Антивирусни сайтове/microsoft.com/прочее не се отварят [решен]

13 септември 201115 г.

Проблемът е общо взето изчерпан в заглавието. Други ефекти (забавяне на системата и т.н.) не виждам.

DDS:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_26
Run by Razor at 22:28:36 on 2011-09-13
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.3071.2460 [GMT 3:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Mozilla Firefox\firefox.exe
.
============== Pseudo HJT Report ===============
.
BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Hard Disk Sentinel] "c:\program files\hard disk sentinel\HDSentinel.exe" /AUTORUN
mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [btTray] "c:\program files\ivt corporation\bluesoleil\BtTray.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Send by Bluetooth - c:\program files\ivt corporation\bluesoleil\transsend\ie\tsinfo.htm
IE: Send via &Message... - c:\program files\ivt corporation\bluesoleil\transsend\ie\tssms.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: Interfaces\{828FCD3B-A40A-4ADC-86FC-2360D38BE01F} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{ABFE3FC1-0335-40E1-93B7-35955E58DFA1} : NameServer = 82.119.88.4 82.119.88.4
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\razor\application data\mozilla\firefox\profiles\ss8x115l.default\
FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
.
============= SERVICES / DRIVERS ===============
.
R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [2009-1-7 20744]
R2 BsMobileCS;BsMobileCS;c:\program files\ivt corporation\bluesoleil\BsMobileCS.exe [2009-2-27 143467]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\logmein hamachi\hamachi-2.exe [2011-5-25 1336712]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2010\TuneUpUtilitiesService32.exe [2009-12-18 1044808]
R3 3xHybrid;SAA7130 TV Card Service;c:\windows\system32\drivers\3xHybrid.sys [2010-9-16 716160]
R3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [2008-12-7 30088]
R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [2008-7-2 26248]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]
S2 cnswnrxmp;Universal Security;c:\windows\system32\svchost.exe -k netsvcs [2008-4-14 14336]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-11-5 1691480]
S3 FGUARD32;FGUARD32;c:\program files\folder guard\FGUARD32.sys [2010-10-8 55376]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-2-19 41272]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2010-9-10 11520]
.
=============== Created Last 30 ================
.
2011-09-06 21:18:15 -------- d-----w- c:\program files\Xenocode
2011-09-04 12:56:48 -------- d-----w- c:\documents and settings\razor\application data\GetRightToGo
2011-09-04 12:54:31 108336 ----a-w- c:\windows\system32\MSWINSCK.OCX
.
==================== Find3M ====================
.
2011-08-15 07:30:21 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-09 22:03:24 724992 ----a-w- c:\windows\iun6002.exe
2011-07-06 16:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 16:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
.
============= FINISH: 22:29:03,54 ===============

