Имам някакъв вирус,някой знае ли нещо по въпроса ?

Windows-Repair.bmp

"Вирусът" ти се нарича лоши сектори на хард диска. Сканирай го и виж дали реално съществуват или е лъжлива тревога..

Сканирах и ми излиза че има някакви вируси махам ги с някаква програма на име Malwarebytes' Anti-Malware но няма резултат (Това ми се получава за 2-ри път в рамките на 20 дена но доколкото разбрах е някакъв вид вирус не е проблем от хард диска ) знаели някои как да го премахна освен в преинстал на Windows нещо в което не ме бива

Така...във момента се намирате в подраздела Премахване на зловреден софтуер - HiJackThis логове ....тук имаме специални правила !Моля прочетете Системата ми е инфектирана - Какво да правя сега? i направете сканирането с DDS...!

сега доколкото разбирам трябва да поставя резултатите от DDS

резултати от DDS : .

DDS (Ver_2011-06-23.01) - NTFSx86

Internet Explorer: 7.0.5730.13

Run by Administrator at 18:54:39 on 2011-08-05

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.3071.2342 [GMT 3:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\RTHDCPL.EXE

D:\Programs\Winamp\winampa.exe

C:\WINDOWS\system32\RunDLL32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DAEMON Tools Lite\DTLite.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.gong.bg/

uWindow Title = IE

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

mSearchAssistant = hxxp://www.google.com/ie

mWinlogon: SfcDisable=-99 (0xffffff9d)

BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - e:\bitcomet\tools\BitCometBHO_1.3.7.16.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

uRun: [Google Update] "c:\users\administrator\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [AdobeBridge]

uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun

uRun: [KphlpyPdLNqAgT] c:\users\all users\application data\KphlpyPdLNqAgT.exe

mRun: [systemTray] SysTray.Exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [WinampAgent] d:\programs\winamp\winampa.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login

mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet

mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

dRunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

dRunOnce: [NewUser] c:\windows\lastxp\NewUser.cmd

uPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)

mPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)

mPolicies-system: SynchronousMachineGroupPolicy = 0 (0x0)

mPolicies-system: SynchronousUserGroupPolicy = 0 (0x0)

dPolicies-explorer: NoSMHelp = 1 (0x1)

dPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)

IE: &С&валяне &с BitComet - e:\bitcomet\BitComet.exe/AddLink.htm

IE: &С&валяне на всички с BitComet - e:\bitcomet\BitComet.exe/AddAllLink.htm

IE: &С&валяне на всичкото видео с BitComet - e:\bitcomet\BitComet.exe/AddVideo.htm

IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office11\EXCEL.EXE/3000

IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://e:\bitcomet\tools\BitCometBHO_1.3.7.16.dll/206

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office11\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{3BAF5F85-A1BA-4E38-BA30-BC16EEC48BAA} : DhcpNameServer = 192.168.1.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\administrator\application data\mozilla\firefox\profiles\48g0kc52.default\

FF - prefs.js: browser.search.selectedEngine - DAEMON Search

FF - prefs.js: browser.startup.homepage - www.gong.bg

FF - plugin: c:\users\administrator\local settings\application data\google\update\1.3.21.65\npGoogleUpdate3.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Quick Starter: [email protected] - c:\program files\java\jre6\lib\deploy\jqs\ff

.

============= SERVICES / DRIVERS ===============

.

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]

R1 MpKsl0e93b550;MpKsl0e93b550;c:\users\all users\application data\microsoft\microsoft antimalware\definition updates\{57fb3b97-6f30-40f3-a056-049b27851422}\MpKsl0e93b550.sys [2011-8-5 28752]

R1 MpKsl83b8c678;MpKsl83b8c678;c:\users\all users\application data\microsoft\microsoft antimalware\definition updates\{57fb3b97-6f30-40f3-a056-049b27851422}\MpKsl83b8c678.sys [2011-8-5 28752]

R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2011-7-3 2214504]

R3 cpuz134;cpuz134;\??\c:\windows\temp\cpuz134\cpuz134_x32.sys --> c:\windows\temp\cpuz134\cpuz134_x32.sys [?]

S1 MpKsl319c1537;MpKsl319c1537;\??\c:\users\all users\application data\microsoft\microsoft antimalware\definition updates\{414ccf76-f568-4e9f-863b-a28dd40dac9e}\mpksl319c1537.sys --> c:\users\all users\application data\microsoft\microsoft antimalware\definition updates\{414ccf76-f568-4e9f-863b-a28dd40dac9e}\MpKsl319c1537.sys [?]

S1 MpKsl90a3aabd;MpKsl90a3aabd;\??\c:\users\all users\application data\microsoft\microsoft antimalware\definition updates\{4e6a5e16-a9c9-41e7-b502-024a3c1a2d0c}\mpksl90a3aabd.sys --> c:\users\all users\application data\microsoft\microsoft antimalware\definition updates\{4e6a5e16-a9c9-41e7-b502-024a3c1a2d0c}\MpKsl90a3aabd.sys [?]

S1 MpKslbfe0200d;MpKslbfe0200d;\??\c:\users\all users\application data\microsoft\microsoft antimalware\definition updates\{cea62408-9733-4c86-8b33-9845dd346561}\mpkslbfe0200d.sys --> c:\users\all users\application data\microsoft\microsoft antimalware\definition updates\{cea62408-9733-4c86-8b33-9845dd346561}\MpKslbfe0200d.sys [?]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-8-5 41272]

.

=============== Created Last 30 ================

.

