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\safedrv.sys --> c:\program files\Garena\safedrv.sys [?] S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [17.6.2009 г. 14:01 26248] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [02.8.2005 г. 23:10 32512] S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [23.1.2004 г. 15:33 13952] S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [23.1.2004 г. 15:32 28800] S3 RTCore32;RTCore32;c:\program files\RightMark Memory Analyzer\RTCore32.sys [09.3.2010 г. 11:06 4608] S3 XGIGraphics;XGIGraphics;c:\windows\system32\drivers\xgigrp.sys [08.1.2008 г. 19:23 290432] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs uxtuneup . Contents of the 'Scheduled Tasks' folder 2011-02-04 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 12:37] 2011-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2011-02-04 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-26 19:55] 2011-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 23:45] 2011-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 23:45] 2011-01-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-920026266-725345543-1003Core.job - c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-05 16:35] 2011-02-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-920026266-725345543-1003UA.job - c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-05 16:35] 2011-01-28 c:\windows\Tasks\One-Click Tweak.job - c:\program files\Advanced PC Tweaker\OneClick.exe [2011-01-28 16:40] 2011-02-04 c:\windows\Tasks\User_Feed_Synchronization-{DABEA9C1-D771-436D-A4EA-9DFF20556F97}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 16:36] . . ------- Supplementary Scan ------- . uStart Page = hxxp://googleure.com uInternet Connection Wizard,ShellNext = iexplore IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {A920F5E5-C246-4587-8D29-420A73DE083F} = 94.155.112.12,94.155.112.13 DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} - hxxp://disteng.nefficient.com/disteng/neffy/NeffyLauncher.cab FF - ProfilePath - c:\documents and settings\Goro.MS-GORO\Application Data\Mozilla\Firefox\Profiles\wkqmrmxm.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.vbox7.com/ FF - prefs.js: network.proxy.type - 0 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-02-04 22:48 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\GarenaPEngine] "ImagePath"="\??\c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-220523388-920026266-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DC984039-3D7D-1F4F-23B3-10F7E48F8E01}*] "hafgkichpgjodank"=hex:6b,61,6f,69,6e,6e,66,64,66,6e,62,65,61,65,67,67,66,6c, 70,6d,65,61,00,00 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\System\ControlSet002\Enum\Root\LEGACY_NETSTATS\0000] @DACL=(02 0000) "Service"="netstats" "Legacy"=dword:00000001 "ConfigFlags"=dword:00000000 "Class"="LegacyDriver" "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}" "DeviceDesc"="netstats" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(936) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(644) c:\windows\system32\msi.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\PnkBstrA.exe c:\windows\System32\TUProgSt.exe c:\windows\system32\wscntfy.exe c:\windows\SOUNDMAN.EXE c:\windows\Logi_MwX.Exe . ************************************************************************** . Completion time: 2011-02-04 22:53:59 - machine was rebooted ComboFix-quarantined-files.txt 2011-02-04 20:53 ComboFix2.txt 2011-02-04 19:37 Pre-Run: 1 972 731 904 bytes free Post-Run: 1 948 741 632 bytes free - - End Of File - - 8775940E842392AFEF837564014B6219

Ауууу два файла се пънат..:

Копирайте текста в карето на notepad и го запазваш с име CFScript.txt на десктопа си:

KILLALL::

file::
C:\mvwamp.exe
C:\cdlo.exe

След съхранението премести CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт прикачете в следващия си пост..!

Еййй дано всичко да идва от тях, че ще полудея A междо другото като тръгнах да пускам комбофикса даде някакъв pev.exe error или нещо от сорта, след което дадоух му донт сенд, тругна сканирането и запецна на 1 място и се наложи да го изключа и да ресна нали не съм развалил нещо ?

Редактирано 4 февруари 201115 г. от darkman93 (преглед на промените)

Това на предния скрипт ли беше или на последния..? Изпълнихте ли скрипта от пост 37....очаквам рапорта...!

