Вирус ми блокира декстопа [РЕШЕН]

2 юни 201115 г.

Изчезнаха ми повечето неща в старт менюто и немога да сменя катинката на декстопа .Изчезнаха също и папките в маи документс.

quickJO

Потребител

Пол:Мъж
Град:София
Интереси:Hardware, MTB, Застраховки, Коли и Жени, Студена биричка и градивният спор

2 юни 201115 г.

Пич, защо пускаш нова тема? Старата ти я преместиха в правилният раздел... Ето ти линк към нея: Проблем с вирус...

А сега прочети внимателно правилата на разделя, където ти е преместена темата или по-точно указанията за работа в раздела: Системата ми е инфектирана - Какво да правя сега?. Успех!

2 юни 201115 г.

Автор

Пич, защо пускаш нова тема? Старата ти я преместиха в правилният раздел... Ето ти линк към нея: Проблем с вирус...

А сега прочети внимателно правилата на разделя, където ти е преместена темата или по-точно указанията за работа в раздела: Системата ми е инфектирана - Какво да правя сега?. Успех!

Пуснах нова тема защото без да исках обърках разделите .

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-06-01.06)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 03.5.2011 г. 01:04:28

System Uptime: 02.6.2011 г. 13:28:30 (1 hours ago)

.

Motherboard: | | K8NF6G-VSTA

Processor: AMD Sempron Processor 2800+ | CPUSocket | 1607/200mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 29 GiB total, 21,43 GiB free.

D: is CDROM ()

E: is FIXED (NTFS) - 100 GiB total, 87,087 GiB free.

F: is CDROM ()

G: is FIXED (NTFS) - 21 GiB total, 20,443 GiB free.

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: NVIDIA nForce Networking Controller

Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV03EF\4&1E6AA3F3&0&00

Manufacturer: NVIDIA

Name: NVIDIA nForce Networking Controller

PNP Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV03EF\4&1E6AA3F3&0&00

Service: NVENETFD

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

Архиватор WinRAR

2007 Microsoft Office Suite Service Pack 2 (SP2)

ABBYY FineReader 6.0

Adobe Reader 9.1

Apple Application Support

Apple Software Update

ArcSoft PhotoImpression

BitTorrent

BufferChm

CANYON USB PC CAMERA

Destinations

DeviceFunctionQFolder

DeviceManagementQFolder

East-Tec Eraser 2011 Version 9.9

EasyBits GO

EasyRecovery Professional

EncryptOnClick

EPSON Copy Utility

EPSON Photo Print

EPSON Scan

EPSON Smart Panel

ESET NOD32 Antivirus

eSupportQFolder

Google Chrome

HP Deskjet 3900 series

HP Imaging Device Functions 5.0

HP Software Update

HP Solution Center & Imaging Support Tools 5.0

HPDeskjet3900Series

HPProductAssistant

IsoBuster 2.5

K-Lite Mega Codec Pack 4.4.2

KoralSoft - EuroDictXP

Microsoft Office Access MUI (Bulgarian) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (Bulgarian) 2007

Microsoft Office Groove MUI (Bulgarian) 2007

Microsoft Office InfoPath MUI (Bulgarian) 2007

Microsoft Office OneNote MUI (Bulgarian) 2007

Microsoft Office Outlook MUI (Bulgarian) 2007

Microsoft Office PowerPoint MUI (Bulgarian) 2007

Microsoft Office Proof (Bulgarian) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Russian) 2007

Microsoft Office Proofing (Bulgarian) 2007

Microsoft Office Publisher MUI (Bulgarian) 2007

Microsoft Office Shared MUI (Bulgarian) 2007

Microsoft Office Word MUI (Bulgarian) 2007

Microsoft Software Update for Web Folders (Bulgarian) 12

Nero 6 Ultra Edition

NVIDIA Drivers

NVIDIA ForceWare Network Access Manager

P1670 Reference Guide

Presto! BizCard 4.1 Eng

PS2 Keyboard English Edition 2.0

QuickTime

R-Wipe&Clean 9.0

Realtek High Definition Audio Driver

ScanToWeb

Security Update for Windows Internet Explorer 7 (KB950759)

Security Update for Windows XP (KB923789)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB950760)

Skype Toolbars

Skype™ 5.3

SolutionCenter

Status

TrayApp

Update for Windows XP (KB898461)

VLC media player 1.1.9

WebFldrs XP

WebReg

Winamp

Winamp Detector Plug-in

Wise Disk Cleaner Professional v5.93

XnView 1.97.2

Your Uninstaller! 2010

.

==== Event Viewer Messages From Past Week ========

.

30.5.2011 г. 08:26:05, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 f42971c1, parameter3 f757683c, parameter4 00000000.

30.5.2011 г. 08:26:03, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 f42971c1, parameter3 ba2f583c, parameter4 00000000.

30.5.2011 г. 08:25:59, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 f42971c1, parameter3 ba0b286c, parameter4 00000000.

02.6.2011 г. 12:54:23, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\drivers\ipsec.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.5512.

02.6.2011 г. 08:51:53, error: Dhcp [1002] - The IP address lease 172.16.0.26 for the Network Card with network address 00147805D196 has been denied by the DHCP server 172.16.0.1 (The DHCP Server sent a DHCPNACK message).

01.6.2011 г. 07:19:39, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

01.6.2011 г. 07:19:24, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

.

==== End Of File ===========================

.

DDS (Ver_2011-06-01.06) - NTFSx86

Internet Explorer: 7.0.5730.13

Run by Ivan at 13:59:54 on 2011-06-02

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.447.63 [GMT 4,5:30]

.

AV: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: ActiveArmor Firewall *Disabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\PixArt\PAC7302\Monitor.exe

C:\Program Files\Winamp\winampa.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\Ivan\Local Settings\Application Data\Google\Update\1.3.21.53\GoogleCrashHandler.exe

C:\WINDOWS\system32\drivers\CDAC11BA.EXE

C:\WINDOWS\system32\cisvc.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Documents and Settings\Ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Documents and Settings\Ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://google.bg/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

uRun: [Google Update] "c:\documents and settings\ivan\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [AlcoholAutomount] "c:\program files\alcohol soft\alcohol 120\axcmd.exe" /automount

uRun: [bitTorrent] "c:\program files\bittorrent\BitTorrent.exe"

uRun: [YDZ1QVAGOJ] c:\docume~1\ivan\locals~1\temp\Pz5.exe

uRun: [ASduaswhIfbMHgW] c:\documents and settings\all users\application data\ASduaswhIfbMHgW.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [skyTel] SkyTel.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [PAC7302_Monitor] c:\windows\pixart\pac7302\Monitor.exe

mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32

uPolicies-explorer: NoDesktop = 1 (0x1)

uPolicies-system: DisableTaskMgr = 1 (0x1)

mPolicies-system: DisableTaskMgr = 1 (0x1)

IE: &Експортиране към Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

TCP: Interfaces\{5F92F410-BD12-49A8-A997-73618998C676} : DhcpNameServer = 88.203.133.1 88.203.133.2

TCP: Interfaces\{8868AE80-FFEB-4A89-9266-A4F9E40D10B0} : NameServer = 88.203.133.1 88.203.133.2

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

.