2011-08-05 14:10:04 -------- d-----w- c:\program files\GridinSoft Trojan Killer

2011-08-05 13:32:06 28752 ---ha-w- c:\users\all users\application data\microsoft\microsoft antimalware\definition updates\{57fb3b97-6f30-40f3-a056-049b27851422}\MpKsl0e93b550.sys

2011-08-05 10:19:48 -------- d--h--w- c:\program files\Skype

2011-08-05 10:17:16 -------- d--h--w- c:\windows\system32\appmgmt

2011-08-05 09:15:55 28752 ---ha-w- c:\users\all users\application data\microsoft\microsoft antimalware\definition updates\{57fb3b97-6f30-40f3-a056-049b27851422}\MpKsl83b8c678.sys

2011-08-05 08:43:31 -------- d--h--w- c:\users\administrator\application data\Malwarebytes

2011-08-05 08:41:55 41272 ---ha-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-08-05 08:41:53 -------- d--h--w- c:\users\all users\application data\Malwarebytes

2011-08-05 08:41:49 22712 ---ha-w- c:\windows\system32\drivers\mbam.sys

2011-08-05 08:41:48 -------- d--h--w- c:\program files\Malwarebytes' Anti-Malware

2011-08-05 08:08:33 -------- d--h--w- c:\users\administrator\application data\GetRightToGo

2011-08-04 17:57:17 6881616 ---ha-w- c:\users\all users\application data\microsoft\microsoft antimalware\definition updates\{57fb3b97-6f30-40f3-a056-049b27851422}\mpengine.dll

2011-08-04 17:04:45 416256 ---ha-w- c:\users\all users\application data\P1kAlMiG2Kb7Fz.exe

2011-08-04 16:55:36 461312 ---ha-w- c:\users\all users\application data\KphlpyPdLNqAgT.exe

2011-07-07 09:58:51 -------- d--h--w- c:\users\administrator\local settings\application data\Identities

.

==================== Find3M ====================

.

2011-07-05 14:16:28 273344 ---ha-w- c:\windows\system32\nvdrsdb1.bin

2011-07-05 14:16:28 1 ---ha-w- c:\windows\system32\nvdrssel.bin

2011-07-05 14:16:24 273344 ---ha-w- c:\windows\system32\nvdrsdb0.bin

2011-07-04 15:43:42 691696 ---ha-w- c:\windows\system32\drivers\sptd.sys

2011-07-04 12:01:29 404640 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-07-03 21:17:37 32768 ---ha-w- c:\windows\~DF6BB4.tmp

2011-07-03 18:39:14 295 ---ha-w- c:\windows\system32\StartAU.cmd

2011-07-03 18:31:30 40 ---ha-w- c:\users\administrator\SetupS.reg

2011-07-03 18:31:30 0 ---ha-w- c:\users\administrator\SetupS.cmd

2011-07-03 18:31:23 73728 ---ha-w- c:\windows\system32\javacpl.cpl

2011-07-03 18:31:23 410984 ---ha-w- c:\windows\system32\deploytk.dll

.

============= FINISH: 19:00:38,64 ===============

резултати от Attach : .

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-06-23.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 03.7.2011 г. 21:31:44

System Uptime: 05.8.2011 г. 16:31:32 (3 hours ago)

.

Motherboard: MICRO-STAR INTERNATIONAL CO.,LTD | | MS-7529

Processor: Intel® Pentium® Dual CPU E2200 @ 2.20GHz | CPU 1 | 2218/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 59 GiB total, 51,145 GiB free.

D: is FIXED (NTFS) - 85 GiB total, 58,99 GiB free.

E: is FIXED (NTFS) - 85 GiB total, 33,506 GiB free.

F: is CDROM ()

G: is CDROM ()

H: is FIXED (NTFS) - 238 GiB total, 233,97 GiB free.

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

7-Zip 4.65

Adobe Anchor Service CS4

Adobe Bridge CS4

Adobe CMaps CS4

Adobe Color - Photoshop Specific CS4

Adobe Color EU Extra Settings CS4

Adobe Color JA Extra Settings CS4

Adobe Color NA Recommended Settings CS4

Adobe Color Video Profiles CS CS4

Adobe CSI CS4

Adobe Default Language CS4

Adobe ExtendScript Toolkit CS4

Adobe Flash Player 10 Plugin

Adobe Fonts All

Adobe Linguistics CS4

Adobe Output Module

Adobe PDF Library Files CS4

Adobe Photoshop CS4

Adobe Photoshop CS4 Support

Adobe Search for Help

Adobe Service Manager Extension

Adobe Setup

Adobe Type Support CS4

Adobe Update Manager CS4

Adobe WinSoft Linguistics Plugin

Adobe XMP Panels CS4

AdobeColorCommonSetCMYK

AdobeColorCommonSetRGB

Alky for Applications (Windows XP)

CCleaner (remove only)

Connect

Creation Master 11 Release 11.0

Critical Update for Windows Media Player 11 (KB959772)

DAEMON Tools Toolbar

FIFA 11

FlexType 2K

GOM Player

Google Chrome

Hotfix for Windows XP (KB2443685)

Java 6 Update 12

K-Lite Codec Pack 6.2.0 (Full)

Kels' CPL Bonus Pack!

kuler

Malwarebytes' Anti-Malware, Іµрсёя 1.51.1.1800

Microsoft .NET Framework 2.0

Microsoft Antimalware

Microsoft Antimalware Service BG-BG Language Pack

Microsoft Application Error Reporting

Microsoft Office 2003 Bulgarian User Interface Pack

Microsoft Office Professional Edition 2003

Microsoft Security Client

Microsoft Security Client BG-BG Language Pack

Microsoft Security Essentials

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Mozilla Firefox (3.6.18)

MSXML 4.0 SP2 (KB973688)

NVIDIA Control Panel 275.33

NVIDIA Graphics Driver 275.33

NVIDIA Install Application

NVIDIA nView 135.85

NVIDIA nView Desktop Manager

NVIDIA PhysX

NVIDIA PhysX System Software 9.10.0514

NVIDIA Update 1.3.5

NVIDIA Update Components

PDF Settings CS4

Photoshop Camera Raw

Realtek High Definition Audio Driver

Security Update for CAPICOM (KB931906)

Security Update for Windows Internet Explorer 7 (KB2530548)

Security Update for Windows Internet Explorer 7 (KB2544521)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 11 (KB936782)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2510581)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982665)

Skype™ 3.8

Suite Shared Configuration CS4

SVD

Total Commander (Remove or Repair)

Trojan Killer 2.0

Update for Windows XP (KB2541763)

Update for Windows XP (KB955759)

Update for Windows XP (KB968389)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

WebFldrs XP

WinRAR archiver

XnView 1.93.1

.

==== Event Viewer Messages From Past Week ========

.

03.8.2011 і. 13:02:05, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

02.8.2011 і. 22:35:47, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

02.8.2011 і. 22:35:44, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

02.8.2011 і. 22:35:42, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

.