Attach:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 2/4/2010 4:51:16 PM
System Uptime: 9/13/2011 10:22:06 PM (0 hours ago)
.
Motherboard: Gigabyte Technology Co., Ltd. | | 945PLM-S2
Processor: Intel® Pentium® D CPU 2.80GHz | Socket 775 | 2794/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 61 GiB total, 25.646 GiB free.
D: is FIXED (NTFS) - 172 GiB total, 58.349 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is CDROM ()
H: is CDROM ()
I: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Bluetooth PAN Network Adapter
Device ID: {F12D3CF8-B11D-457E-8641-BE2AF2D6D204}\IVTBTPAN\1&21CCD16&0&0000
Manufacturer: IVT Corporation
Name: Bluetooth PAN Network Adapter
PNP Device ID: {F12D3CF8-B11D-457E-8641-BE2AF2D6D204}\IVTBTPAN\1&21CCD16&0&0000
Service: BT
.
==== System Restore Points ===================
.
RP1: 8/7/2011 10:07:02 PM - System Checkpoint
RP2: 8/16/2011 10:33:15 PM - System Checkpoint
RP3: 8/18/2011 10:18:23 PM - System Checkpoint
RP4: 8/21/2011 10:04:44 PM - System Checkpoint
RP5: 8/24/2011 12:29:52 PM - Configured Duke Nukem - Manhattan Project
RP6: 8/27/2011 2:30:46 PM - System Checkpoint
RP7: 8/28/2011 9:48:42 PM - System Checkpoint
RP8: 9/6/2011 5:36:28 PM - System Checkpoint
RP9: 9/8/2011 7:31:00 PM - System Checkpoint
RP10: 9/9/2011 10:37:22 PM - System Checkpoint
RP11: 9/11/2011 9:35:08 AM - System Checkpoint
RP12: 9/12/2011 7:35:58 PM - System Checkpoint
.
==== Installed Programs ======================
.
µTorrent
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Reader 9.3
Algebrator 4.0
ASIO4ALL
Audacity 1.3.12 (Unicode)
AviSynth 2.5
Bluesoleil 6.4.249.0
Call of Duty® 4 - Modern Warfare™ 1.5 Multiplayer Patch
Call of Duty® 4 - Modern Warfare™ 1.5 Patch
CDisplay 1.8
Claw
Combined Community Codec Pack 2009-09-09
CoreAVC Professional Edition (remove only)
CyberLink PowerDirector
Diablo II
Driver Genius Professional Edition
DVD Shrink 3.2
EAX Unified
ESET Online Scanner v3
FileBoss 2.515
Folder Guard
Fraps (remove only)
GameRanger
Gordian Knot Rip Pack 0.35.0
Haali Media Splitter
Half-Life
Hard Disk Sentinel PRO
Hero Editor V1.03
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows XP (KB954550-v5)
HyperCam 2
InterVideo DeviceService
Java Auto Updater
Java™ 6 Update 26
Kaiba Corp Virtual Duel System 1.28
Lagarith Lossless Codec (1.3.20)
Lame ACM MP3 Codec
LAME v3.98.2 for Audacity
LogMeIn Hamachi
Malwarebytes' Anti-Malware version 1.51.1.1800
MediaCoder 0.7.2.4580
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Games for Windows - LIVE
Microsoft Games for Windows - LIVE Redistributable
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
mIRC
MozBackup 1.4.10
Mozilla Firefox 6.0.2 (x86 bg)
MPEG-VCR 3.14.7.3 (11/2009)
MSXML 4.0 SP2 Parser and SDK
MX Skype Recorder v3.5.1
NVIDIA Drivers
Orbit Downloader
Pack Vista Inspirat 2 1.0
Pivot Stickfigure Animator
PixelView
Project64 1.6
PunkBuster Services
Realtek High Definition Audio Driver
Skype™ 3.8
Subtitle Workshop 2.51
The KMPlayer 2.9.4.1434
TuneUp Utilities
TuneUp Utilities Language Pack (en-US)
Ubisoft Game Launcher
Ulead VideoStudio 11
Unlocker 1.8.8
VideoStudio
WebFldrs XP
Winamp
Windows Media Format 11 runtime
WinRAR archiver
XChat 2 (remove only)
XML Paper Specification Shared Components Pack 1.0
Xvid 1.2.2 final uninstall
XviD4PSP 5.0
Yu-Gi-Oh! Power of Chaos JOEY THE PASSION
zbattle.net 1.09 SR-1 beta
.
==== Event Viewer Messages From Past Week ========
.
9/13/2011 9:23:38 PM, error: HTTP [15005] - Unable to bind to the underlying transport for 0.0.0.0:2869. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine. The data field contains the error number.
9/13/2011 9:15:34 PM, error: Service Control Manager [7023] - The Universal Security service terminated with the following error: A dynamic link library (DLL) initialization routine failed.
.
==== End Of File ===========================

Редактирано 8 октомври 201114 г. от nologo (преглед на промените)

13 септември 201115 г.

Сега ще проверим защо става така.

Следвайте инструкцията за работа със Security Check:

Изтеглете Security Check (автор: screen317) от тук или от тук и го запишете на десктопа.
Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt.
Копирайте съдържанието с Копирай (Copy) на checkup.txt и с Постави (Paste) го поставете в следващия си коментар.

След това Start - Run - и с Copy/Paste поставете в полето следния текст, маркиран в синьо:

notepad C:\windows\system32\drivers\etc\hosts

След това Enter

Ще се отвори Notepad. Копирайте текста и го поставете в следващия си коментар.