============= SERVICES / DRIVERS ===============

.

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-2-6 106208]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-2-6 93336]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-2-6 727720]

R2 SSHNAS;SSHNAS;c:\windows\system32\svchost.exe -k netsvcs [2008-4-14 14336]

R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-28 275968]

.

=============== Created Last 30 ================

.

2011-09-06 15:29:36 -------- d-----w- c:\program files\East-Tec Eraser 2011

2011-05-29 15:14:25 210944 ----a-w- c:\windows\system32\sshnas21.dll

2011-05-29 15:06:38 -------- d-----w- c:\program files\East-Tec DisposeSecure 2007 Enterprise

2011-05-29 14:29:23 -------- d-----w- c:\program files\East-Tec DisposeSecure

2011-05-28 11:13:51 -------- d--h--w- c:\documents and settings\ivan\application data\go

2011-05-28 11:13:39 -------- d-----w- c:\documents and settings\all users\application data\Easybits GO

2011-05-27 09:15:48 -------- d--h--w- c:\documents and settings\ivan\application data\R-Wipe&Clean

2011-05-27 09:15:48 -------- d-----w- c:\program files\R-Wipe&Clean

2011-05-20 04:23:37 -------- d-----w- c:\program files\Your Uninstaller 2010

2011-05-20 04:13:38 -------- d-----w- c:\windows\XSxS

2011-05-20 04:13:38 -------- d-----w- c:\program files\Xenocode

2011-05-20 02:02:40 -------- d--h--w- c:\documents and settings\ivan\application data\Smart Panel

2011-05-20 02:00:56 -------- d-----w- c:\program files\NewSoft

2011-05-20 02:00:38 306688 ----a-w- c:\windows\IsUninst.exe

2011-05-20 01:59:43 39936 ----a-w- c:\windows\system32\drivers\CDAC11BA.EXE

2011-05-20 01:59:38 -------- d--h--w- c:\documents and settings\ivan\local settings\application data\ABBYY

2011-05-20 01:59:38 -------- d--h--w- c:\documents and settings\ivan\application data\ABBYY

2011-05-20 01:59:17 53248 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\msihook.dll

2011-05-20 01:59:17 126976 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\knlwrap.exe

2011-05-20 01:59:16 114688 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\scpthdlr.dll

2011-05-20 01:59:01 -------- d-----w- c:\program files\ABBYY

2011-05-20 01:58:53 163840 ----a-w- c:\windows\system32\PhotoImpression Screen Saver.scr

2011-05-20 01:58:32 212480 ----a-w- c:\windows\pcdlib32.dll

2011-05-20 01:57:47 708696 ----a-w- c:\windows\system32\python21.dll

2011-05-20 01:57:47 57344 ----a-w- c:\windows\system32\PyWinTypes21.dll

2011-05-20 01:57:47 290919 ----a-w- c:\windows\system32\pythoncom21.dll

2011-05-20 01:57:44 -------- d-----w- c:\program files\common files\Python

2011-05-20 01:56:38 96768 ----a-w- c:\windows\SlantAdj.dll

2011-05-20 01:56:38 73216 ----a-w- c:\windows\ADE.DLL

2011-05-20 01:56:38 3136 ----a-w- c:\windows\Ade001.bin

2011-05-20 01:56:15 -------- d-----w- c:\program files\Smart Panel

2011-05-20 01:55:53 64000 ----a-w- c:\windows\system32\ESFW30.BIN

2011-05-20 01:55:53 278528 ----a-w- c:\windows\system32\esint30.dll

2011-05-20 01:55:53 217088 ----a-w- c:\windows\system32\ESDTR.dll

2011-05-20 01:55:53 176128 ----a-w- c:\windows\system32\ESWIA30.dll

2011-05-20 01:55:51 -------- d-----w- c:\program files\EPSON

2011-05-19 17:46:32 -------- d--h--w- c:\documents and settings\ivan\application data\XnView

2011-05-19 17:46:18 -------- d-----w- c:\program files\XnView

2011-05-18 14:33:19 -------- d-----w- c:\program files\KoralSoft

2011-05-15 17:44:46 -------- d--h--w- c:\documents and settings\ivan\local settings\application data\ESET

2011-05-14 08:25:25 -------- d-----w- c:\program files\Wise Disk Cleaner

2011-05-13 03:15:27 -------- d-----w- c:\program files\2BrightSparks

2011-05-13 03:15:27 -------- d-----w- c:\documents and settings\all users\application data\2BrightSparks

2011-05-09 08:24:06 67072 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\hpzpp3xu.dll

2011-05-09 08:24:06 45056 ----a-w- c:\windows\system32\hpzll3xu.dll

2011-05-09 08:21:47 -------- d-----w- c:\program files\HP

2011-05-09 08:19:13 372736 ----a-w- c:\windows\system32\hpzidi01.dll

2011-05-09 08:19:11 77824 ----a-w- c:\windows\system32\hpzids01.dll

2011-05-06 09:09:04 -------- d--h--w- c:\documents and settings\ivan\local settings\application data\Ahead

2011-05-04 18:30:42 -------- d-----w- c:\documents and settings\all users\application data\Skype Extras

2011-05-04 17:57:39 5632 ----a-w- c:\windows\system32\ptpusb.dll

2011-05-04 17:57:39 159232 ----a-w- c:\windows\system32\ptpusd.dll

2011-05-04 17:57:39 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys

2011-05-04 17:57:39 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2011-05-04 10:02:53 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

2011-05-04 10:02:47 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll

2011-05-04 10:02:09 -------- d-----w- c:\windows\Logs

2011-05-03 17:55:56 -------- d--h--w- c:\documents and settings\ivan\application data\PriceGong

2011-05-03 15:36:30 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys

2011-05-03 15:36:30 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2011-05-03 15:35:30 48128 ----a-w- c:\windows\system32\Remove.exe

2011-05-03 15:35:28 6656 ----a-w- c:\windows\system32\CoInst_071029.dll

2011-05-03 15:35:28 458752 ----a-w- c:\windows\system32\drivers\PAC7302.SYS

2011-05-03 15:35:27 -------- d-----w- c:\program files\ANC

2011-05-03 15:35:26 129024 ----a-w- c:\windows\system32\SP7302.AX

2011-05-03 15:35:25 14336 ----a-w- c:\windows\system32\P7302USD.dll

2011-05-03 15:35:24 -------- d-----w- c:\windows\PixArt

2011-05-03 15:35:24 -------- d-----w- c:\program files\common files\PAC7302

2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll

2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll

2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll

2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll

2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll

2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll

2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll

2011-05-03 12:42:27 -------- d--h--w- c:\documents and settings\ivan\local settings\application data\Apple

2011-05-03 12:42:16 -------- d--h--w- c:\documents and settings\ivan\local settings\application data\Apple Computer