==== End Of File ===========================

Виждам активни зарази в системата ви..!За целта..:

Стъпка 1

• Изтеглете Security Check (автор: screen317) от тук или от тук и го запишете на десктопа.
• Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
• Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt.
• Копирайте съдържанието на checkup.txt с Копирай (Copy) и с Постави (Paste) го поставете в следващия си коментар.

Стъпка 2

Изтеглете ComboFix от тук или тук и го запазете на десктопа си.

• Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

• Стартирайте Combo-Fix.com и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

• Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

• Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

• Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
• ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
• ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
• ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
• В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.

резултати от Chechup :

Results of screen317's Security Check version 0.99.18

Windows XP Service Pack 3

Internet Explorer 7 Out of date!

``````````````````````````````

Antivirus/Firewall Check:

Windows Security Center service is not running! This report may not be accurate!

Windows Firewall Enabled!

Microsoft Security Essentials

Antivirus up to date!

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

CCleaner (remove only)

Java 6 Update 12

Out of date Java installed!

Adobe Flash Player 10.3.181.34

Mozilla Firefox (3.6.18) Firefox Out of Date!

````````````````````````````````

Process Check:

objlist.exe by Laurent

Windows Defender MSMpEng.exe

Microsoft Security Client Antimalware MsMpEng.exe

``````````End of Log````````````

приключи работата на ComboFix но не мога да намеря този файл за който пише да поставя BUG.txt

сега видях че файла същност се казва ComboFix.txt но и този файл не мога да го намеря има други файлове но точно този ComboFix.txt него виждам

приключи работата на ComboFix но не мога да намеря този файл за който пише да поставя BUG.txt

Файла се генерира автоматично.....ще го намерите тук : C:\ComboFix.txt

BUG.txt - не ни е нужен на този етап

Моля, публикувайте съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

http://alfa.kachi-snimka.info/viewer.php?id=cqs1312566361h.JPG ще може ли да кажеш кой точно файл трябва този Combofix с моторчето не е текстов и не мога да го отворя друг не виждам

Провери в папка Qoobox

проверих но го няма и там,ще стартирам още веднъж програмата да видим дали ще излезе този тхт файл този път

проверих но го няма и там,ще стартирам още веднъж програмата да видим дали ще излезе този тхт файл този път

Няма вече никакъв смисъл...!Поне на този етап...!

Моля, изтеглете aswMBR и го запазете на вашия десктоп.

• Кликнете с двоен клин на мишката върху файла aswMBR.exe за да го стартирате.
• Изчакайте да изтегли дефинициите на avast!
• От падащото меню посочете дял C:\ както е на снимката:

• Изберете Scan бутона, за да започне проверката.
• Когато проверката завърши, натиснете бутона save log, запазете съдържанието на лог файла на десктопа и публикувайте съдържанието му в следващия си коментар.

========================================================================================================================================

* Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

===================================================================================

• Изтеглете програмата: ESET Online Scanner
• Стартирайте esetsmartinstaller_enu.exe
• Сложете отметка на YES, I accept the Terms of Use и изберете Start:

  

• Скенерът ще започне да изтегля компонентите, които са му необходими:

  

• Уверете се, че има отметки на следните редове:

  

  Накрая изберете Start

• Скенерът ще започне да изтегля последните дефиниции.
• След, като сканирането завърши изберете Finish.
• Отидете в: C:\Program Files\ESET\ESET Online Scanner
• Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

това всичко което ми казваш ще го направя утре,и после ще го постна тук,благодаря за помоща всъщност току що ми зареди този файл ето го и него : ComboFix 11-08-05.01 - Administrator 08.2011 г. 21:27:57.2.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.3071.2374 [GMT 3:00] Running from: H:\Downloads\ComboFix.exe AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Users\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\System Repair.lnk C:\Users\Administrator\Desktop\System Repair.lnk C:\Users\Administrator\Start Menu\Programs\System Repair C:\Users\Administrator\Start Menu\Programs\System Repair\System Repair.lnk C:\Users\Administrator\Start Menu\Programs\System Repair\Uninstall System Repair.lnk C:\Users\All Users\Application Data\KphlpyPdLNqAgT.exe C:\Users\All Users\Application Data\P1kAlMiG2Kb7Fz.exe C:\WINDOWS\system32\settings.exe C:\WINDOWS\system32\logonui.exe . . . is infected!! ((((((((((((((((((((((((( Files Created from 2011-07-05 to 2011-08-05 ))))))))))))))))))))))))))))))) 2011-08-05 17:19:10 . 2011-08-05 17:19:12 28752 ---ha-w- C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{57FB3B97-6F30-40F3-A056-049B27851422}\MpKslecfddee1.sys 2011-08-05 14:10:04 . 2011-08-05 14:17:05 -------- d--h--w- C:\Program Files\GridinSoft Trojan Killer 2011-08-05 13:32:06 . 2011-08-05 13:32:07 28752 ---ha-w- C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{57FB3B97-6F30-40F3-A056-049B27851422}\MpKsl0e93b550.sys 2011-08-05 10:19:54 . 2011-08-05 13:36:03 -------- d--h--w- C:\Users\Administrator\Application Data\Skype 2011-08-05 10:19:48 . 