Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

FB вирус

Последователи

23 февруари 201115 г.

Автор

ComboFix 11-02-23.01 - petar petrov 02/23/2011 18:49:33.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.255.8 [GMT 2:00] Running from: c:\documents and settings\petar petrov\My Documents\Downloads\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF} AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\page c:\documents and settings\All Users\Application Data\page\page.ico c:\documents and settings\All Users\Application Data\page\page.URL C:\Win F:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2011-01-23 to 2011-02-23 ))))))))))))))))))))))))))))))) . 2011-02-21 10:10 . 2011-02-21 10:10 -------- d-----w- C:\_OTL . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-01-21 14:42 . 2008-04-14 11:00 439808 ----a-w- c:\winxp\system32\shimgvw.dll 2011-01-07 14:09 . 2010-12-14 17:18 290048 ----a-w- c:\winxp\system32\atmfd.dll 2010-12-31 13:14 . 2010-12-14 17:18 1864064 ----a-w- c:\winxp\system32\win32k.sys 2010-12-22 12:32 . 2010-09-16 15:11 301568 ----a-w- c:\winxp\system32\kerberos.dll 2010-12-20 23:58 . 2010-12-14 17:19 919552 ----a-w- c:\winxp\system32\wininet.dll 2010-12-20 23:58 . 2010-12-14 17:19 43520 ----a-w- c:\winxp\system32\licmgr10.dll 2010-12-20 23:58 . 2010-12-14 17:19 1469440 ----a-w- c:\winxp\system32\inetcpl.cpl 2010-12-20 17:24 . 2010-09-16 15:11 730112 ----a-w- c:\winxp\system32\lsasrv.dll 2010-12-20 12:48 . 2010-12-14 17:19 385024 ----a-w- c:\winxp\system32\html.iec 2010-12-14 17:21 . 2010-12-14 17:21 317440 ----a-w- c:\winxp\system32\mp4sdecd.dll 2010-12-14 17:19 . 2010-12-14 17:19 1447424 ----a-w- c:\winxp\system32\msxml6.dll 2010-12-14 17:18 . 2010-12-14 17:18 40960 ----a-w- c:\winxp\system32\drivers\ndproxy.sys 2010-12-09 16:39 . 2010-04-28 05:14 2069376 ----a-w- c:\winxp\system32\ntkrnlpa.exe 2010-12-09 15:15 . 2009-02-09 09:56 718336 ----a-w- c:\winxp\system32\ntdll.dll 2010-12-09 14:29 . 2010-09-16 15:12 33280 ----a-w- c:\winxp\system32\csrsrv.dll 2010-12-09 13:43 . 2010-09-16 15:12 2192768 ----a-w- c:\winxp\system32\ntoskrnl.exe 2010-11-29 15:38 . 2010-11-29 15:38 94208 ----a-w- c:\winxp\system32\QuickTimeVR.qtx 2010-11-29 15:38 . 2010-11-29 15:38 69632 ----a-w- c:\winxp\system32\QuickTime.qts . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016] "SoundMan"="SOUNDMAN.EXE" [2003-07-23 56832] "DT PHL"="c:\program files\Philips Display\SmartControl II\DTHtml.exe" [2007-05-31 280576] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408] c:\documents and settings\All Users\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2003-11-20 503869] FlexType 2K.lnk - c:\program files\Datecs\FlexType 2K\FType2K.exe [2011-2-11 95232] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= R1 MpKsl7b293614;MpKsl7b293614;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4F18B9DC-EA21-4626-B8C0-6F8512F09662}\MpKsl7b293614.sys [2/23/2011 6:53 PM 28752] S3 MBAMSwissArmy;MBAMSwissArmy;c:\winxp\system32\drivers\mbamswissarmy.sys [2/21/2011 11:40 AM 38224] --- Other Services/Drivers In Memory --- *NewlyCreated* - MPKSL7B293614 . Contents of the 'Scheduled Tasks' folder 2011-02-21 c:\winxp\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2011-02-23 c:\winxp\Tasks\MP Scheduled Scan.job - c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 10:26] . . ------- Supplementary Scan ------- . IE: Add to Google Photos Screensa&ver - c:\winxp\system32\GPhotos.scr/200 IE: Free YouTube Download - c:\documents and settings\petar petrov\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm IE: Free YouTube to MP3 Converter - c:\documents and settings\petar petrov\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm FF - ProfilePath - c:\documents and settings\petar petrov\Application Data\Mozilla\Firefox\Profiles\lxm5es2t.default\ FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Quick Starter: [email protected] - c:\program files\Java\jre6\lib\deploy\jqs\ff FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\winxp\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} . - - - - ORPHANS REMOVED - - - - WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) AddRemove-Enable S3 for USB Device - c:\program files\Gigabyte\Enable S3 for USB Device\Uninst.isu ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-02-23 18:59 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINXP\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINXP\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . Completion time: 2011-02-23 19:03:30 ComboFix-quarantined-files.txt 2011-02-23 17:03 Pre-Run: 15,385,112,576 bytes free Post-Run: 15,348,576,256 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINXP [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINXP="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - C253AF61BEC518601779C759BD46DB79

23 февруари 201115 г.

Някаква промяна?

23 февруари 201115 г.

Автор

Ами сега като проверих не се показват тези неща но и предния път беше така-спря и след няколко дни всичко започна отначало.Дано този път да сме успели.Благодаря