2011-05-03 12:39:31 -------- d-----w- c:\program files\VideoLAN

2011-05-03 12:32:14 -------- d-----w- c:\program files\Ontrack

2011-05-03 11:50:20 -------- d-----w- c:\program files\NVIDIA Corporation

2011-05-03 11:49:15 442368 ----a-w- c:\windows\system32\CapabilityTable.exe

2011-05-03 11:49:04 208896 ------w- c:\windows\system32\nvuide.exe

2011-05-03 11:49:02 363008 ----a-r- c:\windows\system32\idecoiins.dll

2011-05-03 11:49:02 363008 ----a-r- c:\windows\system32\idecoi.dll

2011-05-03 11:49:02 35840 ----a-r- c:\windows\system32\NVCOI.DLL

2011-05-03 11:45:59 -------- d-----w- c:\windows\nview

2011-05-03 11:45:58 208896 ----a-w- c:\windows\system32\nvudisp.exe

2011-05-03 11:45:58 -------- d-----w- c:\windows\NV2803540.TMP

2011-05-03 11:45:20 208896 ----a-w- c:\windows\system32\NVUNINST.EXE

2011-05-03 11:45:12 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\ctor.dll

2011-05-03 11:45:12 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\DotNetInstaller.exe

2011-05-03 11:45:12 32768 ----a-w- c:\program files\common files\installshield\professional\runtime\Objectps.dll

2011-05-03 11:45:12 266240 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iscript.dll

2011-05-03 11:45:12 192512 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iuser.dll

2011-05-03 11:45:11 729088 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iKernel.dll

2011-05-03 11:45:05 311428 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\setup.dll

2011-05-03 11:45:05 188548 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iGdi.dll

2011-05-03 11:44:04 5824 ----a-w- c:\windows\system32\drivers\ASUSHWIO.SYS

2011-05-03 11:42:55 -------- d-----w- c:\program files\Delux

2011-05-03 11:42:49 225280 ------w- c:\program files\common files\installshield\iscript\iscript.dll

2011-05-03 11:42:48 77824 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll

2011-05-03 11:42:48 32768 ------w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll

2011-05-03 11:42:48 176128 ------w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll

2011-05-03 11:42:42 614532 ------w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe

2011-05-03 10:44:48 -------- d-----w- c:\windows\system32\Lang

2011-05-03 10:42:11 49152 ------r- c:\windows\system32\ChCfg.exe

2011-05-03 10:42:11 143360 ------r- c:\windows\system32\RtlCPAPI.dll

2011-05-03 10:40:59 200836 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iGdi.dll

2011-05-03 10:40:58 331908 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\setup.dll

.

==================== Find3M ====================

.

2011-05-02 21:02:57 717296 ----a-w- c:\windows\system32\drivers\sptd.sys

2011-03-04 19:44:14 59888 ------w- c:\windows\system32\pxwma.dll

2011-03-04 19:44:14 45648 ------w- c:\windows\system32\drivers\PxHelp20.sys

2011-03-04 19:44:14 133616 ------w- c:\windows\system32\pxafs.dll

2011-03-04 19:44:12 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys

2011-03-04 19:44:12 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys

2011-03-04 19:44:12 126448 ------w- c:\windows\system32\pxinsi64.exe

2011-03-04 19:44:12 123888 ------w- c:\windows\system32\pxcpyi64.exe

.

============= FINISH: 14:00:57,17 ===============

2 юни 201115 г.