2011-08-05 10:19:49 -------- d--h--w- C:\Program Files\Skype 2011-08-05 10:19:48 . 2011-08-05 10:19:48 -------- d--h--w- C:\Program Files\Common Files\Skype 2011-08-05 09:15:55 . 2011-08-05 09:15:55 28752 ---ha-w- C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{57FB3B97-6F30-40F3-A056-049B27851422}\MpKsl83b8c678.sys 2011-08-05 08:43:31 . 2011-08-05 08:43:31 -------- d--h--w- C:\Users\Administrator\Application Data\Malwarebytes 2011-08-05 08:41:55 . 2011-07-06 16:52:42 41272 ---ha-w- C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2011-08-05 08:41:53 . 2011-08-05 08:41:53 -------- d--h--w- C:\Users\All Users\Application Data\Malwarebytes 2011-08-05 08:41:49 . 2011-07-06 16:52:42 22712 ---ha-w- C:\WINDOWS\system32\drivers\mbam.sys 2011-08-05 08:41:48 . 2011-08-05 08:41:58 -------- d--h--w- C:\Program Files\Malwarebytes' Anti-Malware 2011-08-05 08:08:33 . 2011-08-05 08:09:56 -------- d--h--w- C:\Users\Administrator\Application Data\GetRightToGo 2011-08-04 17:57:17 . 2011-07-13 03:39:01 6881616 ---ha-w- C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{57FB3B97-6F30-40F3-A056-049B27851422}\mpengine.dll 2011-08-04 16:55:25 . 2011-08-04 16:55:25 -------- d--h--w- C:\WINDOWS\Sun 2011-07-07 09:58:51 . 2011-07-07 09:58:51 -------- d--h--w- C:\Users\Administrator\Local Settings\Application Data\Identities . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2011-07-13 03:39:01 . 2011-07-05 08:21:25 6881616 ---ha-w- C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-07-04 15:43:42 . 2011-07-04 15:43:42 691696 ---ha-w- C:\WINDOWS\system32\drivers\sptd.sys 2011-07-04 12:01:29 . 2011-07-04 12:01:29 404640 ---ha-w- C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2011-07-03 21:17:37 . 2011-07-03 21:17:37 32768 ---ha-w- C:\WINDOWS\~DF6BB4.tmp 2011-07-03 18:39:14 . 2011-07-03 18:39:14 295 ---ha-w- C:\WINDOWS\system32\StartAU.cmd 2011-07-03 18:31:30 . 2011-07-03 19:55:09 40 ---ha-w- C:\Users\UpdatusUser\SetupS.reg 2011-07-03 18:31:30 . 2011-07-03 19:55:09 0 ---ha-w- C:\Users\UpdatusUser\SetupS.cmd 2011-07-03 18:31:30 . 2011-07-03 18:33:43 40 ---ha-w- C:\Users\Administrator\SetupS.reg 2011-07-03 18:31:30 . 2011-07-03 18:33:43 0 ---ha-w- C:\Users\Administrator\SetupS.cmd 2011-07-03 18:31:30 . 2011-07-03 18:31:44 40 ---ha-w- C:\WINDOWS\system32\config\systemprofile\SetupS.reg 2011-07-03 18:31:30 . 2011-07-03 18:31:44 0 ---ha-w- C:\WINDOWS\system32\config\systemprofile\SetupS.cmd 2011-07-03 18:31:30 . 2011-07-03 18:31:06 40 ---ha-w- C:\Users\Default User\SetupS.reg 2011-07-03 18:31:30 . 2011-07-03 18:31:06 0 ---ha-w- C:\Users\Default User\SetupS.cmd 2011-07-03 18:31:23 . 2011-07-03 18:31:28 73728 ---ha-w- C:\WINDOWS\system32\javacpl.cpl 2011-07-03 18:31:23 . 2011-07-03 18:31:28 410984 ---ha-w- C:\WINDOWS\system32\deploytk.dll 2011-05-25 06:09:23 . 2011-07-03 19:54:49 154728 ---ha-w- C:\WINDOWS\system32\nvsvc32.exe 2011-05-25 06:09:23 . 2011-07-03 19:54:48 111208 ---ha-w- C:\WINDOWS\system32\nvmctray.dll 2011-05-25 06:09:23 . 2011-07-03 19:54:47 54272 ---ha-w- C:\WINDOWS\system32\nvwddi.dll 2011-05-25 06:09:22 . 2011-07-03 19:54:48 13895272 ---ha-w- C:\WINDOWS\system32\nvcpl.dll 2011-05-25 06:09:21 . 2011-07-03 19:54:48 145000 ---ha-w- C:\WINDOWS\system32\nvcolor.exe 2011-05-25 06:09:21 . 2011-07-03 19:54:47 543336 ---ha-w- C:\WINDOWS\system32\easyupdatusapiu.dll 2011-05-25 06:09:21 . 2011-07-03 19:16:17 61440 ---ha-w- C:\WINDOWS\system32\OpenCL.dll 2011-05-25 06:09:21 . 2011-07-03 19:16:09 16068608 ---ha-w- C:\WINDOWS\system32\nvoglnt.dll 2011-05-25 06:09:21 . 2011-07-03 19:16:08 865896 ---ha-w- C:\WINDOWS\system32\nvgenco322090.dll 2011-05-25 06:09:21 . 2011-07-03 19:16:07 899688 ---ha-w- C:\WINDOWS\system32\nvdispco3220150.dll 2011-05-25 06:09:21 . 2011-07-03 19:16:05 2808936 ---ha-w- C:\WINDOWS\system32\nvcuvid.dll 2011-05-25 06:09:21 . 2011-07-03 19:16:05 2082408 ---ha-w- C:\WINDOWS\system32\nvcuvenc.dll 2011-05-25 06:09:20 . 2011-07-03 19:16:05 5332992 ---ha-w- C:\WINDOWS\system32\nvcuda.dll 2011-05-25 06:09:20 . 2011-07-03 19:16:05 4198272 ---ha-w- C:\WINDOWS\system32\nv4_disp.dll 2011-05-25 06:09:20 . 2011-07-03 19:16:05 2328576 ---ha-w- C:\WINDOWS\system32\nvapi.dll 2011-05-25 06:09:20 . 2011-07-03 19:16:05 13004800 ---ha-w- C:\WINDOWS\system32\nvcompiler.dll 2011-05-25 06:09:20 . 2011-07-03 19:16:05 12753664 ---ha-w- C:\WINDOWS\system32\drivers\nv4_mini.sys ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. [-] 2008-04-13 22:10:32 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512 (xpsp.080413-2108)] . . C:\WINDOWS\system32\drivers\atapi.sys [-] 2008-04-13 22:27:28 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\system32\drivers\asyncmac.sys [-] 2001-08-23 12:00:00 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0 (XPClient.010817-1148)] . . C:\WINDOWS\system32\drivers\beep.sys [-] 2008-04-13 22:09:48 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512 (xpsp.080413-2108)] . . C:\WINDOWS\system32\drivers\kbdclass.sys [-] 2008-04-13 22:50:38 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\system32\drivers\ndis.sys [-] 2008-11-18 15:02:08 . 4C51D5275AE8A16999EDFE7E647D00DE . 576384 . . [5.1.2600.5712 (xpsp_sp3_qfe.081118-1720)] . . C:\WINDOWS\system32\drivers\ntfs.sys [-] 2001-08-23 12:00:00 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0 (XPClient.010817-1148)] . . C:\WINDOWS\system32\drivers\null.sys [-] 2009-03-08 09:04:23 . FF267FF1D773BEA5522295E3A79701E9 . 