Ето го, мисля, че ги премахна ComboFix 11-01-31.02 - Goro 02.2011 г. 23:10:17.12.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1022.667 [GMT 2:00] Running from: c:\documents and settings\Goro.MS-GORO\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Goro.MS-GORO\Desktop\CFScript.txt.txt FILE :: "C:\cdlo.exe" "C:\mvwamp.exe" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\cdlo.exe C:\mvwamp.exe . ((((((((((((((((((((((((( Files Created from 2011-01-04 to 2011-02-04 ))))))))))))))))))))))))))))))) . 2011-01-28 00:06 . 2011-01-28 00:19 -------- d-----w- c:\program files\Advanced PC Tweaker 2011-01-25 13:22 . 2011-01-25 13:22 146 ----a-w- c:\windows\DelMR.bat 2011-01-25 13:07 . 2011-01-25 13:07 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Teleca 2011-01-25 12:56 . 2011-01-25 12:56 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Sony Ericsson 2011-01-25 12:55 . 2011-01-25 13:22 -------- d-----w- c:\program files\Common Files\Teleca Shared 2011-01-25 12:55 . 2011-01-25 12:55 -------- d-----w- c:\program files\MSXML 6.0 2011-01-24 18:32 . 2011-01-24 18:32 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\bluesoleil 2011-01-24 18:29 . 2011-01-24 18:29 -------- d-----w- c:\program files\Nokia 2011-01-17 19:14 . 2011-01-17 20:50 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Mumble 2011-01-17 19:13 . 2011-01-17 19:13 -------- d-----w- c:\program files\Mumble 2011-01-09 12:49 . 2011-01-09 12:55 -------- d-----w- C:\Poker 2011-01-08 07:17 . 2011-01-08 07:17 -------- d-----w- c:\documents and settings\NetworkService.NT AUTHORITY.000\Local Settings\Application Data\Apple . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-12-20 16:09 . 2010-02-28 12:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-12-20 16:08 . 2010-02-28 12:22 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-11-11 14:40 . 2008-01-17 08:54 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2010-11-11 14:40 . 2008-01-17 08:54 103736 ----a-w- c:\windows\system32\PnkBstrB.exe 2010-11-11 01:21 . 2008-01-19 09:31 139152 ----a-w- c:\documents and settings\Goro.MS-GORO\Application Data\PnkBstrK.sys 2010-11-11 01:20 . 2008-11-15 11:26 794408 ----a-w- c:\windows\system32\pbsvc.exe 2009-07-22 18:19 . 2009-07-22 18:19 22285608 ----a-w- c:\program files\SkypeSetup_3.8.0.188.exe 2009-04-10 22:22 . 2009-04-10 22:22 17238008 ----a-w- c:\program files\SystemMechanic.exe 2008-02-03 19:06 . 2008-02-03 19:06 1156096 ----a-w- c:\program files\iview410_setup.exe 2007-08-11 09:00 . 2007-06-24 16:44 543000 ----a-w- c:\program files\TunaticSetup.exe 2007-03-08 19:17 . 2007-03-12 19:51 1077161 ----a-w- c:\program files\TSD_Install.exe 2007-01-14 05:17 . 2007-01-14 05:17 348160 ----a-w- c:\program files\MPUI.exe 2007-01-05 06:04 . 2007-01-05 06:02 11757720 ----a-w- c:\program files\nentenst.exe 2006-11-17 02:27 . 2007-01-05 06:05 229760 ----a-w- c:\program files\main.dll 1999-12-01 06:39 . 2007-01-05 06:05 995384 ----a-w- c:\program files\mfc42u.dll 1999-04-24 05:22 . 2007-01-05 06:05 266293 ----a-w- c:\program files\msvcrt.dll 1999-04-24 05:22 . 2007-01-05 06:05 995383 ----a-w- c:\program files\mfc42.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Update"="c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-05 133104] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-21 68856] "Steam"="e:\games\Steam\steam.exe" [2010-11-16 1242448] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "NVRaidService"="c:\windows\system32\nvraidservice.exe" [2004-06-11 83968] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536] "Logitech Utility"="Logi_MwX.Exe" [2003-03-04 19968] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "midi1"=s3usrdrv.dll "wave1"=s3usrdrv.dll "midi2"=s3fmdrv.dll "aux1"=s3usrdrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Garena\\Garena.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"= "e:\\GAMES\\Steam\\Steam.exe"= "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Opera\\opera.exe"= "e:\\GAMES\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4sp.exe"= "e:\\GAMES\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4mp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443 "443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443 "37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674 "37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674 "37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675 "139:TCP"= 139:TCP:@xpsp2res.dll,-22004 "445:TCP"= 445:TCP:@xpsp2res.dll,-22005 "137:UDP"= 137:UDP:@xpsp2res.dll,-22001 "138:UDP"= 138:UDP:@xpsp2res.dll,-22002 "57022:TCP"= 57022:TCP:Pando Media Booster "57022:UDP"= 57022:UDP:Pando Media Booster "8394:TCP"= 8394:TCP:League of Legends Launcher "8394:UDP"= 8394:UDP:League of Legends Launcher "6888:TCP"= 6888:TCP:League of Legends Launcher "6888:UDP"= 6888:UDP:League of Legends Launcher "9721:TCP"= 9721:TCP:tmimzxu [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\RemoteAdminSettings] "RemoteAddresses"= * "Enabled"= 1 (0x1) R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [17.6.2009 