Автор

И папките в маи документс изчезнаха .Също от старт менято почти всичко изчезна .Не бачка и таск мениджара. . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-06-01.06) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 03.5.2011 г. 01:04:28 System Uptime: 02.6.2011 г. 13:28:30 (1 hours ago) . Motherboard: | | K8NF6G-VSTA Processor: AMD Sempron Processor 2800+ | CPUSocket | 1607/200mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 29 GiB total, 21,43 GiB free. D: is CDROM () E: is FIXED (NTFS) - 100 GiB total, 87,087 GiB free. F: is CDROM () G: is FIXED (NTFS) - 21 GiB total, 20,443 GiB free. . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: NVIDIA nForce Networking Controller Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV03EF\4&1E6AA3F3&0&00 Manufacturer: NVIDIA Name: NVIDIA nForce Networking Controller PNP Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV03EF\4&1E6AA3F3&0&00 Service: NVENETFD . ==== System Restore Points =================== . No restore point in system. . ==== Installed Programs ====================== . Архиватор WinRAR 2007 Microsoft Office Suite Service Pack 2 (SP2) ABBYY FineReader 6.0 Adobe Reader 9.1 Apple Application Support Apple Software Update ArcSoft PhotoImpression BitTorrent BufferChm CANYON USB PC CAMERA Destinations DeviceFunctionQFolder DeviceManagementQFolder East-Tec Eraser 2011 Version 9.9 EasyBits GO EasyRecovery Professional EncryptOnClick EPSON Copy Utility EPSON Photo Print EPSON Scan EPSON Smart Panel ESET NOD32 Antivirus eSupportQFolder Google Chrome HP Deskjet 3900 series HP Imaging Device Functions 5.0 HP Software Update HP Solution Center & Imaging Support Tools 5.0 HPDeskjet3900Series HPProductAssistant IsoBuster 2.5 K-Lite Mega Codec Pack 4.4.2 KoralSoft - EuroDictXP Microsoft Office Access MUI (Bulgarian) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (Bulgarian) 2007 Microsoft Office Groove MUI (Bulgarian) 2007 Microsoft Office InfoPath MUI (Bulgarian) 2007 Microsoft Office OneNote MUI (Bulgarian) 2007 Microsoft Office Outlook MUI (Bulgarian) 2007 Microsoft Office PowerPoint MUI (Bulgarian) 2007 Microsoft Office Proof (Bulgarian) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (German) 2007 Microsoft Office Proof (Russian) 2007 Microsoft Office Proofing (Bulgarian) 2007 Microsoft Office Publisher MUI (Bulgarian) 2007 Microsoft Office Shared MUI (Bulgarian) 2007 Microsoft Office Word MUI (Bulgarian) 2007 Microsoft Software Update for Web Folders (Bulgarian) 12 Nero 6 Ultra Edition NVIDIA Drivers NVIDIA ForceWare Network Access Manager P1670 Reference Guide Presto! BizCard 4.1 Eng PS2 Keyboard English Edition 2.0 QuickTime R-Wipe&Clean 9.0 Realtek High Definition Audio Driver ScanToWeb Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB950760) Skype Toolbars Skype™ 5.3 SolutionCenter Status TrayApp Update for Windows XP (KB898461) VLC media player 1.1.9 WebFldrs XP WebReg Winamp Winamp Detector Plug-in Wise Disk Cleaner Professional v5.93 XnView 1.97.2 Your Uninstaller! 2010 . ==== Event Viewer Messages From Past Week ======== . 30.5.2011 г. 08:26:05, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 f42971c1, parameter3 f757683c, parameter4 00000000. 30.5.2011 г. 08:26:03, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 f42971c1, parameter3 ba2f583c, parameter4 00000000. 30.5.2011 г. 08:25:59, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 f42971c1, parameter3 ba0b286c, parameter4 00000000. 02.6.2011 г. 12:54:23, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\drivers\ipsec.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.5512. 02.6.2011 г. 08:51:53, error: Dhcp [1002] - The IP address lease 172.16.0.26 for the Network Card with network address 00147805D196 has been denied by the DHCP server 172.16.0.1 (The DHCP Server sent a DHCPNACK message). 01.6.2011 г. 07:19:39, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) 01.6.2011 г. 07:19:24, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) . ==== End Of File =========================== . DDS (Ver_2011-06-01.06) - NTFSx86 Internet Explorer: 7.0.5730.13 Run by Ivan at 13:59:54 on 2011-06-02 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.447.63 [GMT 4,5:30] . AV: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} FW: ActiveArmor Firewall *Disabled* . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\PixArt\PAC7302\Monitor.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Ivan\Local Settings\Application Data\Google\Update\1.3.21.53\GoogleCrashHandler.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\cisvc.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Documents and Settings\Ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\WINDOWS\system32\cidaemon.exe C:\Documents and Settings\Ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://google.bg/ BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe uRun: [Google Update] "c:\documents and settings\ivan\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [AlcoholAutomount] "c:\program files\alcohol soft\alcohol 120\axcmd.exe" /automount uRun: [bitTorrent] "c:\program files\bittorrent\BitTorrent.exe" uRun: [YDZ1QVAGOJ] c:\docume~1\ivan\locals~1\temp\Pz5.exe uRun: [ASduaswhIfbMHgW] c:\documents and settings\all users\application data\ASduaswhIfbMHgW.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [RTHDCPL] RTHDCPL.EXE mRun: [skyTel] SkyTel.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [PAC7302_Monitor] c:\windows\pixart\pac7302\Monitor.exe mRun: [WinampAgent] "c:\program files\winamp\winampa.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 uPolicies-explorer: NoDesktop = 1 (0x1) uPolicies-system: DisableTaskMgr = 1 (0x1) mPolicies-system: DisableTaskMgr = 1 (0x1) IE: &Експортиране към Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL TCP: Interfaces\{5F92F410-BD12-49A8-A997-73618998C676} : DhcpNameServer = 88.203.133.1 88.203.133.2 TCP: Interfaces\{8868AE80-FFEB-4A89-9266-A4F9E40D10B0} : NameServer = 88.203.133.1 88.203.133.2 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll . ============= SERVICES / DRIVERS =============== . R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-2-6 106208] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-2-6 93336] R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-2-6 727720] R2 SSHNAS;SSHNAS;c:\windows\system32\svchost.exe -k netsvcs [2008-4-14 14336] R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-28 275968] . =============== Created Last 30 ================ . 2011-09-06 15:29:36 -------- d-----w- c:\program files\East-Tec Eraser 2011 2011-05-29 15:14:25 210944 ----a-w- c:\windows\system32\sshnas21.dll 2011-05-29 15:06:38 -------- d-----w- c:\program files\East-Tec DisposeSecure 2007 Enterprise 2011-05-29 14:29:23 -------- d-----w- c:\program files\East-Tec DisposeSecure 2011-05-28 11:13:51 -------- d--h--w- c:\documents and settings\ivan\application data\go 2011-05-28 11:13:39 -------- d-----w- c:\documents and settings\all users\application data\Easybits GO 2011-05-27 09:15:48 -------- d--h--w- c:\documents and settings\ivan\application data\R-Wipe&Clean 2011-05-27 09:15:48 -------- d-----w- c:\program files\R-Wipe&Clean 2011-05-20 04:23:37 -------- d-----w- c:\program files\Your Uninstaller 2010 2011-05-20 04:13:38 -------- d-----w- c:\windows\XSxS 2011-05-20 04:13:38 -------- d-----w- c:\program files\Xenocode 2011-05-20 02:02:40 -------- d--h--w- c:\documents and settings\ivan\application data\Smart Panel 2011-05-20 02:00:56 -------- d-----w- c:\program files\NewSoft 2011-05-20 02:00:38 306688 ----a-w- c:\windows\IsUninst.exe 2011-05-20 01:59:43 39936 ----a-w- c:\windows\system32\drivers\CDAC11BA.EXE 2011-05-20 01:59:38 -------- d--h--w- c:\documents and settings\ivan\local settings\application data\ABBYY 2011-05-20 01:59:38 -------- d--h--w- c:\documents and settings\ivan\application data\ABBYY 2011-05-20 01:59:17 53248 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\msihook.dll 2011-05-20 01:59:17 126976 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\knlwrap.exe 2011-05-20 01:59:16 114688 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\scpthdlr.dll 2011-05-20 01:59:01 -------- d-----w- c:\program files\ABBYY 2011-05-20 01:58:53 163840 ----a-w- c:\windows\system32\PhotoImpression Screen Saver.scr 2011-05-20 01:58:32 212480 ----a-w- c:\windows\pcdlib32.dll 2011-05-20 01:57:47 708696 ----a-w- c:\windows\system32\python21.dll 2011-05-20 01:57:47 57344 ----a-w- c:\windows\system32\PyWinTypes21.dll 2011-05-20 01:57:47 290919 ----a-w- c:\windows\system32\pythoncom21.dll 2011-05-20 01:57:44 -------- d-----w- c:\program files\common files\Python 2011-05-20 01:56:38 96768 ----a-w- c:\windows\SlantAdj.dll 2011-05-20 01:56:38 73216 ----a-w- c:\windows\ADE.DLL 2011-05-20 01:56:38 3136 ----a-w- c:\windows\Ade001.bin 2011-05-20 01:56:15 -------- d-----w- c:\program files\Smart Panel 2011-05-20 01:55:53 64000 ----a-w- c:\windows\system32\ESFW30.BIN 2011-05-20 01:55:53 278528 ----a-w- c:\windows\system32\esint30.dll 2011-05-20 01:55:53 217088 ----a-w- c:\windows\system32\ESDTR.dll 2011-05-20 01:55:53 176128 ----a-w- c:\windows\system32\ESWIA30.dll 2011-05-20 01:55:51 -------- d-----w- c:\program files\EPSON 2011-05-19 17:46:32 -------- d--h--w- c:\documents and settings\ivan\application data\XnView 2011-05-19 17:46:18 -------- d-----w- c:\program files\XnView 2011-05-18 14:33:19 -------- d-----w- c:\program files\KoralSoft 2011-05-15 17:44:46 -------- d--h--w- c:\documents and settings\ivan\local settings\application data\ESET 2011-05-14 08:25:25 -------- d-----w- c:\program files\Wise Disk Cleaner 2011-05-13 03:15:27 -------- d-----w- c:\program files\2BrightSparks 2011-05-13 03:15:27 -------- d-----w- c:\documents and settings\all users\application data\2BrightSparks 2011-05-09 08:24:06 67072 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\hpzpp3xu.dll 2011-05-09 08:24:06 45056 ----a-w- c:\windows\system32\hpzll3xu.dll 2011-05-09 08:21:47 -------- d-----w- c:\program files\HP 2011-05-09 08:19:13 372736 ----a-w- c:\windows\system32\hpzidi01.dll 2011-05-09 08:19:11 77824 ----a-w- c:\windows\system32\hpzids01.dll 2011-05-06 09:09:04 -------- d--h--w- c:\documents and settings\ivan\local settings\application data\Ahead 2011-05-04 18:30:42 -------- d-----w- c:\documents and settings\all users\application data\Skype Extras 2011-05-04 17:57:39 5632 ----a-w- c:\windows\system32\ptpusb.dll 2011-05-04 17:57:39 159232 ----a-w- c:\windows\system32\ptpusd.dll 2011-05-04 17:57:39 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys 2011-05-04 17:57:39 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys 2011-05-04 10:02:53 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll 2011-05-04 10:02:47 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll 2011-05-04 10:02:09 -------- d-----w- c:\windows\Logs 2011-05-03 17:55:56 -------- d--h--w- c:\documents and settings\ivan\application data\PriceGong 2011-05-03 15:36:30 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys 2011-05-03 15:36:30 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys 2011-05-03 15:35:30 48128 ----a-w- c:\windows\system32\Remove.exe 2011-05-03 15:35:28 6656 ----a-w- c:\windows\system32\CoInst_071029.dll 2011-05-03 15:35:28 458752 ----a-w- c:\windows\system32\drivers\PAC7302.SYS 2011-05-03 15:35:27 -------- d-----w- c:\program files\ANC 2011-05-03 15:35:26 129024 ----a-w- c:\windows\system32\SP7302.AX 2011-05-03 15:35:25 14336 ----a-w- c:\windows\system32\P7302USD.dll 2011-05-03 15:35:24 -------- d-----w- c:\windows\PixArt 2011-05-03 15:35:24 -------- d-----w- c:\program files\common files\PAC7302 2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll 2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll 2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll 2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll 2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll 2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll 2011-05-03 12:43:34 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll 2011-05-03 12:42:27 -------- d--h--w- c:\documents and settings\ivan\local settings\application data\Apple 2011-05-03 12:42:16 -------- d--h--w- c:\documents and settings\ivan\local settings\application data\Apple Computer 2011-05-03 12:39:31 -------- d-----w- c:\program files\VideoLAN 2011-05-03 12:32:14 -------- d-----w- c:\program files\Ontrack 2011-05-03 11:50:20 -------- d-----w- c:\program files\NVIDIA Corporation 2011-05-03 11:49:15 442368 ----a-w- c:\windows\system32\CapabilityTable.exe 2011-05-03 11:49:04 208896 ------w- c:\windows\system32\nvuide.exe 2011-05-03 11:49:02 363008 ----a-r- c:\windows\system32\idecoiins.dll 2011-05-03 11:49:02 363008 ----a-r- c:\windows\system32\idecoi.dll 2011-05-03 11:49:02 35840 ----a-r- c:\windows\system32\NVCOI.DLL 2011-05-03 11:45:59 -------- d-----w- c:\windows\nview 2011-05-03 11:45:58 208896 ----a-w- c:\windows\system32\nvudisp.exe 2011-05-03 11:45:58 -------- d-----w- c:\windows\NV2803540.TMP 2011-05-03 11:45:20 208896 ----a-w- c:\windows\system32\NVUNINST.EXE 2011-05-03 11:45:12 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\ctor.dll 2011-05-03 11:45:12 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\DotNetInstaller.exe 2011-05-03 11:45:12 32768 ----a-w- c:\program files\common files\installshield\professional\runtime\Objectps.dll 2011-05-03 11:45:12 266240 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iscript.dll 2011-05-03 11:45:12 192512 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iuser.dll 2011-05-03 11:45:11 729088 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iKernel.dll 2011-05-03 11:45:05 311428 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\setup.dll 2011-05-03 11:45:05 188548 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iGdi.dll 2011-05-03 11:44:04 5824 ----a-w- c:\windows\system32\drivers\ASUSHWIO.SYS 2011-05-03 11:42:55 -------- d-----w- c:\program files\Delux 2011-05-03 11:42:49 225280 ------w- c:\program files\common files\installshield\iscript\iscript.dll 2011-05-03 11:42:48 77824 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll 2011-05-03 11:42:48 32768 ------w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll 2011-05-03 11:42:48 176128 ------w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll 2011-05-03 11:42:42 614532 ------w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe 2011-05-03 10:44:48 -------- d-----w- c:\windows\system32\Lang 2011-05-03 10:42:11 49152 ------r- c:\windows\system32\ChCfg.exe 2011-05-03 10:42:11 143360 ------r- c:\windows\system32\RtlCPAPI.dll 2011-05-03 10:40:59 200836 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iGdi.dll 2011-05-03 10:40:58 331908 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\setup.dll . ==================== Find3M ==================== . 2011-05-02 21:02:57 717296 ----a-w- c:\windows\system32\drivers\sptd.sys 2011-03-04 19:44:14 59888 ------w- c:\windows\system32\pxwma.dll 2011-03-04 19:44:14 45648 ------w- c:\windows\system32\drivers\PxHelp20.sys 2011-03-04 19:44:14 133616 ------w- c:\windows\system32\pxafs.dll 2011-03-04 19:44:12 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys 2011-03-04 19:44:12 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys 2011-03-04 19:44:12 126448 ------w- c:\windows\system32\pxinsi64.exe 2011-03-04 19:44:12 123888 ------w- c:\windows\system32\pxcpyi64.exe . ============= FINISH: 14:00:57,17 ===============