Ако не можете да се справите, пропуснете го.

13 септември 201115 г.

Автор

Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 3
Internet Explorer 6 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
ESET Online Scanner v3
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
TuneUp Utilities
TuneUp Utilities Language Pack (en-US)
Java™ 6 Update 26
Out of date Java installed!
Adobe Flash Player 10.3.183.5
Adobe Reader 9.3
Out of date Adobe Reader installed!
Mozilla Firefox (x86 bg..) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
``````````End of Log````````````

# Copyright © 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

127.0.0.1 static3.cdn.ubi.com
127.0.0.1 ubisoft-orbit.s3.amazonaws.com
127.0.0.1 onlineconfigservice.ubi.com
127.0.0.1 orbitservice.ubi.com
127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com

127.0.0.1 static3.cdn.ubi.com
127.0.0.1 ubisoft-orbit.s3.amazonaws.com
127.0.0.1 onlineconfigservice.ubi.com
127.0.0.1 orbitservice.ubi.com
127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com

127.0.0.1 static3.cdn.ubi.com
127.0.0.1 ubisoft-orbit.s3.amazonaws.com
127.0.0.1 onlineconfigservice.ubi.com
127.0.0.1 orbitservice.ubi.com
127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com

127.0.0.1 static3.cdn.ubi.com
127.0.0.1 ubisoft-orbit.s3.amazonaws.com
127.0.0.1 onlineconfigservice.ubi.com
127.0.0.1 orbitservice.ubi.com
127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com

13 септември 201115 г.

Антивирусната защита липсва. Сега изтеглете OTL.exe и го запазете на десктопа.

Стартирайте OTL (ако е необходимо, потвърдете през UAC).
Направете следните настройки:
Сложете отметка пред Scan All Users
Под менюто File Age изберете 90 days
Под менюто Standard Registryпроменете на ALL
Сложете отметки пред LOP и Purity Check

Под

с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
drivers32 /all
%SYSTEMDRIVE%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
/md5start
atapi.sys
iaStor.sys
explorer.exe
svchost.exe
userinit.exe
hlp.dat
winlogon.exe
wininit.exe
volsnap.sys
/md5stop

Натиснете маркираният в синьо бутон: Run Scan.
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

13 септември 201115 г.

Автор

Ето:

OTL.Txt

Extras.Txt

13 септември 201115 г.

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:otl
O33 - MountPoints2\{399e98b1-461e-11df-bfa0-0016e6d8c1a5}\Shell - "" = AutoRun
O33 - MountPoints2\{399e98b1-461e-11df-bfa0-0016e6d8c1a5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{399e98b1-461e-11df-bfa0-0016e6d8c1a5}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
@Alternate Data Stream - 143 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:527DAC91
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = o
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"2709:TCP" = -
:files
recycler /alldrives
ipconfig /flushdns /c
C:\WINDOWS\system32\cnepd.dll
:commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

13 септември 201115 г.

Автор

All processes killed
========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{399e98b1-461e-11df-bfa0-0016e6d8c1a5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{399e98b1-461e-11df-bfa0-0016e6d8c1a5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{399e98b1-461e-11df-bfa0-0016e6d8c1a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{399e98b1-461e-11df-bfa0-0016e6d8c1a5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{399e98b1-461e-11df-bfa0-0016e6d8c1a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{399e98b1-461e-11df-bfa0-0016e6d8c1a5}\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn not found.
ADS C:\Documents and Settings\All Users\Application Data\Temp:527DAC91 deleted successfully.
========== FILES ==========
File move failed. C:\WINDOWS\system32\cnepd.dll scheduled to be moved on reboot.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\"FirstRunDisabled" | 0 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\"AntiVirusDisableNotify" | 0 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\"UpdatesDisableNotify" | 0 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\"AntiVirusOverride" | o /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\"FirewallOverride" | 0 /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\2709:TCP deleted successfully.