361600 . . [5.1.2600.5649 (xpsp_sp3_qfe.080728-1259)] . . C:\WINDOWS\system32\drivers\tcpip.sys [-] 2008-06-20 11:59:02 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625 (xpsp_sp3_qfe.080620-1309)] . . C:\WINDOWS\system32\dllcache\tcpip.sys [-] 2008-04-14 03:41:52 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512 (xpsp.080413-2113)] . . C:\WINDOWS\system32\browser.dll [-] 2008-04-14 03:42:26 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512 (xpsp.080413-2113)] . . C:\WINDOWS\system32\lsass.exe [-] 2008-04-14 03:42:02 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\system32\netman.dll [-] 2009-03-08 09:09:52 . 403EBA8EE2967BA93E07138400972EE3 . 1443840 . . [2001.12.4414.700] . . C:\WINDOWS\system32\comres.dll [-] 2008-04-14 03:42:04 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512 (xpsp.080413-2108)] . . C:\WINDOWS\system32\qmgr.dll [-] 2009-03-08 09:12:29 . 3D1ABDC3009D6B7CA7F9E66769C126CA . 568832 . . [5.1.2600.5512 (xpsp.080413-2113)] . . C:\WINDOWS\system32\winlogon.exe [-] 2008-04-14 03:41:52 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512 (xpsp.080413-2113)] . . C:\WINDOWS\system32\cryptsvc.dll [-] 2009-03-08 09:01:47 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . C:\WINDOWS\system32\es.dll [-] 2008-04-14 03:41:56 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512 (xpsp.080413-2105)] . . C:\WINDOWS\system32\imm32.dll [-] 2008-04-14 03:41:58 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512 (xpsp.080413-2105)] . . C:\WINDOWS\system32\linkinfo.dll [-] 2008-04-14 03:41:58 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512 (xpsp.080413-2105)] . . C:\WINDOWS\system32\lpk.dll [-] 2009-03-08 09:08:14 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0 (xpclient.010817-1148)] . . C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll [-] 2009-03-08 09:08:14 . A4C4A54FD7E31179CB5BDF7896DF3DF7 . 343040 . . [7.0.2600.5701 (xpsp_sp3_qfe.081025-1544)] . . C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5701_x-ww_40d12c25\msvcrt.dll [-] 2009-03-08 09:01:59 . 06B8485FB1DA9A552B10AB978CD1AC85 . 343040 . . [7.0.2600.5701 (xpsp_sp3_qfe.081025-1544)] . . C:\WINDOWS\system32\msvcrt.dll [-] 2009-03-08 09:02:00 . 290C1A30DEFC723BBE10910AC2D6F6D0 . 245248 . . [5.1.2600.5649 (xpsp_sp3_qfe.080728-1259)] . . C:\WINDOWS\system32\mswsock.dll [-] 2008-06-20 17:43:05 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625 (xpsp_sp3_qfe.080620-1309)] . . C:\WINDOWS\system32\dllcache\mswsock.dll [-] 2009-03-08 09:02:02 . 06CF9EEDB7E827205C6948C9DAF56974 . 407040 . . [5.1.2600.5582 (xpsp_sp3_qfe.080416-1432)] . . C:\WINDOWS\system32\netlogon.dll [-] 2008-04-14 03:42:04 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512 (xpsp.080413-2105)] . . C:\WINDOWS\system32\powrprof.dll [-] 2008-04-14 03:42:06 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512 (xpsp.080413-2113)] . . C:\WINDOWS\system32\scecli.dll [-] 2008-04-14 03:42:06 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\system32\sfc.dll [-] 2008-04-14 03:42:38 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\system32\svchost.exe [-] 2009-03-08 09:02:15 . E2B32B10ACC5D97623275AAFB67E5F03 . 249856 . . [5.1.2600.5654 (xpsp_sp3_qfe.080806-1410)] . . C:\WINDOWS\system32\tapisrv.dll [-] 2009-03-08 09:12:20 . 99C1ACB1B8F0F2CECC56515E502B5120 . 575488 . . [5.1.2600.5512 (xpsp.080413-2105)] . . C:\WINDOWS\system32\user32.dll [-] 2008-04-14 03:42:40 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512 (xpsp.080413-2113)] . . C:\WINDOWS\system32\userinit.exe [-] 2008-04-14 03:42:12 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\system32\ws2_32.dll [-] 2008-04-14 03:42:12 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\system32\ws2help.dll [-] 2009-03-08 09:10:05 . E1F5F729264C8AF1D6A95ECD1C8086DD . 1723904 . . [6.00.2900.5634 (xpsp_sp3_qfe.080703-1303)] . . C:\WINDOWS\explorer.exe [-] 2008-04-14 03:42:34 . 200EA506B86F7E9E6C37820D2BB5F39B . 210944 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\regedit.exe [-] 2008-04-13 15:41:58 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512 (xpsp.080413-0845)] . . C:\WINDOWS\system32\ksuser.dll [-] 2008-04-14 03:42:08 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512 (xpsp.080413-2108)] . . C:\WINDOWS\system32\srsvc.dll [-] 2008-04-14 03:42:42 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512 (xpsp.080413-2108)] . . C:\WINDOWS\system32\wscntfy.exe [-] 2008-04-14 03:42:12 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\system32\xmlprov.dll [-] 2008-04-14 03:41:54 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\system32\eventlog.dll [-] 2008-04-14 03:42:06 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\system32\sfcfiles.dll [-] 2009-03-08 09:09:56 . CBF5945651C96E471B3A004BBDC36864 . 37376 . . [5.1.2600.5512 (xpsp.080413-2105)] . . C:\WINDOWS\system32\ctfmon.exe [-] 2009-07-27 23:17:41 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853 (xpsp_sp3_gdr.090727-1736)] . . C:\WINDOWS\system32\shsvcs.dll [-] 2009-07-27 23:17:41 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853 (xpsp_sp3_gdr.090727-1736)] . . C:\WINDOWS\system32\dllcache\shsvcs.dll [-] 2009-07-27 22:13:09 . 888CD7B39C37E13A2419BECFAAF0A28C . 135168 . . [6.00.2900.5853 (xpsp_sp3_qfe.090727-1747)] . . C:\WINDOWS\$hf_mig$\KB971029\SP3QFE\shsvcs.dll [-] 2008-04-14 03:42:06 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512 (xpsp.080413-2105)] . . C:\WINDOWS\$NtUninstallKB971029$\shsvcs.dll [-] 2008-04-14 03:42:06 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\system32\regsvc.dll [-] 2008-04-14 03:42:06 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512 (xpsp.080413-2108)] . . C:\WINDOWS\system32\schedsvc.dll [-] 2008-04-14 03:42:08 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\system32\ssdpsrv.dll [-] 2009-03-08 09:02:16 . 