Заразена система (Security Guard)

13 юли 201115 г.

Здравейте, надявам се на своевременна помощ от ваша страна, тъй като сам изглежда не мога да се справя с проблема. Машината, почти със сигурност, е заразена в доста голяма степен. Въпросната програма (от заглавието на темата) се представя като антивирусна програма, която блокира стартирането на абсолютно всякакви приложения и програми. Предлага "почистване на системата", което реално не се извършва, иска някакво плащане. Блокира също така достъпа на всички браузери до интернет. В момента пиша от заразената машина, която е под Safe mode with networking. Операционната система е Windows XP SP3. Прилагам логовете от DDS: . DDS (Ver_2011-06-23.01) - NTFSx86 NETWORK Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_24 Run by Shef at 9:01:47 on 2011-07-13 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.959.784 [GMT 3:00] . AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7} . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\system32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE . ============== Pseudo HJT Report =============== . uStart Page = about:blank BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File {555d4d79-4bd2-4094-a395-cfc534424a05} uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized uRunOnce: [lgbva] c:\docume~1\shef~1.cha\locals~1\applic~1\lgbva.exe mRun: [bigDogPath] c:\windows\VM301Snap.exe Vimicro USB PC Camera (ZC0301PL) mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min mRun: [Domino] c:\windows\Domino.exe mRun: [VTTimer] VTTimer.exe mRun: [smapp] c:\program files\analog devices\soundmax\SMTray.exe mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray dRunOnce: [iE8] rundll32 advpack.dll,LaunchINFSection IE8.INF,FirstUserStart dRunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab TCP: DhcpNameServer = 217.18.242.146 217.9.224.206 TCP: Interfaces\{2258FE74-81E8-4BAB-9373-B7B0DC79DE01} : DhcpNameServer = 217.18.242.146 217.9.224.206 SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\shef.changeme1\application data\mozilla\firefox\profiles\8ra5h17s.default\ FF - prefs.js: browser.startup.homepage - google.bg FF - plugin: c:\program files\foxit software\foxit reader\plugins\npFoxitReaderPlugin.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll . ============= SERVICES / DRIVERS =============== . S1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2011-4-11 11608] S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-4-11 136360] S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-4-11 269480] S2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-4-11 66616] S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-4-11 366640] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-4-11 22712] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-4-11 39984] . =============== Created Last 30 ================ . 2011-07-13 05:51:02 -------- d-----w- c:\documents and settings\shef.changeme1\application data\Malwarebytes 2011-07-12 14:42:43 342016 ----a-w- c:\documents and settings\shef.changeme1\local settings\application data\lgbva.exe 2011-06-24 14:25:54 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll 2011-06-24 14:25:54 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll 2011-06-14 12:57:18 -------- d-----w- c:\documents and settings\shef.changeme1\application data\HpUpdate 2011-06-14 12:56:50 -------- d-----w- c:\windows\Cache 2011-06-14 12:56:49 -------- d-----w- c:\program files\Coupons 2011-06-14 12:56:31 -------- d-----w- c:\program files\HP Photo Creations 2011-06-14 12:56:31 -------- d-----w- c:\documents and settings\all users\application data\HP Photo Creations . ==================== Find3M ==================== . 2011-07-04 05:57:35 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2011-06-08 05:30:29 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-06-07 08:02:04 44 ----a-w- c:\windows\system32\msssc.dll 2011-05-29 06:11:30 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-05-29 06:11:20 22712 ----a-w- c:\windows\system32\drivers\mbam.sys . ============= FINISH: 9:02:18.18 =============== Atach.txt: . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-06-23.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume5 Install Date: 17.6.2010 г. 12:08:50 System Uptime: 13.7.2011 г. 09:00:50 (0 hours ago) . Motherboard: ASUSTek Computer INC. | | A7V400-MX SE Processor: AMD Sempron 2400+ | Socket A | 1659/166mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 15 GiB total, 1.849 GiB free. D: is FIXED (NTFS) - 62 GiB total, 28.905 GiB free. E: is FIXED (NTFS) - 15 GiB total, 8.981 GiB free. F: is CDROM () G: is FIXED (NTFS) - 40 GiB total, 1.194 GiB free. H: is FIXED (NTFS) - 50 GiB total, 1.001 GiB free. I: is FIXED (FAT32) - 48 GiB total, 0.332 GiB free. J: is Removable . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Photosmart C4400 series Device ID: USB\VID_03F0&PID_6C11&MI_00\6&3658F857&0&0000 Manufacturer: Name: Photosmart C4400 series PNP Device ID: USB\VID_03F0&PID_6C11&MI_00\6&3658F857&0&0000 Service: . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Photosmart C4400 series Device ID: USB\VID_03F0&PID_6C11&MI_02\6&3658F857&0&0002 Manufacturer: Name: Photosmart C4400 series PNP Device ID: USB\VID_03F0&PID_6C11&MI_02\6&3658F857&0&0002 Service: . ==== System Restore Points =================== . RP41: 02.6.2011 г. 14:36:19 - System Checkpoint RP42: 03.6.2011 г. 14:58:10 - System Checkpoint RP43: 04.6.2011 г. 15:40:03 - System Checkpoint RP44: 05.6.2011 г. 17:41:28 - System Checkpoint RP45: 07.6.2011 г. 09:21:24 - Installed PowerArchiver 2010 RP46: 07.6.2011 г. 09:32:30 - Before installing new drivers - 07.6.2011 г. 09:32:26 RP47: 07.6.2011 г. 10:01:30 - Installed SoundMAX RP48: 07.6.2011 г. 10:01:47 - Installed SoundMAX RP49: 08.6.2011 г. 10:32:52 - System Checkpoint RP50: 09.6.2011 г. 11:32:52 - System Checkpoint RP51: 11.6.2011 г. 13:01:18 - System Checkpoint RP52: 12.6.2011 г. 13:28:12 - System Checkpoint RP53: 13.6.2011 г. 14:13:09 - System Checkpoint RP54: 14.6.2011 г. 14:36:42 - System Checkpoint RP55: 15.6.2011 г. 14:47:38 - System Checkpoint RP56: 16.6.2011 г. 08:41:49 - Removed HP Update. RP57: 17.6.2011 г. 09:42:24 - System Checkpoint RP58: 18.6.2011 г. 11:46:17 - System Checkpoint RP59: 20.6.2011 г. 10:09:34 - System Checkpoint RP60: 21.6.2011 г. 12:05:47 - System Checkpoint RP61: 22.6.2011 г. 13:01:41 - System Checkpoint RP62: 23.6.2011 г. 13:48:03 - System Checkpoint RP63: 24.6.2011 г. 16:47:33 - System Checkpoint RP64: 27.6.2011 г. 08:42:24 - System Checkpoint RP65: 28.6.2011 г. 09:20:25 - System Checkpoint RP66: 29.6.2011 г. 10:35:40 - System Checkpoint RP67: 04.7.2011 г. 09:57:28 - System Checkpoint RP68: 05.7.2011 г. 10:58:23 - System Checkpoint RP69: 08.7.2011 г. 11:19:46 - System Checkpoint RP70: 09.7.2011 г. 12:12:18 - System Checkpoint RP71: 10.7.2011 г. 13:04:07 - System Checkpoint RP72: 11.7.2011 г. 14:02:12 - System Checkpoint RP73: 12.7.2011 г. 14:58:58 - System Checkpoint . ==== Installed Programs ====================== . 32 Bit HP CIO Components Installer Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Avira AntiVir Personal - Free Antivirus BufferChm Bulgarian Keyboards XP by G. Atanasov CCleaner Copy Coupon Printer for Windows Defraggler Destinations DeviceDiscovery DJ_AIO_05_F4400_Software_Min F4400 Foxit Reader GPBaseService2 Hotfix for Windows XP (KB970653-v3) HP Deskjet F4400 Printer Driver Software 14.0 Rel. 5 HP Imaging Device Functions 14.0 HP Photo Creations HP Solution Center 14.0 HPProductAssistant HPSSupply Java Auto Updater Java 6 Update 24 Malwarebytes' Anti-Malware version 1.51.0.1200 Microsoft Office Professional Edition 2003 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Mozilla Firefox 5.0 (x86 bg) Opera 11.01 PowerArchiver 2010 PS_AIO_03_C4400_ProductContext S3 S3Display S3 S3Gamma2 S3 S3Info2 S3 S3Overlay SA Dictionary 2005 T2 Scan Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB941569) Sereby's Updatepack - IE8 Addon Version 1.0.7 Shop for HP Supplies Skype™ 3.8 SolutionCenter SopCast 3.3.2 SoundMAX Speccy Status Toolbox TrayApp UniChrome IGP Driver and Utilities WebFldrs XP WebReg . ==== Event Viewer Messages From Past Week ======== . 13.7.2011 г. 09:01:42, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 13.7.2011 г. 08:57:52, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume5'. It has stopped monitoring the volume. 13.7.2011 г. 08:56:53, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 13.7.2011 г. 08:51:38, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK7 avgio avipbb Fips ssmdrv 13.7.2011 г. 08:50:31, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 13.7.2011 г. 08:38:46, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 13.7.2011 г. 08:38:36, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 13.7.2011 г. 08:37:15, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 13.7.2011 г. 08:36:43, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 13.7.2011 г. 08:36:40, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 13.7.2011 г. 08:36:40, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 13.7.2011 г. 08:36:40, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 13.7.2011 г. 08:36:33, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 13.7.2011 г. 08:35:08, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK7 avgio avipbb Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss ssmdrv Tcpip 13.7.2011 г. 08:35:08, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning. 13.7.2011 г. 08:35:08, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. 13.7.2011 г. 08:35:08, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 13.7.2011 г. 08:35:08, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning. 13.7.2011 г. 08:34:21, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 13.7.2011 г. 08:34:14, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E} 12.7.2011 г. 17:46:04, error: System Error [1003] - Error code 0000000a, parameter1 895f2fc0, parameter2 00000002, parameter3 00000000, parameter4 804f9908. . ==== End Of File =========================== Предварително благодаря, разчитам на помощта ви, тъй като машината е важна и на нея се работи, а в момента е блокирана поради този проблем.