Редактирано 2 юни 201115 г. от vankytyg (преглед на промените)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

2 юни 201115 г.

Здравейте...!Една нехараактерна процедура за нашия подраздел ...но няма начин..налага се:

Изтеглете Unhide.exe Запазете я на десктопа си..Стартирате с двоен клик върху иконата...Програмата ще премахне атрибут ''hidden'' на всички папки на твърдия ви диск..!

Копирайте съдържаниет на тази папка:

C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\1

и я посравете ( paste) в тази папка:

C:\Documents and Settings\All Users\Start Menu

Копирайте съдържаниет на тази папка:

C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\2

и я посравете ( paste) в тази папка:

C:\Documents and Settings\user_name\Application Data\Microsoft\Internet Explorer\Quick Launch

Копирайте съдържаниет на тази папка:

C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\3

и я посравете ( paste) в тази папка:

C:\Documents and Settings\user_name\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

Копирайте съдържаниет на тази папка:

C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\4

и я посравете ( paste) в тази папка:

C:\Documents and Settings\All Users\Desktop

2 юни 201115 г.

Автор

Появиха се нещата в май-документс и някои работи от старт менюто но тези папки пише че ги няма .

2 юни 201115 г.

Направи скритите системни папки видими и ще я намериш! Старт---Контрол панел---Облик и персонализиране---Опции на папките--Изглед--Сложи отметка най-долу както съм дал на снимката и потвърди

2 юни 201115 г.

Автор

Направи скритите системни папки видими и ще я намериш!
Старт---Контрол панел---Облик и персонализиране---Опции на папките--Изглед--Сложи отметка най-долу както съм дал на снимката и потвърди

И Таск мениджара неще да се отвори.

