Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

Проблем с достъп до сайтове

Последователи

1 май 201115 г.

Attach

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_11-03-05.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 4/12/2011 3:38:30 AM

System Uptime: 4/30/2011 11:05:05 PM (0 hours ago)

Motherboard: ECS | | GeForce7050M-M

Processor: AMD Sempron™ Processor LE-1200 | CPU 1 | 2094/200mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 10 GiB total, 4.152 GiB free.

D: is FIXED (NTFS) - 29 GiB total, 1.911 GiB free.

E: is FIXED (NTFS) - 38 GiB total, 0.243 GiB free.

F: is CDROM ()

G: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP4: 3/27/2011 3:54:09 AM - System Checkpoint

RP5: 3/29/2011 2:19:52 AM - System Checkpoint

==== Installed Programs ======================

СЪСхфИ ОТ рфр 3 - т ОФИСр 1.00

К°є ґѕст°ть сѕсµґ° 3 - т ѕфёсµ (Cracked by Alkser Chemnesoft)

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Ashampoo Burning Studio 10.0.4

Ashampoo UnInstaller 4 v.4.15

Ask Toolbar

FlexType 2K

foobar2000 v1.1.5

Good Timing

Google Toolbar for Internet Explorer

Google Update Helper

High Definition Audio Driver Package - KB888111

Mozilla Firefox 4.0 (x86 bg)

NVIDIA Drivers

Opera 11.10

Real Hide IP

Realtek High Definition Audio Driver

Skype Toolbars

Skype™ 4.2

The KMPlayer (remove only)

VirtualCloneDrive

VLC media player 1.1.9

WebFldrs XP

WinRAR archiver

µTorrent

==== Event Viewer Messages From Past Week ========

4/30/2011 9:06:02 AM, error: RMSPPPOE [55] - Received a PPPoE Active Discovery packet indicating a Generic Error.

4/30/2011 6:22:39 AM, information: Windows File Protection [64004] - The protected system file tourstart.exe could not be restored to its original, valid version. The file version of the bad file is 6.0.2900.2180 The specific error code is 0x000006ba [The RPC server is unavailable. ].

4/30/2011 6:21:37 AM, information: Windows File Protection [64004] - The protected system file systeminfo.exe could not be restored to its original, valid version. The file version of the bad file is 5.1.2600.0 The specific error code is 0x000006ba [The RPC server is unavailable. ].

4/30/2011 6:18:33 AM, information: Windows File Protection [64004] - The protected system file schtasks.exe could not be restored to its original, valid version. The file version of the bad file is 5.1.2600.2180 The specific error code is 0x000006ba [The RPC server is unavailable. ].

4/30/2011 6:12:24 AM, information: Windows File Protection [64004] - The protected system file openfiles.exe could not be restored to its original, valid version. The file version of the bad file is 5.1.2600.2180 The specific error code is 0x000006ba [The RPC server is unavailable. ].

4/30/2011 6:04:11 AM, information: Windows File Protection [64004] - The protected system file gpresult.exe could not be restored to its original, valid version. The file version of the bad file is 5.1.2600.2180 The specific error code is 0x000006ba [The RPC server is unavailable. ].

4/30/2011 4:37:00 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}

4/30/2011 3:25:09 AM, information: Windows File Protection [64004] - The protected system file eventtriggers.exe could not be restored to its original, valid version. The file version of the bad file is 5.1.2600.0 The specific error code is 0x000006ba [The RPC server is unavailable. ].

4/30/2011 3:25:09 AM, information: Windows File Protection [64004] - The protected system file eventcreate.exe could not be restored to its original, valid version. The file version of the bad file is 5.1.2600.2180 The specific error code is 0x000006ba [The RPC server is unavailable. ].

4/30/2011 3:24:07 AM, information: Windows File Protection [64004] - The protected system file driverquery.exe could not be restored to its original, valid version. The file version of the bad file is 5.1.2600.0 The specific error code is 0x000006ba [The RPC server is unavailable. ].