Редактирано 13 юли 201115 г. от The_Reaver (преглед на промените)

13 юли 201115 г.

Иди в Administrative Tools --> Services и дай опресняване от контексното меню показващо се при кликване с десният бутон на мишката върху DCOM server process launcher сервиза! Извинявам се за офтопика.

2. Не пишете в чужда тема, а само във вашата.

13 юли 201115 г.

Автор

Иди в Administrative Tools --> Services и дай опресняване от контексното меню показващо се при кликване с десният бутон на мишката върху DCOM server process launcher сервиза! Извинявам се за офтопика.

Не разбрах с каква цел е това, но го направих.

13 юли 201115 г.

Не разбрах с каква цел е това, но го направих.

Сега спри този сервиз: Start > Programs > Control Panel > Administrative Tools > Services> Windows Image Acquisition, като от менюто Properties появяващо се след кликване с десният бутон на иконата на сервиза, в General>Startup Type избереш Disabled. Дава грешка при стартирането на този сервиз обслужващ работата с камери и сканиращи устройства.

2. Не пишете в чужда тема, а само във вашата.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

13 юли 201115 г.

Здравейте....!Както сте в Safe mode with networking :

Изтеглете ComboFix от тук или тук и го запазете на десктопа си.

Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

Стартирайте Combo-Fix.com и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

Публикувано изображение

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Публикувано изображение

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

13 юли 201115 г.