========== FILES ==========
C:\RECYCLER\S-1-5-21-583907252-1677128483-1177238915-1003 folder moved successfully.
C:\RECYCLER folder moved successfully.
D:\RECYCLER\S-1-5-21-583907252-1677128483-1177238915-1003 folder moved successfully.
D:\RECYCLER\S-1-5-21-220523388-1275210071-839522115-1003 folder moved successfully.
D:\RECYCLER\S-1-5-21-1214440339-573735546-842925246-1003 folder moved successfully.
D:\RECYCLER folder moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Razor\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Razor\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Razor
->Temp folder emptied: 46904916 bytes
->Temporary Internet Files folder emptied: 22240494 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 232300340 bytes
->Flash cache emptied: 8495 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 574697 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 288,00 mb

[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: Razor
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.28.0 log created on 09142011_003257

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\system32\cnepd.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot...

13 септември 201115 г.

Много си бърз, приятелю. Аз едва давам инструкции, дано не съм оплескал нещо заради артефактите на форума. След малко ще пиша.

Айде пак наново. Същото с OTL, както преди малко. Само че със следния скрипт:

:otl
NetSvcs: cnswnrxmp - C:\WINDOWS\system32\cnepd.dll ()
:services:
cnswnrxmp
:files
recycler /alldrives
ipconfig /flushdns /c
:commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

13 септември 201115 г.

Автор

All processes killed
========== OTL ==========
cnswnrxmp removed from NetSvcs value successfully!
Service cnswnrxmp stopped successfully!
Service cnswnrxmp deleted successfully!
File move failed. C:\WINDOWS\system32\cnepd.dll scheduled to be moved on reboot.
Error: Unable to interpret <:services:> in the current context!
Error: Unable to interpret <cnswnrxmp> in the current context!
========== FILES ==========
C:\RECYCLER\S-1-5-21-583907252-1677128483-1177238915-1003 folder moved successfully.
C:\RECYCLER folder moved successfully.
D:\RECYCLER\S-1-5-21-583907252-1677128483-1177238915-1003 folder moved successfully.
D:\RECYCLER folder moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Razor\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Razor\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Razor
->Temp folder emptied: 701789 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 27648787 bytes
->Flash cache emptied: 566 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 341 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 27,00 mb

[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: Razor
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.28.0 log created on 09142011_005018

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\system32\cnepd.dll not found!

Registry entries deleted on Reboot...

***Сега всички си зареждат нормално.

Редактирано 13 септември 201115 г. от Scarecrow (преглед на промените)

13 септември 201115 г.

Сега аз искам малко съдействие. Ще може ли да качиш папката C:\_OTL\MovedFiles например тук.

P.S. Ако е много голяма, пиши. Имаме още малко работа.

13 септември 201115 г.

Автор

Mod Edit: Файлът е премахнат от съображения за сигурност.

Редактирано 13 септември 201115 г. от nologo (преглед на промените)

13 септември 201115 г.

Супер, Следва:

Стартирайте OTL още веднъж и натиснете бутона CleanUp.

Публикувано изображение

При дeинсталацията на OTL ще бъдат почистени инструменти и файлове, които използвахме в темата. Ще последва рестарт на Windows. Може да изтриете останалите програми и логове, които използвахме в темата, ако има остатъци.

Сега може ли един скан с MBAM (Malwarebytes Anti-Malware)?

13 септември 201115 г.

Автор

Бързият скан не откри нищо, пълен ще пусна утре, защото ще отнеме много време.

13 септември 201115 г.

О.К. Препоръчвам това, което намери Security Check в червено да бъде поправено: инсталация на антивирус (може да е безплатен или от раздела с промоциите, но не кракнат, пачнат и пр.), последна версия на Java и обновяване на Firefox.

14 септември 201115 г.

Автор