г. 14:01 20744] R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.4.2007 г. 11:46 682232] R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [08.1.2008 г. 17:03 16896] R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [08.1.2008 г. 17:03 52224] R1 s3knldrv;s3knldrv;c:\windows\system32\drivers\S3KNLDRV.SYS [22.5.2007 г. 19:39 309184] R1 XGIkp;XGIkp;c:\windows\system32\drivers\xrvkp.sys [08.1.2008 г. 19:23 4480] R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [17.7.2008 г. 22:26 2368] R3 N100;Compaq Ethernet or Fast Ethernet NIC Driver;c:\windows\system32\drivers\n100325.sys [08.1.2008 г. 22:31 128000] R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [01.9.2010 г. 22:58 17792] S1 s3knljs;s3knljs;c:\windows\system32\drivers\S3KNLJS.SYS [22.5.2007 г. 19:39 17376] S2 gupdate1c99dec842196aa;Google Update Service (gupdate1c99dec842196aa);c:\program files\Google\Update\GoogleUpdate.exe [06.3.2009 г. 01:45 133104] S3 BS_Flash;BS_Flash;\??\c:\program files\BIOS\BIOS Flash\BS_Flash.sys --> c:\program files\BIOS\BIOS Flash\BS_Flash.sys [?] S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [17.6.2009 г. 14:02 30088] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [21.2.2010 г. 04:26 129024] S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp --> c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp [?] S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\safedrv.sys --> c:\program files\Garena\safedrv.sys [?] S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [17.6.2009 г. 14:01 26248] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [02.8.2005 г. 23:10 32512] S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [23.1.2004 г. 15:33 13952] S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [23.1.2004 г. 15:32 28800] S3 RTCore32;RTCore32;c:\program files\RightMark Memory Analyzer\RTCore32.sys [09.3.2010 г. 11:06 4608] S3 XGIGraphics;XGIGraphics;c:\windows\system32\drivers\xgigrp.sys [08.1.2008 г. 19:23 290432] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs uxtuneup . Contents of the 'Scheduled Tasks' folder 2011-02-04 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 12:37] 2011-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2011-02-04 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-26 19:55] 2011-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 23:45] 2011-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 23:45] 2011-01-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-920026266-725345543-1003Core.job - c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-05 16:35] 2011-02-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-920026266-725345543-1003UA.job - c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-05 16:35] 2011-01-28 c:\windows\Tasks\One-Click Tweak.job - c:\program files\Advanced PC Tweaker\OneClick.exe [2011-01-28 16:40] 2011-02-04 c:\windows\Tasks\User_Feed_Synchronization-{DABEA9C1-D771-436D-A4EA-9DFF20556F97}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 16:36] . . ------- Supplementary Scan ------- . uStart Page = hxxp://googleure.com uInternet Connection Wizard,ShellNext = iexplore IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {A920F5E5-C246-4587-8D29-420A73DE083F} = 94.155.112.12,94.155.112.13 DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} - hxxp://disteng.nefficient.com/disteng/neffy/NeffyLauncher.cab FF - ProfilePath - c:\documents and settings\Goro.MS-GORO\Application Data\Mozilla\Firefox\Profiles\wkqmrmxm.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.vbox7.com/ FF - prefs.js: network.proxy.type - 0 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-02-04 23:20 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\GarenaPEngine] "ImagePath"="\??\c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-220523388-920026266-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DC984039-3D7D-1F4F-23B3-10F7E48F8E01}*] "hafgkichpgjodank"=hex:6b,61,6f,69,6e,6e,66,64,66,6e,62,65,61,65,67,67,66,6c, 70,6d,65,61,00,00 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\System\ControlSet002\Enum\Root\LEGACY_NETSTATS\0000] @DACL=(02 0000) "Service"="netstats" "Legacy"=dword:00000001 "ConfigFlags"=dword:00000000 "Class"="LegacyDriver" "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}" "DeviceDesc"="netstats" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(928) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(3508) c:\windows\system32\msi.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\PnkBstrA.exe c:\windows\System32\TUProgSt.exe c:\windows\system32\wscntfy.exe c:\windows\SOUNDMAN.EXE c:\windows\Logi_MwX.Exe . ************************************************************************** . Completion time: 2011-02-04 23:27:48 - machine was rebooted ComboFix-quarantined-files.txt 2011-02-04 21:27 ComboFix2.txt 2011-02-04 20:53 ComboFix3.txt 2011-02-04 19:37 Pre-Run: 1 967 706 112 bytes free Post-Run: 1 952 649 216 bytes free - - End Of File - - 4A3C15B954D2E6BF0449F10E9DBE5C84