4/30/2011 3:15:54 AM, information: Windows File Protection [64004] - The protected system file tour.exe could not be restored to its original, valid version. The file version of the bad file is 5.0.30.0 The specific error code is 0x000006ba [The RPC server is unavailable. ].

4/30/2011 10:17:34 PM, error: Service Control Manager [7023] - The dzqdqcoin service terminated with the following error: A dynamic link library (DLL) initialization routine failed.

==== End Of File ===========================

DDS

DDS (Ver_11-03-05.01) - NTFSx86

Run by bik3p at 23:49:22.30 on ±єЎ®І 04/30/2011

Internet Explorer: 6.0.2900.2180

Microsoft Windows XP Professional 5.1.2600.2.1251.1.1033.18.895.499 [GMT -7:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Opera\opera.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\bik3p\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://eu.ask.com?o=15854&l=dis

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.6209.1142\swg.dll

BHO: PandoraTV Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: PandoraTV Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [uIWatcher] c:\program files\ashampoo\ashampoo uninstaller 4\UIWatcher.exe

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [skyTel] SkyTel.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [VirtualCloneDrive] "c:\program files\elaborate bytes\virtualclonedrive\VCDDaemon.exe" /s

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\flexty~1.lnk - c:\windows\datecs\FType2K.exe

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: {B5BA907C-6945-4D47-B5E5-52568DA6CC31} = 194.187.132.2 194.187.132.5

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\bik3p\applic~1\mozilla\firefox\profiles\7rjsfhbn.default\

FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll

============= SERVICES / DRIVERS ===============

R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);c:\windows\system32\drivers\RMSPPPOE.SYS [2011-4-12 31424]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-4-12 313816]

S2 uceymfyzk;dzqdqcoin;c:\windows\system32\svchost.exe -k netsvcs [2004-8-3 14336]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-4-12 313816]

=============== Created Last 30 ================

2011-05-01 05:41:51 -------- d-----w- c:\program files\Elaborate Bytes

2011-05-01 05:37:00 -------- d-----w- c:\docume~1\bik3p\locals~1\applic~1\Temp

2011-04-24 21:09:34 -------- d-----w- c:\docume~1\bik3p\applic~1\Good Timing

2011-04-24 21:09:24 -------- d-----w- c:\program files\Good Timing

2011-04-22 18:41:49 -------- d-----w- c:\docume~1\bik3p\locals~1\applic~1\Thinstall

2011-04-22 18:41:49 -------- d-----w- c:\docume~1\bik3p\applic~1\Thinstall

2011-04-15 20:51:16 -------- d-----w- c:\docume~1\bik3p\locals~1\applic~1\AskToolbar