И пълното сканиране не откри нищо, това предполагам е краят и темата може да се преименува на решена.

14 септември 201115 г.

Точно така. Приятна вечер и успех!

15 септември 201115 г.

Автор

Така, ново развитие по въпроса - снощи същият проблем с невъзможността за отваряне на страници се появи отново. Този път Malwarebytes засече

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (PUM.Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

и с неговото изтриване се оправи. Днес при скан пак намери същото (PUM.Hijack.System.Hidden). Някакви предложения?

15 септември 201115 г.

Понеже файлът, който взехме от карантината на OTL беше пратен на доста места, вече се засича. Аз имам малко съмнения, затова е добре да видя още един лог от DDS.

15 септември 201115 г.

Автор

DDS:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_26
Run by Razor at 18:46:50 on 2011-09-15
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.3071.2503 [GMT 3:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Hard Disk Sentinel\HDSentinel.exe
C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SNDVOL32.EXE
.
============== Pseudo HJT Report ===============
.
BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Hard Disk Sentinel] "c:\program files\hard disk sentinel\HDSentinel.exe" /AUTORUN
mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [btTray] "c:\program files\ivt corporation\bluesoleil\BtTray.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Send by Bluetooth - c:\program files\ivt corporation\bluesoleil\transsend\ie\tsinfo.htm
IE: Send via &Message... - c:\program files\ivt corporation\bluesoleil\transsend\ie\tssms.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: Interfaces\{ABFE3FC1-0335-40E1-93B7-35955E58DFA1} : NameServer = 82.119.88.5 82.119.88.5
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\razor\application data\mozilla\firefox\profiles\ss8x115l.default\
FF - prefs.js: browser.search.selectedEngine - YouTube Video Search
FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
.
============= SERVICES / DRIVERS ===============
.
R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [2009-1-7 20744]
R2 BsMobileCS;BsMobileCS;c:\program files\ivt corporation\bluesoleil\BsMobileCS.exe [2009-2-27 143467]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\logmein hamachi\hamachi-2.exe [2011-5-25 1336712]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2010\TuneUpUtilitiesService32.exe [2009-12-18 1044808]
R3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [2008-12-7 30088]
R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [2008-7-2 26248]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]
S2 bckbn;Installer Shell;c:\windows\system32\svchost.exe -k netsvcs [2008-4-14 14336]
S2 pzplpaq;Time Helper;c:\windows\system32\svchost.exe -k netsvcs [2008-4-14 14336]
S2 txtkvrjpm;Microsoft Security;c:\windows\system32\svchost.exe -k netsvcs [2008-4-14 14336]
S2 yehzclam;Installer Time;c:\windows\system32\svchost.exe -k netsvcs [2008-4-14 14336]
S3 3xHybrid;SAA7130 TV Card Service;c:\windows\system32\drivers\3xHybrid.sys [2010-9-16 716160]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-11-5 1691480]
S3 FGUARD32;FGUARD32;c:\program files\folder guard\FGUARD32.sys [2010-10-8 55376]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2010-9-10 11520]
.
=============== Created Last 30 ================
.
2011-09-06 21:18:15 -------- d-----w- c:\program files\Xenocode
2011-09-04 12:56:48 -------- d-----w- c:\documents and settings\razor\application data\GetRightToGo
2011-09-04 12:54:31 108336 ----a-w- c:\windows\system32\MSWINSCK.OCX
.
==================== Find3M ====================
.
2011-08-15 07:30:21 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-09 22:03:24 724992 ----a-w- c:\windows\iun6002.exe
2011-07-06 16:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 16:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
.
============= FINISH: 18:47:23,76 ===============

Attach:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 2/4/2010 4:51:16 PM
System Uptime: 9/15/2011 2:03:54 PM (4 hours ago)
.
Motherboard: Gigabyte Technology Co., Ltd. | | 945PLM-S2
Processor: Intel® Pentium® D CPU 2.80GHz | Socket 775 | 2793/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 61 GiB total, 28.865 GiB free.