Архивирай отново папката C:\Qoobox и я качи на http://www.zippyshare.com/ и след това публикувай линк..!След като се увериш че си готов продължаваш с деинсталация на ComboFix:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

2.Изтеглете OTCleanIt или от тук,стартирайте и натиснете Clean up

Ако са останали някъкви програми които използвахме изтриваш и тях..!Оставаяш си само Malwarebytes' Anti-Malware....с него ще направим последно сканиране ...!

Инсталирай си антивирусна програма и направи пълно сканиране с нея..!

И най- накрая обнови Malwarebytes' Anti-Malware и направи контролно пълно сканиране ....!

Изпълних първите 2 стъпки. Сканирах с антивирусната. Намери/изтри 1 троянец, след което ме попита дали искам да направи boot scan и без да знам какво е това дадох ок ( и това ми беше грешката ). Шест часа сканираше C: ( и намери още 2-3 троянеца и 6-7 повредени архиви) , след което не издържах повече и го спрях. Реших да пробвам машината да видим как върви вече и за мое съжаление същият проблем със засичането на образа и изкривяването на звука бяха на лице както в игри така и сайтове за клипчета. Докато бях в 1 от игрити обаче много грубо ме изхвърли svchost error и Generetic host нещо си пак error. Сутринта ще пусна mbam да сканира пък дано оправи нещата.

Изпълних първите 2 стъпки.

А кои са те..?Не виждам линк..!Или вие си ги измисляте тези стъпки...?Вижте ...от една седмица се опитвам да ви изчистя системата,опитвам се да ви оправя грешките....и най-накрая когато постигнахме нещо.....отново глупости и свободни съчинения..!Така няма да се разберем.....и най-вероятно ще затворя темата,ако продължавате така..!

И така - направете пълно сканиране с Malwarebytes' Anti-Malware и искам да видя лога..!Не забравяйте да обновите базата данни..!

Освен това искам линк към архивираната папка C:\Qoobox...!Не разбрах сега ComboFix деинсталиран ли е..?

Още веднъж ви приканвам за сериозно отношение към вашия проблем..!

Съжелявам забравих да дам линк за папката Qoobox : Сега пускам mbam.

Не разбрах сега ComboFix деинсталиран ли е..?

Да деинтсалиран е, ето лога от mbam. Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5686 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 06.2.2011 г. 20:17:43 mbam-log-2011-02-06 (20-17-43).txt Scan type: Full scan (C:\|E:\|) Objects scanned: 305055 Time elapsed: 2 hour(s), 10 minute(s), 42 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 3 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\documents and settings\networkservice.nt authority.000\local settings\temporary internet files\content.ie5\mfqs91v5\gorn[1].gif (Extension.Mismatch) -> Quarantined and deleted successfully. c:\documents and settings\networkservice.nt authority.000\local settings\temporary internet files\content.ie5\mfqs91v5\jrti[1].gif (Extension.Mismatch) -> Quarantined and deleted successfully. c:\documents and settings\networkservice.nt authority.000\local settings\temporary internet files\content.ie5\zlv2ux0o\jrti[1].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

Сега ще се наложи да изтеглите свежо копие на ComboFix и да направите сканиране по тази инструкция:

Изтеглете ComboFix от тук и го запазете на десктопа си.

• Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

• Стартирайте Combo-Fix.com и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

• Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

• Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

• Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
• ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
• ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
• ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
• В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