2011-04-15 11:58:09 -------- d-----w- c:\program files\Ask.com

2011-04-15 11:57:29 -------- d-----w- c:\program files\VideoLAN

2011-04-15 11:53:15 -------- d-----w- c:\program files\The KMPlayer

2011-04-13 09:47:52 -------- d-----w- c:\docume~1\bik3p\applic~1\foobar2000

2011-04-13 09:47:39 -------- d-----w- c:\program files\foobar2000

2011-04-13 09:40:37 -------- d-----w- c:\docume~1\alluse~1\applic~1\Ashampoo

2011-04-13 09:40:30 39776 ----a-w- c:\windows\system32\DfSdkBt64.exe

2011-04-13 09:40:29 33632 ----a-w- c:\windows\system32\DfSdkBt32.exe

2011-04-13 09:40:27 -------- d-----w- c:\program files\Ashampoo

2011-04-13 09:34:12 -------- d-----w- c:\program files\VLCPortable

2011-04-13 09:30:26 5120 ----a-w- c:\windows\system32\vga856.fon

2011-04-13 09:30:24 6928 ----a-w- c:\windows\system32\kbdhebx.Dll

2011-04-13 09:30:24 6416 ----a-w- c:\windows\system32\kbdinori.Dll

2011-04-13 09:30:24 6416 ----a-w- c:\windows\system32\kbdinasa.Dll

2011-04-13 09:30:24 6416 ----a-w- c:\windows\system32\kbdbp.Dll

2011-04-13 09:30:24 6416 ----a-w- c:\windows\system32\kbdbds.Dll

2011-04-13 09:30:24 45056 ----a-w- c:\windows\system32\newdll.dll

2011-04-13 09:30:23 8992 ----a-w- c:\windows\system32\kbdbphz.dLL

2011-04-13 09:30:23 8992 ----a-w- c:\windows\system32\KBDBPH.dLL

2011-04-13 09:30:23 7440 ----a-w- c:\windows\system32\KBDDLL.DLL

2011-04-13 09:30:23 -------- d-----w- c:\windows\Datecs

2011-04-13 09:15:57 -------- d-----w- c:\docume~1\bik3p\locals~1\applic~1\Opera

2011-04-13 09:14:21 -------- d-----w- c:\windows\system32\Lang

2011-04-13 09:12:57 -------- d-----w- c:\windows\system32\ReinstallBackups

2011-04-13 09:12:35 -------- d-----w- c:\windows\system32\RTCOM

2011-04-13 09:12:33 4096 -c--a-w- c:\windows\system32\dllcache\ksuser.dll

2011-04-13 09:12:33 4096 ----a-w- c:\windows\system32\ksuser.dll

2011-04-13 09:12:32 60288 -c--a-w- c:\windows\system32\dllcache\drmk.sys

2011-04-13 09:12:32 60288 ----a-w- c:\windows\system32\drivers\drmk.sys

2011-04-13 09:12:32 130048 ----a-w- c:\windows\system32\ksproxy.ax

2011-04-13 09:12:03 200664 ----a-w- c:\windows\system32\spupdsvc.exe

2011-04-12 11:32:24 -------- d-----w- c:\docume~1\bik3p\locals~1\applic~1\Google

2011-04-12 11:09:23 -------- d-----w- c:\program files\uTorrent

2011-04-12 11:09:12 -------- d-----w- c:\docume~1\bik3p\applic~1\uTorrent

==================== Find3M ====================

2011-04-13 09:11:41 493018 ----a-w- c:\windows\HideWin.exe

2011-03-26 08:48:09 265176 ----a-w- c:\program files\Uninstall.exe

2011-03-26 08:46:42 1844702 ----a-w- c:\program files\kds3.exe

2011-03-07 02:08:13 93552 ----a-w- c:\windows\system32\ElbyCDIO.dll

2011-03-07 00:52:09 134512 ----a-w- c:\windows\system32\ElbyVCD.dll

============= FINISH: 23:49:35.35 ===============

Редактирано 1 май 201115 г. от capnemo (преглед на промените)

1 май 201115 г.

Привет, bik3p. Вашият Windows е сериозно заразен. Ще се опитаме да го оправим.

Затова изтеглете ComboFix от: тук

ВАЖНО: Запазете ComboFix.exe на вашия десктоп!

Изключете вашата антивирусна и антишпионска програма (ако има такива). Обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Забележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs
Стартирайте Combofix.exe и следвайте инструкциите.

Забележка:

Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
ComboFix ще нулира всички настройки на Internet Explorer (IE), включително да направи IE браузър по подразбиране.
ComboFix ще изключи autorun функцията на всички CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и защити системата от бъдещи вируси/заплахи, които поразяват посредством autorun. Ако това е проблем за вас - моля, уведомете ме.
ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той също ще изключи интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix може да отнеме до 20-30 минути. Затова имайте имайте търпение. Когато процесът приключи успешно, ComboFix ще създаде лог файл. Моля, копирайте съдържанието на C:\ComboFix.txt и го поставете в следващия си коментар в тази тема.