Направих го но отново не ми позволява да отида тук C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\1

и я посравете ( paste) в тази папка:

C:\Documents and Settings\All Users\Start Menu

Копирайте съдържаниет на тази папка:

C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\2

и я посравете ( paste) в тази папка:

C:\Documents and Settings\user_name\Application Data\Microsoft\Internet Explorer\Quick Launch

Копирайте съдържаниет на тази папка:

C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\3

и я посравете ( paste) в тази папка:

C:\Documents and Settings\user_name\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

Копирайте съдържаниет на тази папка:

C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\4

и я посравете ( paste) в тази папка:

C:\Documents and Settings\All Users\Desktop

и на декстопа не може нищо да се прави

Здравейте...!Една нехараактерна процедура за нашия подраздел ...но няма начин..налага се:

Изтеглете Unhide.exe Запазете я на десктопа си..Стартирате с двоен клик върху иконата...Програмата ще премахне атрибут ''hidden'' на всички папки на твърдия ви диск..!

Копирайте съдържаниет на тази папка:
C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\1

и я посравете ( paste) в тази папка:
C:\Documents and Settings\All Users\Start Menu

Копирайте съдържаниет на тази папка:
C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\2

и я посравете ( paste) в тази папка:
C:\Documents and Settings\user_name\Application Data\Microsoft\Internet Explorer\Quick Launch

Копирайте съдържаниет на тази папка:
C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\3

и я посравете ( paste) в тази папка:
C:\Documents and Settings\user_name\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

Копирайте съдържаниет на тази папка:
C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\4

и я посравете ( paste) в тази папка:
C:\Documents and Settings\All Users\Desktop

Оправих старт менюто Смених адреса на C:\Documents and Settings\Ivan\Local Settings\Temp\smtmp\1\Programs

Здравейте...!Една нехараактерна процедура за нашия подраздел ...но няма начин..налага се:

Изтеглете Unhide.exe Запазете я на десктопа си..Стартирате с двоен клик върху иконата...Програмата ще премахне атрибут ''hidden'' на всички папки на твърдия ви диск..!

Копирайте съдържаниет на тази папка:
C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\1

и я посравете ( paste) в тази папка:
C:\Documents and Settings\All Users\Start Menu

Копирайте съдържаниет на тази папка:
C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\2

и я посравете ( paste) в тази папка:
C:\Documents and Settings\user_name\Application Data\Microsoft\Internet Explorer\Quick Launch

Копирайте съдържаниет на тази папка:
C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\3

и я посравете ( paste) в тази папка:
C:\Documents and Settings\user_name\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

Копирайте съдържаниет на тази папка:
C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\4

и я посравете ( paste) в тази папка:
C:\Documents and Settings\All Users\Desktop

Вече имам достъп до декстопа но Таск мениджъра не бачка.

И Таск мениджара неще да се отвори.
Направих го но отново не ми позволява да отида тук C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\1

и я посравете ( paste) в тази папка:

C:\Documents and Settings\All Users\Start Menu

Копирайте съдържаниет на тази папка:

C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\2

и я посравете ( paste) в тази папка:

C:\Documents and Settings\user_name\Application Data\Microsoft\Internet Explorer\Quick Launch

Копирайте съдържаниет на тази папка:

C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\3

и я посравете ( paste) в тази папка:

C:\Documents and Settings\user_name\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

Копирайте съдържаниет на тази папка:

C:\Documents and Settings\user_name\Local Settings\Temp\smtmp\4

и я посравете ( paste) в тази папка:

C:\Documents and Settings\All Users\Desktop
и на декстопа не може нищо да се прави

Оправих старт менюто Смених адреса на C:\Documents and Settings\Ivan\Local Settings\Temp\smtmp\1\Programs

Вече имам достъп до декстопа но Таск мениджъра не бачка.

Прочетох от един сайт и Таск Мениджара вече работи но има друг проблем Като дам на пропартис декстоп не ми дава да избирам картинки от там .

Редактирано 2 юни 201115 г. от vankytyg (преглед на промените)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

2 юни 201115 г.

Така...хубаво,успяхме да постигнем някъкъв успех...сега имам съмнение че причината е рууткита TDL3.За целта:

Изтеглете TDSSKiller и го разархивирайте на десктопa.
Стартирайте TDSSKiller.exe, след това натиснете бутона Start Scan.
Ако бъде открит зловреден (malicious) файл, проверете дали е избрана опцията Cure (по подразбиране). Ако е избрана Cure - натиснете Continue
Ако бъде открит подозрителен (suspicious) файл, проверете дали е избрана опцията Skip (по подразбиране). Ако е избрана Skip - натиснете Continue.
Изберете skip и за sptd услугата:
Възможно е програмата да изиска рестарт. Ако е така - потвърдете с Reboot Now.

-Ако няма рестартиране, отидете на Report. Ще се появи лог файл. Копирайте и поставете съдържанието му в следващия си коментар.

-Ако има рестартиране, отидете на в основаната директория на дял C:\. Там трябва да има файл с формат: TDSSKiller.[Version]_[Date]_[Time]_log.txt. Отворете го, копирайте и поставете съдържанието му в следващия си коментар.

2 юни 201115 г.

Автор

Така...хубаво,успяхме да постигнем някъкъв успех...сега имам съмнение че причината е рууткита TDL3.За целта:

Изтеглете TDSSKiller и го разархивирайте на десктопa.

Стартирайте TDSSKiller.exe, след това натиснете бутона Start Scan.

Ако бъде открит зловреден (malicious) файл, проверете дали е избрана опцията Cure (по подразбиране). Ако е избрана Cure - натиснете Continue

Ако бъде открит подозрителен (suspicious) файл, проверете дали е избрана опцията Skip (по подразбиране). Ако е избрана Skip - натиснете Continue.

Изберете skip и за sptd услугата:

Възможно е програмата да изиска рестарт. Ако е така - потвърдете с Reboot Now.

-Ако няма рестартиране, отидете на Report. Ще се появи лог файл. Копирайте и поставете съдържанието му в следващия си коментар.

-Ако има рестартиране, отидете на в основаната директория на дял C:\. Там трябва да има файл с формат: TDSSKiller.[Version]_[Date]_[Time]_log.txt. Отворете го, копирайте и поставете съдържанието му в следващия си коментар.

Написами че няма заразени фаилове.

Редактирано 2 юни 201115 г. от vankytyg (преглед на промените)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

2 юни 201115 г.

Може ли да видя лога за моя информация..!Благодаря предварително..! :giggle1:

2 юни 201115 г.

Автор

Може ли да видя лога за моя информация..!Благодаря предварително..!

Да. Eто го лога.

TDSSKiller.2.5.3.0_02.06.2011_16.58.31_log.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

2 юни 201115 г.

Добре..да продължим така:

Изтеглете ComboFix от тук или тук и го запазете на десктопа си.

Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

Стартирайте Combo-Fix.com и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

Публикувано изображение

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Публикувано изображение

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

2 юни 201115 г.