ComboFix 11-02-05.01 - Goro 02.2011 г. 21:02:09.13.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1022.643 [GMT 2:00] Running from: c:\documents and settings\Goro.MS-GORO\Desktop\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . ((((((((((((((((((((((((( Files Created from 2011-01-06 to 2011-02-06 ))))))))))))))))))))))))))))))) . 2011-02-05 11:48 . 2011-01-13 08:41 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys 2011-02-05 11:48 . 2011-01-13 08:37 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2011-02-05 11:48 . 2011-01-13 08:37 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2011-02-05 11:48 . 2011-01-13 08:40 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2011-02-05 11:48 . 2011-01-13 08:40 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2011-02-05 11:48 . 2011-01-13 08:39 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys 2011-02-05 11:48 . 2011-01-13 08:37 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2011-02-05 11:47 . 2011-01-13 08:47 38848 ----a-w- c:\windows\avastSS.scr 2011-02-05 11:47 . 2011-01-13 08:47 188216 ----a-w- c:\windows\system32\aswBoot.exe 2011-01-28 00:06 . 2011-01-28 00:19 -------- d-----w- c:\program files\Advanced PC Tweaker 2011-01-25 13:22 . 2011-01-25 13:22 146 ----a-w- c:\windows\DelMR.bat 2011-01-25 13:07 . 2011-01-25 13:07 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Teleca 2011-01-25 12:56 . 2011-01-25 12:56 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Sony Ericsson 2011-01-25 12:55 . 2011-01-25 13:22 -------- d-----w- c:\program files\Common Files\Teleca Shared 2011-01-25 12:55 . 2011-01-25 12:55 -------- d-----w- c:\program files\MSXML 6.0 2011-01-24 18:32 . 2011-01-24 18:32 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\bluesoleil 2011-01-24 18:29 . 2011-01-24 18:29 -------- d-----w- c:\program files\Nokia 2011-01-17 19:14 . 2011-01-17 20:50 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Mumble 2011-01-17 19:13 . 2011-01-17 19:13 -------- d-----w- c:\program files\Mumble 2011-01-09 12:49 . 2011-01-09 12:55 -------- d-----w- C:\Poker 2011-01-08 07:17 . 2011-01-08 07:17 -------- d-----w- c:\documents and settings\NetworkService.NT AUTHORITY.000\Local Settings\Application Data\Apple . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-12-20 16:09 . 2010-02-28 12:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-12-20 16:08 . 2010-02-28 12:22 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-11-11 14:40 . 2008-01-17 08:54 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2010-11-11 14:40 . 2008-01-17 08:54 103736 ----a-w- c:\windows\system32\PnkBstrB.exe 2010-11-11 01:21 . 2008-01-19 09:31 139152 ----a-w- c:\documents and settings\Goro.MS-GORO\Application Data\PnkBstrK.sys 2010-11-11 01:20 . 2008-11-15 11:26 794408 ----a-w- c:\windows\system32\pbsvc.exe 2009-07-22 18:19 . 2009-07-22 18:19 22285608 ----a-w- c:\program files\SkypeSetup_3.8.0.188.exe 2009-04-10 22:22 . 2009-04-10 22:22 17238008 ----a-w- c:\program files\SystemMechanic.exe 2008-02-03 19:06 . 2008-02-03 19:06 1156096 ----a-w- c:\program files\iview410_setup.exe 2007-08-11 09:00 . 2007-06-24 16:44 543000 ----a-w- c:\program files\TunaticSetup.exe 2007-03-08 19:17 . 2007-03-12 19:51 1077161 ----a-w- c:\program files\TSD_Install.exe 2007-01-14 05:17 . 2007-01-14 05:17 348160 ----a-w- c:\program files\MPUI.exe 2007-01-05 06:04 . 2007-01-05 06:02 11757720 ----a-w- c:\program files\nentenst.exe 2006-11-17 02:27 . 2007-01-05 06:05 229760 ----a-w- c:\program files\main.dll 1999-12-01 06:39 . 2007-01-05 06:05 995384 ----a-w- c:\program files\mfc42u.dll 1999-04-24 05:22 . 2007-01-05 06:05 266293 ----a-w- c:\program files\msvcrt.dll 1999-04-24 05:22 . 2007-01-05 06:05 995383 ----a-w- c:\program files\mfc42.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Update"="c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-05 133104] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-21 68856] "Steam"="e:\games\Steam\steam.exe" [2010-11-16 1242448] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "NVRaidService"="c:\windows\system32\nvraidservice.exe" [2004-06-11 83968] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536] "Logitech Utility"="Logi_MwX.Exe" [2003-03-04 19968] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760] "avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "midi1"=s3usrdrv.dll "wave1"=s3usrdrv.dll "midi2"=s3fmdrv.dll "aux1"=s3usrdrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Garena\\Garena.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"= "e:\\GAMES\\Steam\\Steam.exe"= "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Opera\\opera.exe"= "e:\\GAMES\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4sp.exe"= "e:\\GAMES\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4mp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443 "443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443 "37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674 "37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674 "37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675 "139:TCP"= 139:TCP:@xpsp2res.dll,-22004 "445:TCP"= 445:TCP:@xpsp2res.dll,-22005 "137:UDP"= 137:UDP:@xpsp2res.dll,-22001 "138:UDP"= 138:UDP:@xpsp2res.dll,-22002 "57022:TCP"= 57022:TCP:Pando Media Booster "57022:UDP"= 57022:UDP:Pando Media Booster "8394:TCP"= 8394:TCP:League of Legends Launcher "8394:UDP"= 