D: is FIXED (NTFS) - 172 GiB total, 57.534 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is CDROM ()
H: is CDROM ()
I: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description: SAA7130 TV Card
Device ID: PCI\VEN_1131&DEV_7130&SUBSYS_00001131&REV_01\4&BC67B8D&0&10F0
Manufacturer: Philips Semiconductors
Name: SAA7130 TV Card
PNP Device ID: PCI\VEN_1131&DEV_7130&SUBSYS_00001131&REV_01\4&BC67B8D&0&10F0
Service: 3xHybrid
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Bluetooth PAN Network Adapter
Device ID: {F12D3CF8-B11D-457E-8641-BE2AF2D6D204}\IVTBTPAN\1&21CCD16&0&0000
Manufacturer: IVT Corporation
Name: Bluetooth PAN Network Adapter
PNP Device ID: {F12D3CF8-B11D-457E-8641-BE2AF2D6D204}\IVTBTPAN\1&21CCD16&0&0000
Service: BT
.
==== System Restore Points ===================
.
RP1: 9/15/2011 2:05:05 PM - System Checkpoint
.
==== Installed Programs ======================
.
µTorrent
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Reader 9.3
Algebrator 4.0
ASIO4ALL
Audacity 1.3.12 (Unicode)
AviSynth 2.5
Bluesoleil 6.4.249.0
Call of Duty® 4 - Modern Warfare™ 1.5 Multiplayer Patch
Call of Duty® 4 - Modern Warfare™ 1.5 Patch
CDisplay 1.8
Claw
Combined Community Codec Pack 2009-09-09
CoreAVC Professional Edition (remove only)
CyberLink PowerDirector
Diablo II
Driver Genius Professional Edition
DVD Shrink 3.2
EAX Unified
ESET Online Scanner v3
FileBoss 2.515
Folder Guard
Fraps (remove only)
GameRanger
Gordian Knot Rip Pack 0.35.0
Haali Media Splitter
Half-Life
Hard Disk Sentinel PRO
Hero Editor V1.03
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows XP (KB954550-v5)
HyperCam 2
InterVideo DeviceService
Java Auto Updater
Java™ 6 Update 26
Kaiba Corp Virtual Duel System 1.28
Lagarith Lossless Codec (1.3.20)
Lame ACM MP3 Codec
LAME v3.98.2 for Audacity
LogMeIn Hamachi
Malwarebytes' Anti-Malware version 1.51.1.1800
MediaCoder 0.7.2.4580
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Games for Windows - LIVE
Microsoft Games for Windows - LIVE Redistributable
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
mIRC
MozBackup 1.4.10
Mozilla Firefox 6.0.2 (x86 bg)
MPEG-VCR 3.14.7.3 (11/2009)
MSXML 4.0 SP2 Parser and SDK
MX Skype Recorder v3.5.1
NVIDIA Drivers
Orbit Downloader
Pack Vista Inspirat 2 1.0
Pivot Stickfigure Animator
PixelView
Project64 1.6
PunkBuster Services
Realtek High Definition Audio Driver
Skype™ 3.8
Subtitle Workshop 2.51
The KMPlayer 2.9.4.1434
TuneUp Utilities
TuneUp Utilities Language Pack (en-US)
Ubisoft Game Launcher
Ulead VideoStudio 11
Unlocker 1.8.8
VideoStudio
WebFldrs XP
Winamp
Windows Media Format 11 runtime
WinRAR archiver
XChat 2 (remove only)
XML Paper Specification Shared Components Pack 1.0
Xvid 1.2.2 final uninstall
XviD4PSP 5.0
Yu-Gi-Oh! Power of Chaos JOEY THE PASSION
zbattle.net 1.09 SR-1 beta
.
==== Event Viewer Messages From Past Week ========
.
9/15/2011 1:27:12 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
9/15/2011 1:27:03 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
9/15/2011 1:27:03 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
9/15/2011 1:27:03 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
9/15/2011 1:27:03 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
9/15/2011 1:27:03 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
9/15/2011 1:27:01 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
9/15/2011 1:20:15 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
9/14/2011 12:50:19 AM, error: Service Control Manager [7034] - The TuneUp Utilities Service service terminated unexpectedly. It has done this 1 time(s).
9/14/2011 12:50:19 AM, error: Service Control Manager [7034] - The PnkBstrA service terminated unexpectedly. It has done this 1 time(s).
9/14/2011 12:50:19 AM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
9/14/2011 12:50:19 AM, error: Service Control Manager [7034] - The LogMeIn Hamachi 2.0 Tunneling Engine service terminated unexpectedly. It has done this 1 time(s).
9/14/2011 12:50:19 AM, error: Service Control Manager [7034] - The Cyberlink RichVideo Service(CRVS) service terminated unexpectedly. It has done this 1 time(s).
9/14/2011 12:50:19 AM, error: Service Control Manager [7034] - The Capture Device Service service terminated unexpectedly. It has done this 1 time(s).