Автор

LOG-a от ComboFIX: ComboFix 11-07-12.09 - Shef 07.2011 г. 10:32:23.1.1 - x86 NETWORK Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.959.670 [GMT 3:00] Running from: c:\documents and settings\Shef.CHANGEME1\Desktop\ComboFix.exe . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\Shef.CHANGEME1\Local Settings\Application Data\lgbva.exe c:\documents and settings\Shef.CHANGEME1\WINDOWS c:\windows\system32\msssc.dll c:\windows\XSxS D:\khq . . ((((((((((((((((((((((((( Files Created from 2011-06-13 to 2011-07-13 ))))))))))))))))))))))))))))))) . . 2011-07-13 06:22 . 2011-07-13 06:22 -------- d-----w- c:\documents and settings\Shef.CHANGEME1\Application Data\URSoft 2011-07-13 06:22 . 2011-07-13 06:22 -------- d-----w- c:\program files\Your Uninstaller 2010 2011-07-13 05:51 . 2011-07-13 05:51 -------- d-----w- c:\documents and settings\Shef.CHANGEME1\Application Data\Malwarebytes 2011-07-13 05:33 . 2011-07-13 05:34 -------- d-----w- c:\documents and settings\Administrator.SHEFF 2011-06-24 14:25 . 2011-06-24 14:25 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll 2011-06-24 14:25 . 2011-06-24 14:25 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll 2011-06-14 13:16 . 2011-06-14 13:16 -------- d-----w- c:\documents and settings\Shef.CHANGEME1\Application Data\HP 2011-06-14 12:57 . 2011-06-15 13:42 -------- d-----w- c:\documents and settings\Shef.CHANGEME1\Application Data\HpUpdate 2011-06-14 12:56 . 2011-06-14 12:56 -------- d-----w- c:\windows\Cache 2011-06-14 12:56 . 2011-06-14 12:56 -------- d-----w- c:\program files\Coupons 2011-06-14 12:56 . 2011-06-14 12:56 -------- d-----w- c:\program files\HP Photo Creations 2011-06-14 12:56 . 2011-06-14 12:56 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Photo Creations 2011-06-14 12:56 . 2011-06-14 12:56 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Product Assistant 2011-06-14 12:54 . 2011-06-14 13:16 -------- d-----w- c:\documents and settings\All Users\Application Data\HP . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-06-08 05:30 . 2011-06-08 05:30 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-05-29 06:11 . 2011-04-11 07:20 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-05-29 06:11 . 2011-04-11 07:19 22712 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-06-24 14:25 . 2011-04-11 10:52 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2009-11-05 . 600D58665D16BFBB776EFEFB0E80532D . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BigDogPath"="c:\windows\VM301Snap.exe" [2007-03-27 49152] "Domino"="c:\windows\Domino.exe" [2006-07-04 49152] "VTTimer"="VTTimer.exe" [2004-09-01 53248] "Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "ShowDeskFix"="shell32" [X] "IE8"="advpack.dll" [2009-11-05 128512] . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup . [HKLM\~\startupfolder\C:^Documents and Settings^Shef.CHANGEME1^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk] path=c:\documents and settings\Shef.CHANGEME1\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk backup=c:\windows\pss\OpenOffice.org 3.2.lnkStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware] 2011-05-29 06:11 449584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-10-29 12:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "MBAMService"=2 (0x2) "JavaQuickStarterService"=2 (0x2) "AntiVirService"=2 (0x2) "AntiVirSchedulerService"=2 (0x2) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Opera\\opera.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= . S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11.4.2011 г. 10:19 22712] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [11.4.2011 г. 10:20 39984] S4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11.4.2011 г. 10:20 366640] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2011-04-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-24 06:29] . 2011-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-24 06:29] . . ------- Supplementary Scan ------- . uStart Page = about:blank IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: DhcpNameServer = 217.18.242.146 217.9.224.206 FF - ProfilePath - c:\documents and settings\Shef.CHANGEME1\Application Data\Mozilla\Firefox\Profiles\8ra5h17s.default\ FF - prefs.js: browser.startup.homepage - google.bg . - - - - ORPHANS REMOVED - - - - . WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) MSConfigStartUp-avgnt - c:\program files\Avira\AntiVir Desktop\avgnt.exe MSConfigStartUp-FlashPlayerUpdate - c:\windows\system32\Macromed\Flash\FlashUtil10o_Plugin.exe MSConfigStartUp-HP Software Update - c:\program files\HP\HP Software Update\HPWuSchd2.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-07-13 10:39 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="c:\\Program Files\\CCleaner\\ccleaner.exe" . Completion time: 2011-07-13 10:41:45 ComboFix-quarantined-files.txt 2011-07-13 07:41 . Pre-Run: 1 982 623 744 bytes free Post-Run: 2 568 171 520 bytes free . WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect . - - End Of File - - 042CA9605116A09725D11CE6B36926D4

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

13 юли 201115 г.

Благодаря....сега в нормален режим Rogue Program блокира ли ви системата....?

13 юли 201115 г.

Автор

Благодаря много, след помощта ви зловредната програма не се стартира в нормален режим и всички програми и достъп работят нормално.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

13 юли 201115 г.