8394:UDP:League of Legends Launcher "6888:TCP"= 6888:TCP:League of Legends Launcher "6888:UDP"= 6888:UDP:League of Legends Launcher "9721:TCP"= 9721:TCP:tmimzxu [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\RemoteAdminSettings] "RemoteAddresses"= * "Enabled"= 1 (0x1) R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [17.6.2009 г. 14:01 20744] R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.4.2007 г. 11:46 682232] R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [08.1.2008 г. 17:03 16896] R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [08.1.2008 г. 17:03 52224] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [05.2.2011 г. 13:48 294608] R1 s3knldrv;s3knldrv;c:\windows\system32\drivers\S3KNLDRV.SYS [22.5.2007 г. 19:39 309184] R1 XGIkp;XGIkp;c:\windows\system32\drivers\xrvkp.sys [08.1.2008 г. 19:23 4480] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [05.2.2011 г. 13:48 17744] R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [17.7.2008 г. 22:26 2368] R3 N100;Compaq Ethernet or Fast Ethernet NIC Driver;c:\windows\system32\drivers\n100325.sys [08.1.2008 г. 22:31 128000] R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [01.9.2010 г. 22:58 17792] S1 s3knljs;s3knljs;c:\windows\system32\drivers\S3KNLJS.SYS [22.5.2007 г. 19:39 17376] S2 gupdate1c99dec842196aa;Google Update Service (gupdate1c99dec842196aa);c:\program files\Google\Update\GoogleUpdate.exe [06.3.2009 г. 01:45 133104] S3 BS_Flash;BS_Flash;\??\c:\program files\BIOS\BIOS Flash\BS_Flash.sys --> c:\program files\BIOS\BIOS Flash\BS_Flash.sys [?] S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [17.6.2009 г. 14:02 30088] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [21.2.2010 г. 04:26 129024] S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp --> c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp [?] S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\safedrv.sys --> c:\program files\Garena\safedrv.sys [?] S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [17.6.2009 г. 14:01 26248] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [02.8.2005 г. 23:10 32512] S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [23.1.2004 г. 15:33 13952] S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [23.1.2004 г. 15:32 28800] S3 RTCore32;RTCore32;c:\program files\RightMark Memory Analyzer\RTCore32.sys [09.3.2010 г. 11:06 4608] S3 XGIGraphics;XGIGraphics;c:\windows\system32\drivers\xgigrp.sys [08.1.2008 г. 19:23 290432] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs uxtuneup . Contents of the 'Scheduled Tasks' folder 2011-02-06 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 12:37] 2011-02-06 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-26 19:55] 2011-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 23:45] 2011-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 23:45] 2011-02-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-920026266-725345543-1003Core.job - c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-05 16:35] 2011-02-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-920026266-725345543-1003UA.job - c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-05 16:35] 2011-01-28 c:\windows\Tasks\One-Click Tweak.job - c:\program files\Advanced PC Tweaker\OneClick.exe [2011-01-28 16:40] 2011-02-06 c:\windows\Tasks\User_Feed_Synchronization-{DABEA9C1-D771-436D-A4EA-9DFF20556F97}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 16:36] . . ------- Supplementary Scan ------- . uStart Page = hxxp://googleure.com uInternet Connection Wizard,ShellNext = iexplore IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {A920F5E5-C246-4587-8D29-420A73DE083F} = 94.155.112.12,94.155.112.13 DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} - hxxp://disteng.nefficient.com/disteng/neffy/NeffyLauncher.cab FF - ProfilePath - c:\documents and settings\Goro.MS-GORO\Application Data\Mozilla\Firefox\Profiles\wkqmrmxm.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.vbox7.com/ FF - prefs.js: network.proxy.type - 0 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . . ------- File Associations ------- . JSEFile=NOTEPAD.EXE %1 .scr=AutoCADScriptFile . - - - - ORPHANS REMOVED - - - - AddRemove-mIRC - c:\program files\mIRC\mirc.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-02-06 21:10 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\GarenaPEngine] "ImagePath"="\??\c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-220523388-920026266-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DC984039-3D7D-1F4F-23B3-10F7E48F8E01}*] "hafgkichpgjodank"=hex:6b,61,6f,69,6e,6e,66,64,66,6e,62,65,61,65,67,67,66,6c, 70,6d,65,61,00,00 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\System\ControlSet002\Enum\Root\LEGACY_NETSTATS\0000] @DACL=(02 0000) "Service"="netstats" "Legacy"=dword:00000001 "ConfigFlags"=dword:00000000 "Class"="LegacyDriver" "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}" "DeviceDesc"="netstats" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(972) c:\windows\system32\Ati2evxx.dll c:\windows\system32\COMRes.dll - - - - - - - > 'explorer.exe'(3464) c:\windows\system32\msi.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2011-02-06 21:15:10 ComboFix-quarantined-files.txt 2011-02-06 19:14 Pre-Run: 2 179 543 040 bytes free Post-Run: 2 177 593 344 bytes free - - End Of File - - 6CD79FA32B805942525A4D0884872CA5