Автор

Добре..да продължим така:

Изтеглете ComboFix от тук или тук и го запазете на десктопа си.

Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

Стартирайте Combo-Fix.com и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.

ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.

ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.

ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.

В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

Eто лог фаила .

ComboFix 11-06-01.07 - Ivan 06.2011 г. 17:56:16.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.447.168 [GMT 4,5:30]

Running from: c:\documents and settings\Ivan\My Documents\Downloads\ComboFix.exe

AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: ActiveArmor Firewall *Disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Ivan\Application Data\PriceGong

c:\documents and settings\Ivan\Application Data\PriceGong\Data\1.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\a.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\b.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\c.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\d.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\e.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\f.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\g.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\h.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\i.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\J.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\k.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\l.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\m.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\n.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\o.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\p.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\q.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\r.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\s.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\t.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\u.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\v.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\w.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\x.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\y.xml

c:\documents and settings\Ivan\Application Data\PriceGong\Data\z.xml

c:\windows\system32\sshnas21.dll

c:\windows\XSxS

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_SSHNAS

-------\Service_SSHNAS

.

((((((((((((((((((((((((( Files Created from 2011-05-02 to 2011-06-02 )))))))))))))))))))))))))))))))

.

2011-09-06 15:29 . 2011-09-06 15:30 -------- d-----w- c:\program files\East-Tec Eraser 2011

2011-09-06 15:28 . 2011-09-06 15:43 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe

2011-06-02 12:06 . 2011-06-02 12:06 -------- d--h--w- c:\windows\system32\GroupPolicy

2011-05-29 15:06 . 2011-05-29 15:12 -------- d-----w- c:\program files\East-Tec DisposeSecure 2007 Enterprise

2011-05-29 14:29 . 2011-05-29 14:50 -------- d-----w- c:\program files\East-Tec DisposeSecure

2011-05-28 11:13 . 2011-05-28 11:13 -------- d-----w- c:\documents and settings\Ivan\Application Data\go

2011-05-28 11:13 . 2011-06-01 12:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Easybits GO

2011-05-27 09:15 . 2011-05-31 11:20 -------- d-----w- c:\documents and settings\Ivan\Application Data\R-Wipe&Clean

2011-05-27 09:15 . 2011-05-27 10:09 -------- d-----w- c:\program files\R-Wipe&Clean

2011-05-20 04:23 . 2011-05-20 04:27 -------- d-----w- c:\program files\Your Uninstaller 2010

2011-05-20 04:13 . 2011-05-20 04:13 -------- d-----w- c:\program files\Xenocode

2011-05-20 02:05 . 2011-05-20 02:05 -------- d-----w- c:\documents and settings\Ivan\Application Data\EPSON

2011-05-20 02:02 . 2011-05-20 02:17 -------- d-----w- c:\documents and settings\Ivan\Application Data\Smart Panel

2011-05-20 02:00 . 2011-05-20 02:00 -------- d-----w- c:\program files\NewSoft

2011-05-20 02:00 . 1998-10-29 11:15 306688 ----a-w- c:\windows\IsUninst.exe

2011-05-20 01:59 . 2011-05-20 01:59 39936 ----a-w- c:\windows\system32\drivers\CDAC11BA.EXE

2011-05-20 01:59 . 2011-05-20 01:59 -------- d-----w- c:\documents and settings\Ivan\Local Settings\Application Data\ABBYY

2011-05-20 01:59 . 2011-05-20 01:59 -------- d-----w- c:\documents and settings\Ivan\Application Data\ABBYY

2011-05-20 01:59 . 2011-05-20 01:59 53248 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\msihook.dll

2011-05-20 01:59 . 2011-05-20 01:59 126976 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\knlwrap.exe

2011-05-20 01:59 . 2011-05-20 01:59 114688 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\scpthdlr.dll

2011-05-20 01:59 . 2011-05-20 04:28 -------- d-----w- c:\program files\ABBYY

2011-05-20 01:58 . 2001-10-16 05:53 163840 ----a-w- c:\windows\system32\PhotoImpression Screen Saver.scr

2011-05-20 01:58 . 2011-05-20 01:58 -------- d-----w- c:\program files\ArcSoft

2011-05-20 01:58 . 1999-05-26 05:16 212480 ----a-w- c:\windows\pcdlib32.dll

2011-05-20 01:57 . 2001-10-19 07:49 57344 ----a-w- c:\windows\system32\PyWinTypes21.dll

2011-05-20 01:57 . 2001-10-19 07:48 708696 ----a-w- c:\windows\system32\python21.dll

2011-05-20 01:57 . 2001-10-19 07:48 290919 ----a-w- c:\windows\system32\pythoncom21.dll

2011-05-20 01:57 . 2011-05-20 01:57 -------- d-----w- c:\program files\Common Files\Python

2011-05-20 01:56 . 1999-12-06 21:33 73216 ----a-w- c:\windows\ADE.DLL

2011-05-20 01:56 . 1999-06-15 07:01 96768 ----a-w- c:\windows\SlantAdj.dll

2011-05-20 01:56 . 1999-04-26 19:47 3136 ----a-w- c:\windows\Ade001.bin

2011-05-20 01:56 . 2011-05-20 02:18 -------- d-----w- c:\program files\Smart Panel

2011-05-20 01:55 . 2003-03-28 12:27 278528 ----a-w- c:\windows\system32\esint30.dll

2011-05-20 01:55 . 2003-03-28 12:26 176128 ----a-w- c:\windows\system32\ESWIA30.dll

2011-05-20 01:55 . 2003-03-28 12:20 64000 ----a-w- c:\windows\system32\ESFW30.BIN

2011-05-20 01:55 . 2003-03-09 19:30 217088 ----a-w- c:\windows\system32\ESDTR.dll

2011-05-20 01:55 . 2011-05-20 02:02 -------- d-----w- c:\program files\EPSON

2011-05-19 17:46 . 2011-05-20 04:08 -------- d-----w- c:\documents and settings\Ivan\Application Data\XnView

2011-05-19 17:46 . 2011-05-19 17:46 -------- d-----w- c:\program files\XnView

2011-05-18 14:33 . 2011-05-18 14:33 -------- d-----w- c:\program files\KoralSoft

2011-05-15 17:44 . 2011-05-15 17:44 -------- d-----w- c:\documents and settings\Ivan\Local Settings\Application Data\ESET

2011-05-14 08:25 . 2011-05-29 08:28 -------- d-----w- c:\program files\Wise Disk Cleaner

2011-05-13 03:15 . 2011-05-13 03:15 -------- d-----w- c:\program files\2BrightSparks

2011-05-13 03:15 . 2011-05-13 03:15 -------- d-----w- c:\documents and settings\All Users\Application Data\2BrightSparks

2011-05-12 18:05 . 2011-05-12 18:05 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET

2011-05-09 08:24 . 2005-04-08 15:14 45056 ----a-w- c:\windows\system32\hpzll3xu.dll

2011-05-09 08:24 . 2005-04-08 15:13 67072 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp3xu.dll

2011-05-09 08:22 . 2011-05-09 08:22 -------- d-----w- c:\program files\Hewlett-Packard