37981A741AD7B04258E87129FFE79AB9 . 296448 . . [5.1.2600.5733 (xpsp_sp3_qfe.081226-1351)] . . C:\WINDOWS\system32\termsrv.dll [-] 2009-03-08 09:01:48 . 0A878AA66E4DD3E2608192A1ECCD9F8F . 344064 . . [5.1.2600.5589 (xpsp_sp3_qfe.080428-1317)] . . C:\WINDOWS\system32\hnetcfg.dll [-] 2008-04-14 03:41:50 . D8849F77C0B66226335A59D26CB4EDC6 . 167936 . . [5.1.2600.5512 (xpsp.080413-2113)] . . C:\WINDOWS\system32\appmgmts.dll [-] 2001-08-23 12:00:00 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0 (xpclient.010817-1148)] . . C:\WINDOWS\system32\drivers\acpiec.sys [-] 2008-04-13 08:09:24 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . C:\WINDOWS\system32\drivers\aec.sys [-] 2008-04-13 22:23:36 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\system32\drivers\ip6fw.sys [-] 2008-04-14 03:42:00 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512 (xpsp.080413-2113)] . . C:\WINDOWS\system32\msgsvc.dll [-] 2009-03-08 09:08:53 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . C:\WINDOWS\system32\mspmsnsv.dll [-] 2010-12-09 15:39:28 . F67CD97282E0ABFAF91A9A1359B16F2D . 2069376 . . [5.1.2600.6055 (xpsp_sp3_qfe.101209-1646)] . . C:\WINDOWS\$hf_mig$\KB2393802\SP3QFE\ntkrnlpa.exe [-] 2010-12-09 13:07:07 . 9ED77E2307F6EC6F174C063C15AA3B8C . 2027008 . . [5.1.2600.6055 (xpsp_sp3_gdr.101209-1647)] . . C:\WINDOWS\system32\ntkrnlpa.exe [-] 2010-12-09 13:07:05 . 84FF488E249DBD2050EB39EA81C6F5C2 . 2069376 . . [5.1.2600.6055 (xpsp_sp3_gdr.101209-1647)] . . C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe [-] 2010-12-09 13:07:05 . 84FF488E249DBD2050EB39EA81C6F5C2 . 2069376 . . [5.1.2600.6055 (xpsp_sp3_gdr.101209-1647)] . . C:\WINDOWS\system32\dllcache\ntkrnlpa.exe [-] 2009-03-08 09:16:44 . BEC5D7EF52E385F457E7C20EDBB1C5E7 . 2185216 . . [5.1.2600.5657 (xpsp_sp3_qfe.080814-1300)] . . C:\WINDOWS\$NtUninstallKB2393802$\ntkrnlpa.exe [7] 2009-02-06 10:30:40 . 607352B9CB3D708C67F6039097801B5A . 2066176 . . [5.1.2600.5755 (xpsp_sp3_qfe.090206-1316)] . . C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe [-] 2008-04-14 03:42:04 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . C:\WINDOWS\system32\ntmssvc.dll [-] 2008-04-14 03:42:10 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\system32\upnphost.dll [-] 2008-04-14 03:41:54 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512 (xpsp.080413-0845)] . . C:\WINDOWS\system32\dsound.dll [-] 2009-03-08 09:01:46 . D2CF91B2C710E9F666E60AFBF87643EE . 1689088 . . [5.03.2600.5601 (xpsp_sp3_qfe.080513-1258)] . . C:\WINDOWS\system32\d3d9.dll [-] 2008-04-14 03:41:52 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512 (xpsp.080413-0845)] . . C:\WINDOWS\system32\ddraw.dll [-] 2008-04-14 03:42:04 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . C:\WINDOWS\system32\olepro32.dll [-] 2008-04-14 03:42:04 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\system32\perfctrs.dll [-] 2008-04-14 03:42:10 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512 (xpsp.080413-2105)] . . C:\WINDOWS\system32\version.dll [-] 2010-12-09 13:43:18 . A531BBD3DE13121C1380ED7DC99082DB . 2192768 . . [5.1.2600.6055 (xpsp_sp3_qfe.101209-1646)] . . C:\WINDOWS\$hf_mig$\KB2393802\SP3QFE\ntoskrnl.exe [-] 2010-12-09 13:42:26 . 60E16152D847D7A7B7D3DA4C4B8E2120 . 2148864 . . [5.1.2600.6055 (xpsp_sp3_gdr.101209-1647)] . . C:\WINDOWS\system32\ntoskrnl.exe [-] 2010-12-09 13:38:47 . 64C1ADF6DF629F340C5A439FE0EF8ED1 . 2192768 . . [5.1.2600.6055 (xpsp_sp3_gdr.101209-1647)] . . C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe [-] 2010-12-09 13:38:47 . 64C1ADF6DF629F340C5A439FE0EF8ED1 . 2192768 . . [5.1.2600.6055 (xpsp_sp3_gdr.101209-1647)] . . C:\WINDOWS\system32\dllcache\ntoskrnl.exe [7] 2009-02-07 16:35:26 . EFE8EACE83EAAD5849A7A548FB75B584 . 2189184 . . [5.1.2600.5755 (xpsp_sp3_qfe.090206-1316)] . . C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe [-] 2008-11-18 00:45:41 . CCF64982AD1B27461A5B85401657B29A . 2292224 . . [5.1.2600.5657 (xpsp_sp3_gdr.080814-1236)] . . C:\WINDOWS\$NtUninstallKB2393802$\ntoskrnl.exe [-] 2008-04-14 03:42:08 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512 (xpsp.080413-2108)] . . C:\WINDOWS\system32\srsvc.dll [-] 2009-03-08 09:02:18 . 9F8A0D0CBB2FA265A754516128C00E22 . 175616 . . [5.1.2600.5635 (xpsp_sp3_qfe.080704-1744)] . . C:\WINDOWS\system32\w32time.dll [-] 2008-04-14 03:42:10 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\system32\wiaservc.dll [-] 2008-04-14 03:41:58 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512 (xpsp.080413-0845)] . . C:\WINDOWS\system32\midimap.dll [-] 2008-04-14 03:42:04 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\system32\rasadhlp.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 11:57:08 369200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2008-07-03 14:51:28 16876032] "MSC"="C:\Program Files\Microsoft Security Client\msseces.exe" [2011-06-15 12:16:48 997920] "WinampAgent"="D:\Programs\Winamp\winampa.exe" [2008-03-27 06:35:38 36352] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2011-05-25 06:09:22 13895272] "NvMediaCenter"="NvMCTray.dll" [2011-05-25 06:09:23 111208] "nwiz"="C:\Program Files\NVIDIA Corporation\nView\nwiz.exe" [2011-05-04 21:02:42 1632360] "AdobeCS4ServiceManager"="C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 04:58:34 611712] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2009-03-08 09:09:56 37376] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "_nltide_3"="advpack.dll" [2011-04-25 15:49:27 124928] "NewUser"="C:\WINDOWS\LastXP\NewUser.cmd" [2009-02-18 06:24:04 2375] C:\Users\All Users\Start Menu\Programs\Startup\ FlexType 2K.lnk - C:\WINDOWS\Datecs\Flex2K.exe [2011-7-3 151552] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "E:\\BitComet\\BitComet.exe"= "D:\\FIFA 11\\Game\\fifa.exe"= "C:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"= "C:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "21218:TCP"= 21218:TCP:BitComet 21218 TCP "21218:UDP"= 21218:UDP:BitComet 21218 UDP "5353:TCP"= 5353:TCP:Adobe CSI CS4 R0 sptd;sptd;C:\WINDOWS\system32\drivers\sptd.sys [04.7.2011 і. 18:43:42 691696] R1 MpKsl0e93b550;MpKsl0e93b550;C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{57FB3B97-6F30-40F3-A056-049B27851422}\MpKsl0e93b550.sys [05.8.2011 і. 16:32:06 28752] R1 MpKsl83b8c678;MpKsl83b8c678;C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{57FB3B97-6F30-40F3-A056-049B27851422}\MpKsl83b8c678.sys [05.8.2011 і. 12:15:55 28752] R1 MpKslecfddee1;MpKslecfddee1;C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{57FB3B97-6F30-40F3-A056-049B27851422}\MpKslecfddee1.sys [05.8.2011 і. 20:19:10 28752] R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [03.7.2011 і. 22:54:53 2214504] S1 MpKsl319c1537;MpKsl319c1537;\??\C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{414CCF76-F568-4E9F-863B-A28DD40DAC9E}\MpKsl319c1537.sys --> C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{414CCF76-F568-4E9F-863B-A28DD40DAC9E}\MpKsl319c1537.sys [?] S1 MpKsl90a3aabd;MpKsl90a3aabd;\??\C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4E6A5E16-A9C9-41E7-B502-024A3C1A2D0C}\MpKsl90a3aabd.sys --> C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4E6A5E16-A9C9-41E7-B502-024A3C1A2D0C}\MpKsl90a3aabd.sys [?] S1 MpKslbfe0200d;MpKslbfe0200d;\??\C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CEA62408-9733-4C86-8B33-9845DD346561}\MpKslbfe0200d.sys --> C:\Users\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CEA62408-9733-4C86-8B33-9845DD346561}\MpKslbfe0200d.sys [?] S3 cpuz134;cpuz134;\??\C:\Windows\Temp\cpuz134\cpuz134_x32.sys --> C:\Windows\Temp\cpuz134\cpuz134_x32.sys [?] S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [05.8.2011 і. 11:41:55 41272] --- Other Services/Drivers In Memory --- *NewlyCreated* - MPKSLECFDDEE1 Contents of the 'Scheduled Tasks' folder 2011-08-04 C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-507921405-1580818891-1177238915-500Core.job - C:\Users\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-03 18:52:28 . 2011-07-03 18:52:27] 2011-08-05 C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-507921405-1580818891-1177238915-500UA.job - C:\Users\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-03 18:52:28 . 2011-07-03 18:52:27] 2011-08-05 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 12:39:26 . 2011-04-27 12:39:26]

резултати от aswMBR :

aswMBR version 0.9.8.978 Copyright© 2011 AVAST Software

Run date: 2011-08-06 11:42:49

-----------------------------

11:42:49.121 OS Version: Windows 5.1.2600 Service Pack 3

11:42:49.121 Number of processors: 2 586 0xF0D

11:42:49.121 ComputerName: LastXP22 UserName:

11:42:49.465 Initialize success

11:45:15.152 AVAST engine defs: 11080501

11:45:29.246 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T1L0-e

11:45:29.246 Disk 0 Vendor: SAMSUNG_HD502IJ 1AA01113 Size: 476940MB BusType: 3

11:45:31.262 Disk 0 MBR read successfully

11:45:31.262 Disk 0 MBR scan

11:45:31.262 Disk 0 TDL4@MBR code has been found

11:45:31.262 Disk 0 Windows XP default MBR code found via API

11:45:31.262 Disk 0 MBR hidden

11:45:31.262 Disk 0 MBR [TDL4] **ROOTKIT**

11:45:31.262 Disk 0 trace - called modules:

11:45:31.277 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8a03fed1]<<

11:45:31.277 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a074ab8]

11:45:31.277 3 CLASSPNP.SYS[f7647fd7] -> nt!IofCallDriver -> \Device\0000006a[0x8a07a9e8]

11:45:31.277 5 ACPI.sys[f74a3620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T1L0-e[0x8a079940]

11:45:31.277 \Driver\atapi[0x8a09c9c0] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x8a03fed1

11:45:31.480 AVAST engine scan C:\

11:52:24.184 File: C:\Qoobox\Quarantine\C\Windows\system32\settings.exe.vir **INFECTED** Win32:Trojan-gen

11:52:56.559 File: C:\System Volume Information\_restore{DAA58470-E0B3-428D-AD40-19833488FA9B}\RP1\A0001257.exe **INFECTED** Win32:Trojan-gen

12:10:50.949 Scan finished successfully

12:11:28.465 Disk 0 MBR has been saved successfully to "C:\Users\Administrator\Desktop\MBR.dat"

12:11:28.465 The log file has been saved successfully to "C:\Users\Administrator\Desktop\aswMBR.txt"

резултати от Malwarebytes' Anti-Malware :

Malwarebytes' Anti-Malware 1.51.1.1800

www.malwarebytes.org

Database version: 7392

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

06.8.2011 г. 12:32:31

mbam-log-2011-08-06 (12-32-31).txt

Scan type: Full scan (C:\|D:\|E:\|H:\|)

Objects scanned: 198808

Time elapsed: 10 minute(s), 50 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\Users\administrator\local settings\application data\Xenocode\Sandbox\nero burning rom\8, 3, 6, 0\2010.02.03t15.31\Native\STUBEXE\@SYSTEM@\verclsid.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\administrator\local settings\application data\Xenocode\Sandbox\nero burning rom\8, 3, 6, 0\2010.02.03t15.31\Virtual\STUBEXE\@programfiles@\Nero\nero burning rom\nero.exe (Trojan.Agent) -> Quarantined and deleted successfully.

резултати от ESET Online Scanner :

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=c4893e298f2d4d44af3b2b97ba73e575

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-08-06 10:27:43