Копирайте текста в карето на notepad и го запазваш с име CFScript.txt на десктопа си:

KILLALL::
Driver::
netstats

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9721:TCP"=-

RegNull::
[HKEY_USERS\S-1-5-21-220523388-920026266-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell  Extensions\Approved\{DC984039-3D7D-1F4F-23B3-10F7E48F8E01}*]

След съхранението премести CFScript.txt на иконата на ComboFix.exe

Генерирания рапорт прикачете в следващия си пост..!

ComboFix 11-02-05.01 - Goro 02.2011 г. 22:19:50.14.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1022.700 [GMT 2:00] Running from: c:\documents and settings\Goro.MS-GORO\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Goro.MS-GORO\Desktop\CFScript.txt.txt AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NETSTATS ((((((((((((((((((((((((( Files Created from 2011-01-06 to 2011-02-06 ))))))))))))))))))))))))))))))) . 2011-02-05 11:48 . 2011-01-13 08:41 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys 2011-02-05 11:48 . 2011-01-13 08:37 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2011-02-05 11:48 . 2011-01-13 08:37 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2011-02-05 11:48 . 2011-01-13 08:40 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2011-02-05 11:48 . 2011-01-13 08:40 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2011-02-05 11:48 . 2011-01-13 08:39 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys 2011-02-05 11:48 . 2011-01-13 08:37 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2011-02-05 11:47 . 2011-01-13 08:47 38848 ----a-w- c:\windows\avastSS.scr 2011-02-05 11:47 . 2011-01-13 08:47 188216 ----a-w- c:\windows\system32\aswBoot.exe 2011-01-28 00:06 . 2011-01-28 00:19 -------- d-----w- c:\program files\Advanced PC Tweaker 2011-01-25 13:22 . 2011-01-25 13:22 146 ----a-w- c:\windows\DelMR.bat 2011-01-25 13:07 . 2011-01-25 13:07 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Teleca 2011-01-25 12:56 . 2011-01-25 12:56 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Sony Ericsson 2011-01-25 12:55 . 2011-01-25 13:22 -------- d-----w- c:\program files\Common Files\Teleca Shared 2011-01-25 12:55 . 2011-01-25 12:55 -------- d-----w- c:\program files\MSXML 6.0 2011-01-24 18:32 . 2011-01-24 18:32 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\bluesoleil 2011-01-24 18:29 . 2011-01-24 18:29 -------- d-----w- c:\program files\Nokia 2011-01-17 19:14 . 2011-01-17 20:50 -------- d-----w- c:\documents and settings\Goro.MS-GORO\Application Data\Mumble 2011-01-17 19:13 . 2011-01-17 19:13 -------- d-----w- c:\program files\Mumble 2011-01-09 12:49 . 2011-01-09 12:55 -------- d-----w- C:\Poker 2011-01-08 07:17 . 2011-01-08 07:17 -------- d-----w- c:\documents and settings\NetworkService.NT AUTHORITY.000\Local Settings\Application Data\Apple . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-12-20 16:09 . 2010-02-28 12:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-12-20 16:08 . 2010-02-28 12:22 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-11-11 14:40 . 2008-01-17 08:54 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2010-11-11 14:40 . 2008-01-17 08:54 103736 ----a-w- c:\windows\system32\PnkBstrB.exe 2010-11-11 01:21 . 2008-01-19 09:31 139152 ----a-w- c:\documents and settings\Goro.MS-GORO\Application Data\PnkBstrK.sys 2010-11-11 01:20 . 2008-11-15 11:26 794408 ----a-w- c:\windows\system32\pbsvc.exe 2009-07-22 18:19 . 2009-07-22 18:19 22285608 ----a-w- c:\program files\SkypeSetup_3.8.0.188.exe 2009-04-10 22:22 . 2009-04-10 22:22 17238008 ----a-w- c:\program files\SystemMechanic.exe 2008-02-03 19:06 . 2008-02-03 19:06 1156096 ----a-w- c:\program files\iview410_setup.exe 2007-08-11 09:00 . 2007-06-24 16:44 543000 ----a-w- c:\program files\TunaticSetup.exe 2007-03-08 19:17 . 2007-03-12 19:51 1077161 ----a-w- c:\program files\TSD_Install.exe 2007-01-14 05:17 . 2007-01-14 05:17 348160 ----a-w- c:\program files\MPUI.exe 2007-01-05 06:04 . 2007-01-05 06:02 11757720 ----a-w- c:\program files\nentenst.exe 2006-11-17 02:27 . 2007-01-05 06:05 229760 ----a-w- c:\program files\main.dll 1999-12-01 06:39 . 2007-01-05 06:05 995384 ----a-w- c:\program files\mfc42u.dll 1999-04-24 05:22 . 2007-01-05 06:05 266293 ----a-w- c:\program files\msvcrt.dll 1999-04-24 05:22 . 2007-01-05 06:05 995383 ----a-w- c:\program files\mfc42.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Update"="c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-05 133104] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-21 68856] "Steam"="e:\games\Steam\steam.exe" [2010-11-16 1242448] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "NVRaidService"="c:\windows\system32\nvraidservice.exe" [2004-06-11 83968] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536] "Logitech Utility"="Logi_MwX.Exe" [2003-03-04 19968] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760] "avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "midi1"=s3usrdrv.dll "wave1"=s3usrdrv.dll "midi2"=s3fmdrv.dll "aux1"=s3usrdrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Garena\\Garena.