9/14/2011 12:50:19 AM, error: Service Control Manager [7034] - The BsMobileCS service terminated unexpectedly. It has done this 1 time(s).
9/14/2011 12:50:19 AM, error: Service Control Manager [7034] - The BsHelpCS service terminated unexpectedly. It has done this 1 time(s).
9/14/2011 12:50:19 AM, error: Service Control Manager [7034] - The BlueSoleilCS service terminated unexpectedly. It has done this 1 time(s).
9/14/2011 12:36:05 AM, error: Service Control Manager [7023] - The Universal Security service terminated with the following error: A dynamic link library (DLL) initialization routine failed.
9/14/2011 1:21:28 AM, error: Dhcp [1002] - The IP address lease 0.0.0.0 for the Network Card with network address 0016E6D8C1A5 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
9/14/2011 1:21:27 AM, error: Dhcp [1002] - The IP address lease 192.168.1.45 for the Network Card with network address 0016E6D8C1A5 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
9/13/2011 9:44:23 PM, error: HTTP [15005] - Unable to bind to the underlying transport for 0.0.0.0:2869. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine. The data field contains the error number.
.
==== End Of File ===========================

15 септември 201115 г.

Ще се наложи да работим с големия чук.

1. Изтеглете ComboFix от BleepingComputer

и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

Публикувано изображение

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

Публикувано изображение

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива. За целта може да прегледате информацията от този линк: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. ComboFix ще провери дали Windows Recovery Console e инсталиранa.

*Необходимо да използвате NO за Windows Recovery Console

5. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

Забележка: При проблеми с ComboFix копирайте с (Copy) и поставете с (Paste) съдържанието на C:\BUG.txt в следващия си коментар.

6. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Публикувано изображение

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

15 септември 201115 г.

Автор

ComboFix 11-09-15.05 - Razor 09.2011 г. 20:15:31.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.3071.2454 [GMT 3:00]
Running from: c:\documents and settings\Razor\Desktop\ComboFix.exe
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Razor\Start Menu\Programs\1964.lnk
c:\documents and settings\Razor\WINDOWS
c:\windows\system32\mfc100deu.dll
c:\windows\XSxS
.
.
((((((((((((((((((((((((( Files Created from 2011-08-15 to 2011-09-15 )))))))))))))))))))))))))))))))
.
.
2011-09-14 22:26 . 2011-09-14 22:26 -------- d-----w- c:\documents and settings\Administrator
2011-09-13 18:35 . 2011-09-13 18:35 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles
2011-09-06 21:18 . 2011-09-06 21:18 -------- d-----w- c:\program files\Xenocode
2011-09-04 12:56 . 2011-09-04 12:57 -------- d-----w- c:\documents and settings\Razor\Application Data\GetRightToGo
2011-09-04 12:54 . 2007-03-01 10:26 108336 ----a-w- c:\windows\system32\MSWINSCK.OCX
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-15 07:30 . 2011-05-15 10:25 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-30 09:47 . 2011-07-30 09:47 45056 ----a-r- c:\documents and settings\Razor\Application Data\Microsoft\Installer\{336DD6B4-B100-4048-B2B7-FBA7059FD959}\NewShortcut2_42519298BFF84444A0D4589027E45BA4.exe
2011-07-30 09:47 . 2011-07-30 09:47 40960 ----a-r- c:\documents and settings\Razor\Application Data\Microsoft\Installer\{336DD6B4-B100-4048-B2B7-FBA7059FD959}\NewShortcut3_42519298BFF84444A0D4589027E45BA4.exe
2011-07-30 09:47 . 2011-07-30 09:47 40960 ----a-r- c:\documents and settings\Razor\Application Data\Microsoft\Installer\{336DD6B4-B100-4048-B2B7-FBA7059FD959}\NewShortcut1_42519298BFF84444A0D4589027E45BA4.exe
2011-07-09 22:03 . 2011-07-09 22:03 724992 ----a-w- c:\windows\iun6002.exe
2011-07-06 16:52 . 2010-02-19 12:29 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 16:52 . 2010-02-19 12:29 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-07 07:34 . 2011-07-10 16:07 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-14 . BD0D8A40D28A07DB96913D6DA2E6B5A3 . 100864 . . [5.4.3790.5512] . . c:\windows\system32\wuauclt.exe