# local_time=2011-08-06 01:27:43 (+0200, FLE Daylight Time)

# country="Bulgaria"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=5891 16776533 42 87 347 9501687 0 0

# compatibility_mode=8192 67108863 100 0 151 151 0 0

# scanned=42794

# found=3

# cleaned=3

# scan_time=2846

C:\Qoobox\Quarantine\C\Windows\system32\settings.exe.vir probably a variant of Win32/Agent.CYOSPMR trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\WINDOWS\LastXP\Games\Bridges.exe probably a variant of Win32/Agent.HFKUGCR trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\WINDOWS\LastXP\Games\Netgame.exe probably a variant of Win32/Agent.EQWGYZV trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Перфектно.....!

Деинсталирайте Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

2.Изтеглете OTCleanIt или от тук,стартирайте и натиснете Clean up

• Изтеглете OTL.exe и го запазете на десктопа.
• Стартирайте файла с двукратен клик на мишката.
• Направете следните настройки:

• Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

:Services
 
:files
autorun.inf /alldrives
autorun.exe /alldrives
recycler /alldrives
ipconfig /flushdns /c
 
:Commands
[purity]
[emptytemp]
[resethosts]
[clearallrestorepoints]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

http://alfa.kachi-snimka.info/viewer.php?id=arx1312627622e.JPG като го напиша ми изписва това

Не го пишете правилно...забележете - между Combofix и /Uninstall има една идея разстояние...!

http://alfa.kachi-snimka.info/viewer.php?id=bfi1312628203h.JPG по този начин го правя но пак не става изписва същото

Добре, продължи с т.2 и следващите инструкции..!

резултати :

All processes killed

========== SERVICES/DRIVERS ==========

========== FILES ==========

autorun.inf not found in C:\

autorun.inf not found in D:\

autorun.inf not found in E:\

autorun.inf not found in H:\

autorun.exe not found in C:\

autorun.exe not found in D:\

autorun.exe not found in E:\

autorun.exe not found in H:\

C:\RECYCLER\S-1-5-21-507921405-1580818891-1177238915-500 folder moved successfully.

C:\RECYCLER folder moved successfully.

D:\RECYCLER\S-1-5-21-507921405-1580818891-1177238915-500 folder moved successfully.

D:\RECYCLER\S-1-5-21-1644491937-1935655697-682003330-1003 folder moved successfully.

D:\RECYCLER folder moved successfully.

E:\RECYCLER\S-1-5-21-507921405-1580818891-1177238915-500 folder moved successfully.

E:\RECYCLER folder moved successfully.

H:\RECYCLER\S-1-5-21-507921405-1580818891-1177238915-500 folder moved successfully.

H:\RECYCLER folder moved successfully.

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

H:\Downloads\cmd.bat deleted successfully.

H:\Downloads\cmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 43923400 bytes

->Java cache emptied: 85081 bytes

->FireFox cache emptied: 48986164 bytes

->Google Chrome cache emptied: 41202130 bytes

->Flash cache emptied: 29969 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService

->Temp folder emptied: 25074 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2434812 bytes

%systemroot%\System32 .tmp files removed: 7697 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 45959482 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 174,00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

Restore points cleared and new OTL Restore Point set!

[EMPTYFLASH]

User: Administrator

->Flash cache emptied: 0 bytes

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: UpdatusUser

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.26.1 log created on 08062011_140548

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Как е положението със системата ви..?Наблюдавате ли проблеми..?

засега е добре,но има друг проблем,файловете ми стоят като скрита http://alfa.kachi-snimka.info/viewer.php?id=opt1312630493a.JPGи да се виждат правих разни настройки от Tools..Folder Options ... отделно не мога да си поставя Mozilla на декстопа http://alfa.kachi-snimka.info/viewer.php?id=bfi1312630797k.JPG ,друго че не мога да се впиша в скъп но не знам дали проблема не е от самият скъп или от този вирус неми позволява

http://alfa.kachi-snimka.info/viewer.php?id=cqs1312631030v.JPG качвам пак първата снимка тъй като мисля че има проблем и не се вижда

Изтеглете FixAfterVirus.Разархивирате на десктопа си....и стартирате програмата.

Както виждате програмата е предназначена за възстановяване на системата поразена от вирус.Потвърждавате че сте съгласен.

Тук аз бих маркирал ''Изборно поправяне'' и щях да си избера фиксиране на проблемните позиции.Това и препоръчвам.

...в лявата колона маркирайте: 1,2,3,4,5,6,7,9 позиция

Внимание: Програмата може да измени ваши настройки по системата и интерфейса,както и поведението на компютъра ви..!

направих го както каза но разлика няма,иконите пак си стоят като скрити

Даааа..!Забелязах че съм пропуснал нещо много важно...!Сега ще направим ново сканиране с Комбофикс.:

Изтеглете ComboFix от тук или тук и го запазете на десктопа си.

• Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

• Стартирайте Combo-Fix.com и следвайте инструкциите.

Бележка: ComboFix ще се стартира без инсталирана Recovery Console.

• Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.

• Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.

** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

• Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
• ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
• ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
• ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
• В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

Работата на ComboFix, може да отнеме до 20-30 минути, за да завърши, моля имайте търпение.

Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.