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"= "e:\\GAMES\\Steam\\Steam.exe"= "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Opera\\opera.exe"= "e:\\GAMES\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4sp.exe"= "e:\\GAMES\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4mp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443 "443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443 "37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674 "37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674 "37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675 "139:TCP"= 139:TCP:@xpsp2res.dll,-22004 "445:TCP"= 445:TCP:@xpsp2res.dll,-22005 "137:UDP"= 137:UDP:@xpsp2res.dll,-22001 "138:UDP"= 138:UDP:@xpsp2res.dll,-22002 "57022:TCP"= 57022:TCP:Pando Media Booster "57022:UDP"= 57022:UDP:Pando Media Booster "8394:TCP"= 8394:TCP:League of Legends Launcher "8394:UDP"= 8394:UDP:League of Legends Launcher "6888:TCP"= 6888:TCP:League of Legends Launcher "6888:UDP"= 6888:UDP:League of Legends Launcher [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\RemoteAdminSettings] "RemoteAddresses"= * "Enabled"= 1 (0x1) R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [17.6.2009 г. 14:01 20744] R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.4.2007 г. 11:46 682232] R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [08.1.2008 г. 17:03 16896] R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [08.1.2008 г. 17:03 52224] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [05.2.2011 г. 13:48 294608] R1 s3knldrv;s3knldrv;c:\windows\system32\drivers\S3KNLDRV.SYS [22.5.2007 г. 19:39 309184] R1 XGIkp;XGIkp;c:\windows\system32\drivers\xrvkp.sys [08.1.2008 г. 19:23 4480] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [05.2.2011 г. 13:48 17744] R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [17.7.2008 г. 22:26 2368] R3 N100;Compaq Ethernet or Fast Ethernet NIC Driver;c:\windows\system32\drivers\n100325.sys [08.1.2008 г. 22:31 128000] R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [01.9.2010 г. 22:58 17792] S1 s3knljs;s3knljs;c:\windows\system32\drivers\S3KNLJS.SYS [22.5.2007 г. 19:39 17376] S2 gupdate1c99dec842196aa;Google Update Service (gupdate1c99dec842196aa);c:\program files\Google\Update\GoogleUpdate.exe [06.3.2009 г. 01:45 133104] S3 BS_Flash;BS_Flash;\??\c:\program files\BIOS\BIOS Flash\BS_Flash.sys --> c:\program files\BIOS\BIOS Flash\BS_Flash.sys [?] S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [17.6.2009 г. 14:02 30088] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [21.2.2010 г. 04:26 129024] S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp --> c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp [?] S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\safedrv.sys --> c:\program files\Garena\safedrv.sys [?] S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [17.6.2009 г. 14:01 26248] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [02.8.2005 г. 23:10 32512] S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [23.1.2004 г. 15:33 13952] S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [23.1.2004 г. 15:32 28800] S3 RTCore32;RTCore32;c:\program files\RightMark Memory Analyzer\RTCore32.sys [09.3.2010 г. 11:06 4608] S3 XGIGraphics;XGIGraphics;c:\windows\system32\drivers\xgigrp.sys [08.1.2008 г. 19:23 290432] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs uxtuneup . Contents of the 'Scheduled Tasks' folder 2011-02-06 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 12:37] 2011-02-06 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-26 19:55] 2011-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 23:45] 2011-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 23:45] 2011-02-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-920026266-725345543-1003Core.job - c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-05 16:35] 2011-02-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-920026266-725345543-1003UA.job - c:\documents and settings\Goro.MS-GORO\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-05 16:35] 2011-01-28 c:\windows\Tasks\One-Click Tweak.job - c:\program files\Advanced PC Tweaker\OneClick.exe [2011-01-28 16:40] 2011-02-06 c:\windows\Tasks\User_Feed_Synchronization-{DABEA9C1-D771-436D-A4EA-9DFF20556F97}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 16:36] . . ------- Supplementary Scan ------- . uStart Page = hxxp://googleure.com uInternet Connection Wizard,ShellNext = iexplore IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {A920F5E5-C246-4587-8D29-420A73DE083F} = 94.155.112.12,94.155.112.13 DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} - hxxp://disteng.nefficient.com/disteng/neffy/NeffyLauncher.cab FF - ProfilePath - c:\documents and settings\Goro.MS-GORO\Application Data\Mozilla\Firefox\Profiles\wkqmrmxm.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.vbox7.com/ FF - prefs.js: network.proxy.type - 0 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-02-06 22:34 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\GarenaPEngine] "ImagePath"="\??\c:\docume~1\GORO~2.MS-\LOCALS~1\Temp\GTZ2DBB.tmp" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-220523388-920026266-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DC984039-3D7D-1F4F-23B3-10F7E48F8E01}*] "hafgkichpgjodank"=hex:6b,61,6f,69,6e,6e,66,64,66,6e,62,65,61,65,67,67,66,6c, 70,6d,65,61,00,00 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\System\ControlSet002\Enum\Root\LEGACY_NETSTATS\0000] @DACL=(02 0000) "Service"="netstats" "Legacy"=dword:00000001 "ConfigFlags"=dword:00000000 "Class"="LegacyDriver" "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}" "DeviceDesc"="netstats" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(992) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(2224) c:\windows\system32\msi.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\program files\Alwil Software\Avast5\AvastSvc.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\PnkBstrA.exe c:\windows\System32\TUProgSt.exe c:\windows\system32\wscntfy.exe c:\windows\SOUNDMAN.EXE c:\windows\Logi_MwX.Exe . ************************************************************************** . Completion time: 2011-02-06 22:41:13 - machine was rebooted ComboFix-quarantined-files.txt 2011-02-06 20:41 ComboFix2.txt 2011-02-06 19:15 Pre-Run: 2 184 749 056 bytes free Post-Run: 2 110 087 168 bytes free - - End Of File - - 9DA034148655B5666254BDAE1FC082D4