Прекрасно..но не бързайте да ми бягате ...искам да направим още няколко проверки за да сме сигурни че не са останали някъкви остатъци....!!!

Изтрийте вашето копие на ComboFIX и изтеглете свежо от линковете които съм ви дал в пост 5 инаправете нова проверка с програмата в нормален режим (инструкция пост 5)....!!! :wors:

Следвате инструкциите на HJT Тeam, докато не ви бъде съобщено, че системата е чиста. Това, че симптомите са изчезнали не означава, че проблемът е решен.

13 юли 201115 г.

Автор

Ето новия LOG от ComboFix:\ ComboFix 11-07-12.09 - Shef 07.2011 г. 11:26:30.2.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.959.459 [GMT 3:00] Running from: c:\documents and settings\Shef.CHANGEME1\Desktop\ComboFix.exe AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7} FW: COMODO Firewall *Disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} . . ((((((((((((((((((((((((( Files Created from 2011-06-13 to 2011-07-13 ))))))))))))))))))))))))))))))) . . 2011-07-13 08:15 . 2011-07-13 08:15 -------- d-----w- c:\program files\COMODO 2011-07-13 08:14 . 2011-07-13 08:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo 2011-07-13 08:13 . 2011-07-13 08:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo Downloader 2011-07-13 08:08 . 2011-07-13 08:21 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys 2011-07-13 08:08 . 2011-07-13 08:21 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2011-07-13 08:08 . 2010-06-17 12:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys 2011-07-13 08:08 . 2010-06-17 12:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys 2011-07-13 08:08 . 2011-07-13 08:08 -------- d-----w- c:\program files\Avira 2011-07-13 08:08 . 2011-07-13 08:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira 2011-07-13 06:22 . 2011-07-13 06:22 -------- d-----w- c:\documents and settings\Shef.CHANGEME1\Application Data\URSoft 2011-07-13 06:22 . 2011-07-13 06:22 -------- d-----w- c:\program files\Your Uninstaller 2010 2011-07-13 05:51 . 2011-07-13 05:51 -------- d-----w- c:\documents and settings\Shef.CHANGEME1\Application Data\Malwarebytes 2011-07-13 05:33 . 2011-07-13 05:34 -------- d-----w- c:\documents and settings\Administrator.SHEFF 2011-06-30 06:38 . 2011-06-30 06:38 97504 ----a-w- c:\windows\system32\drivers\inspect.sys 2011-06-30 06:38 . 2011-06-30 06:38 29400 ----a-w- c:\windows\system32\drivers\cmdhlp.sys 2011-06-30 06:38 . 2011-06-30 06:38 242600 ----a-w- c:\windows\system32\drivers\cmdGuard.sys 2011-06-30 06:38 . 2011-06-30 06:38 17416 ----a-w- c:\windows\system32\drivers\cmderd.sys 2011-06-30 06:37 . 2011-06-30 06:37 285256 ----a-w- c:\windows\system32\guard32.dll 2011-06-24 14:25 . 2011-06-24 14:25 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll 2011-06-24 14:25 . 2011-06-24 14:25 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll 2011-06-14 13:16 . 2011-06-14 13:16 -------- d-----w- c:\documents and settings\Shef.CHANGEME1\Application Data\HP 2011-06-14 12:57 . 2011-06-15 13:42 -------- d-----w- c:\documents and settings\Shef.CHANGEME1\Application Data\HpUpdate 2011-06-14 12:56 . 2011-06-14 12:56 -------- d-----w- c:\windows\Cache 2011-06-14 12:56 . 2011-06-14 12:56 -------- d-----w- c:\program files\Coupons 2011-06-14 12:56 . 2011-06-14 12:56 -------- d-----w- c:\program files\HP Photo Creations 2011-06-14 12:56 . 2011-06-14 12:56 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Photo Creations 2011-06-14 12:56 . 2011-06-14 12:56 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Product Assistant 2011-06-14 12:54 . 2011-06-14 13:16 -------- d-----w- c:\documents and settings\All Users\Application Data\HP . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-06-08 05:30 . 2011-06-08 05:30 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-05-29 06:11 . 2011-04-11 07:20 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-05-29 06:11 . 2011-04-11 07:19 22712 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-06-24 14:25 . 2011-04-11 10:52 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2009-11-05 . 600D58665D16BFBB776EFEFB0E80532D . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((( SnapShot@2011-07-13_07.40.07 ))))))))))))))))))))))))))))))))))))))))) . + 2011-07-13 08:08 . 2010-06-17 12:27 28520 c:\windows\system32\drivers\ssmdrv.sys + 2011-07-13 08:15 . 2011-07-13 08:15 8761856 c:\windows\Installer\12cf71.msi . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BigDogPath"="c:\windows\VM301Snap.exe" [2007-03-27 49152] "Domino"="c:\windows\Domino.exe" [2006-07-04 49152] "VTTimer"="VTTimer.exe" [2004-09-01 53248] "Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768] "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-06-30 2554696] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "ShowDeskFix"="shell32" [X] "IE8"="advpack.dll" [2009-11-05 128512] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\guard32.dll . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup . [HKLM\~\startupfolder\C:^Documents and Settings^Shef.CHANGEME1^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk] path=c:\documents and settings\Shef.CHANGEME1\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk backup=c:\windows\pss\OpenOffice.org 3.2.lnkStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware] 2011-05-29 06:11 449584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-10-29 12:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "MBAMService"=2 (0x2) "JavaQuickStarterService"=2 (0x2) "AntiVirService"=2 (0x2) "AntiVirSchedulerService"=2 (0x2) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Opera\\opera.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= . R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [30.6.2011 г. 09:38 242600] R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [30.6.2011 г. 09:38 29400] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [13.7.2011 г. 11:08 136360] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11.4.2011 г. 10:19 22712] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [11.4.2011 г. 10:20 39984] S4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11.4.2011 г. 10:20 366640] . --- Other Services/Drivers In Memory --- . *NewlyCreated* - CMDAGENT *NewlyCreated* - CMDGUARD *NewlyCreated* - CMDHLP *NewlyCreated* - INSPECT *NewlyCreated* - SSMDRV . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2011-04-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-24 06:29] . 2011-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-10-24 06:29] . . ------- Supplementary Scan ------- . uStart Page = about:blank IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: DhcpNameServer = 217.18.242.146 217.9.224.206 TCP: Interfaces\{2258FE74-81E8-4BAB-9373-B7B0DC79DE01}: NameServer = 156.154.70.22,156.154.71.22 FF - ProfilePath - c:\documents and settings\Shef.CHANGEME1\Application Data\Mozilla\Firefox\Profiles\8ra5h17s.default\ FF - prefs.js: browser.startup.homepage - google.bg . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-07-13 11:33 Windows 5.1.2600 Service Pack 3 NTFS . detected NTDLL code modification: ZwClose . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="c:\\Program Files\\CCleaner\\ccleaner.exe" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(700) c:\windows\system32\guard32.dll . - - - - - - - > 'lsass.exe'(756) c:\windows\system32\guard32.dll . - - - - - - - > 'explorer.exe'(1384) c:\windows\system32\WININET.dll c:\windows\system32\guard32.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\wpdshserviceobj.dll c:\windows\system32\portabledevicetypes.dll c:\windows\system32\portabledeviceapi.dll . Completion time: 2011-07-13 11:36:24 ComboFix-quarantined-files.txt 2011-07-13 08:36 ComboFix2.txt 2011-07-13 07:41 . Pre-Run: 2 342 825 984 bytes free Post-Run: 2 336 964 608 bytes free . - - End Of File - - 0A900D92009D3D09B273C23D89A27B7C

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

13 юли 201115 г.

Благодаря...! :ph34r:

Деинсталирайте Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

Публикувано изображение

2.Изтеглете OTCleanIt или от тук,стартирайте и натиснете Clean up

След това контролни сканирания с:

* Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Изтеглете програмата: ESET Online Scanner
Стартирайте esetsmartinstaller_enu.exe
Сложете отметка на YES, I accept the Terms of Use и изберете Start:
Скенерът ще започне да изтегля компонентите, които са му необходими:
Уверете се, че има отметки на следните редове:

Накрая изберете Start
Скенерът ще започне да изтегля последните дефиниции.
След, като сканирането завърши изберете Finish.
Отидете в: C:\Program Files\ESET\ESET Online Scanner
Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.