2011-05-09 08:22 . 2011-05-09 08:22 -------- d-----w- c:\documents and settings\All Users\Application Data\HP

2011-05-09 08:21 . 2011-05-09 08:22 -------- d-----w- c:\program files\HP

2011-05-09 08:19 . 2011-05-09 08:25 -------- d-----w- c:\documents and settings\Ivan\Application Data\HP

2011-05-09 08:19 . 2005-04-28 01:38 372736 ----a-w- c:\windows\system32\hpzidi01.dll

2011-05-09 08:19 . 2005-04-28 01:37 77824 ----a-w- c:\windows\system32\hpzids01.dll

2011-05-06 09:09 . 2011-05-06 09:09 -------- d-----w- c:\documents and settings\Ivan\Local Settings\Application Data\Ahead

2011-05-05 15:39 . 2011-05-05 15:39 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\BitTorrentBar

2011-05-05 15:39 . 2011-05-05 15:39 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple

2011-05-04 18:30 . 2011-06-01 12:44 -------- d-----w- c:\documents and settings\Ivan\Application Data\skypePM

2011-05-04 18:30 . 2011-06-01 12:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype Extras

2011-05-04 17:57 . 2008-04-14 05:12 159232 ----a-w- c:\windows\system32\ptpusd.dll

2011-05-04 17:57 . 2008-04-13 23:45 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys

2011-05-04 17:57 . 2008-04-13 23:45 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2011-05-04 17:57 . 2001-08-17 22:06 5632 ----a-w- c:\windows\system32\ptpusb.dll

2011-05-04 10:02 . 2009-09-04 12:59 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

2011-05-04 10:02 . 2006-09-28 11:35 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll

2011-05-04 10:02 . 2011-05-04 10:02 -------- d-----w- c:\windows\Logs

2011-05-03 15:37 . 2008-04-13 23:39 5504 -c--a-w- c:\windows\system32\dllcache\mstee.sys

2011-05-03 15:36 . 2008-04-13 23:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys

2011-05-03 15:36 . 2008-04-13 23:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2011-05-03 15:35 . 2007-10-04 13:12 48128 ----a-w- c:\windows\system32\Remove.exe

2011-05-03 15:35 . 2007-11-08 05:59 458752 ----a-w- c:\windows\system32\drivers\PAC7302.SYS

2011-05-03 15:35 . 2007-11-02 06:37 6656 ----a-w- c:\windows\system32\CoInst_071029.dll

2011-05-03 15:35 . 2011-05-03 15:35 -------- d-----w- c:\program files\ANC

2011-05-03 15:35 . 2007-10-30 13:18 129024 ----a-w- c:\windows\system32\SP7302.AX

2011-05-03 15:35 . 2006-10-12 07:27 14336 ----a-w- c:\windows\system32\P7302USD.dll

2011-05-03 15:35 . 2011-05-03 15:35 -------- d-----w- c:\program files\Common Files\PAC7302

2011-05-03 15:35 . 2011-05-03 15:35 -------- d-----w- c:\windows\PixArt

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-05-02 21:02 . 2011-05-02 21:02 717296 ----a-w- c:\windows\system32\drivers\sptd.sys

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2008-07-12 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-02-24 203928]

"BitTorrent"="c:\program files\BitTorrent\BitTorrent.exe" [2011-05-02 4770672]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-12 7626752]

"nwiz"="nwiz.exe" [2006-07-12 1519616]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-12 86016]

"RTHDCPL"="RTHDCPL.EXE" [2006-08-01 16049664]

"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2011-03-22 74752]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_2"="shell32" [X]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

PS2 Keyboard English Edition 2.0.lnk - c:\program files\Delux\PS2 Keyboard English Edition 2.0\kb_2k.exe [2011-5-3 262144]

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=

"c:\\Program Files\\Winamp\\winamp.exe"=

.

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [03.5.2011 г. 01:32 717296]

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [06.2.2009 г. 14:23 106208]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [06.2.2009 г. 14:24 93336]

R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [06.2.2009 г. 14:23 727720]

.

Contents of the 'Scheduled Tasks' folder

.

2011-05-26 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 08:04]

.

2011-06-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1343024091-688789844-1177238915-1003Core.job

- c:\documents and settings\Ivan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-02 21:07]

.

2011-06-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1343024091-688789844-1177238915-1003UA.job

- c:\documents and settings\Ivan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-02 21:07]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.bg/

IE: &Експортиране към Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: Interfaces\{8868AE80-FFEB-4A89-9266-A4F9E40D10B0}: NameServer = 88.203.133.1 88.203.133.2

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-ASduaswhIfbMHgW - c:\documents and settings\All Users\Application Data\ASduaswhIfbMHgW.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-06-02 18:03

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\.ipsec]

"ImagePath"="\*"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(2700)

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\drivers\CDAC11BA.EXE

c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

c:\windows\system32\nvsvc32.exe

c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

c:\windows\system32\RUNDLL32.EXE

c:\windows\RTHDCPL.EXE

c:\windows\system32\wscntfy.exe

c:\documents and settings\Ivan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

.

**************************************************************************

.

Completion time: 2011-06-02 18:06:06 - machine was rebooted

ComboFix-quarantined-files.txt 2011-06-02 13:35

.

Pre-Run: 22 937 378 816 bytes free

Post-Run: 22 880 018 432 bytes free

.

- - End Of File - - B2398BB62E9B9FBA861055184D6E153D

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

2 юни 201115 г.

След изпълнението на сканирането как е положението със системата..?

2 юни 201115 г.

Автор

След изпълнението на сканирането как е положението със системата..?

Всичко е ОК . Само ,че ми се появиха две възможноси за избиране като включа Лундолса. Все едно имам два Лундолса.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

2 юни 201115 г.

Хм...ще помисля по въпроса ...!

Деинсталирай Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

Публикувано изображение

2.Изтеглете OTCleanIt или от тук,стартирайте и натиснете Clean up

2 юни 201115 г.

Автор

Хм...ще помисля по въпроса ...!

Деинсталирай Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

2.Изтеглете OTCleanIt или от тук,стартирайте и натиснете Clean up

Почистих с OTCleanI и премахнах Combofix .

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

2 юни 201115 г.

Старт---Контрол панел---Облик и персонализиране---Опции на папките--Изглед--Сложи отметка така:

2 юни 201115 г.

Автор

Старт---Контрол панел---Облик и персонализиране---Опции на папките--Изглед--Сложи отметка така:

Готово. Благодаря много .

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

2 юни 201115 г.

Само ,че ми се появиха две възможноси за избиране като включа Лундолса. Все едно имам два Лундолса.

Сега тук вече няма проблеми ...така ли да разбирам..?

2 юни 201115 г.

Автор

Сега тук вече няма проблеми ...така ли да разбирам..?

Всичко вече е наред.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

2 юни 201115 г.

Благодаря ...Добра работа...Пожелавам ви лека и спокойна вечер..! Поздрави..! Ицо

Добре дошли!

Вирус ми блокира декстопа [РЕШЕН]

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)