[-] 2008-04-14 . BD0D8A40D28A07DB96913D6DA2E6B5A3 . 100864 . . [5.4.3790.5512] . . c:\windows\system32\dllcache\wuauclt.exe
.
[-] 2008-04-14 . FAF0B7CBC359831970AF068390A0CB4C . 3507200 . . [6.00.2900.5512] . . c:\windows\system32\mshtml.dll
[-] 2008-04-14 . FAF0B7CBC359831970AF068390A0CB4C . 3507200 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\mshtml.dll
.
[-] 2008-04-14 . 8A513E79E7980018DAEDCA586B866BC3 . 699904 . . [6.00.2900.5512] . . c:\windows\system32\wininet.dll
[-] 2008-04-14 . 8A513E79E7980018DAEDCA586B866BC3 . 699904 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\wininet.dll
.
[-] 2008-04-14 . 561A50497324F378E30F55D09B4E1258 . 975872 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 561A50497324F378E30F55D09B4E1258 . 975872 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe
.
[-] 2008-04-14 . 0B720CAE71F51A2B93811816F187BC0A . 224256 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[-] 2008-04-14 . 0B720CAE71F51A2B93811816F187BC0A . 224256 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regedit.exe
.
[-] 2008-04-14 . AAC9DAE0E7C43BD26C43FC7436E2F1B0 . 832512 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\iexplore.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-02-04 289584]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"Hard Disk Sentinel"="c:\program files\Hard Disk Sentinel\HDSentinel.exe" [2010-02-04 3458560]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"BtTray"="c:\program files\IVT Corporation\BlueSoleil\BtTray.exe" [2009-02-27 278016]
"RTHDCPL"="RTHDCPL.EXE" [2010-10-05 19580520]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PixelView Schedule Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PixelView Schedule Agent.lnk
backup=c:\windows\pss\PixelView Schedule Agent.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2010-10-05 16:10 64104 ----a-w- c:\windows\ALCMTR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 09:00 110592 ----a-w- c:\windows\system32\bthprops.cpl
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
2007-08-16 11:24 167368 ----a-w- c:\program files\DAEMON Tools\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2011-05-25 14:29 1951112 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-07-06 16:52 449584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2007-12-05 01:41 1626112 ----a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-04-08 09:59 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TV Card Remote Control Device Monitor]
2007-09-14 01:00 466944 ----a-w- c:\windows\713xRMT.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload]
2007-03-03 12:12 341488 ----a-w- c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"TuneUp.Defrag"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"="o"
"FirewallOverride"="0"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Opera Portable\\Opera1010usb\\OperaUSB.exe"=
"c:\\Program Files\\sysreset Portable\\mirc.exe"=
"d:\\Consoles\\ Kaillera Server\\kaillerasrv.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe"=
"c:\\Program Files\\zbattle.net\\zbattle.net.exe"=
"d:\\Diablo II\\Game.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"d:\\Yu-Gi-Oh!\\joey_pc.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Documents and Settings\\Razor\\Application Data\\GameRanger\\GameRanger\\GameRanger.exe"=
"c:\\Program Files\\xchat\\xchat.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2709:TCP"= 2709:TCP:fxmjf
.
R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [1/7/2009 11:39 PM 20744]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2/6/2010 5:22 PM 685816]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [12/18/2009 1:12 AM 1044808]
R3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [12/7/2008 12:44 PM 30088]
R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [7/2/2008 2:58 PM 26248]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [10/14/2009 8:24 AM 10064]
S2 bckbn;Installer Shell;c:\windows\system32\svchost.exe -k netsvcs [4/14/2008 12:00 PM 14336]
S2 BsMobileCS;BsMobileCS;c:\program files\IVT Corporation\BlueSoleil\BsMobileCS.exe [2/27/2009 4:40 PM 143467]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [5/25/2011 5:29 PM 1336712]
S2 pzplpaq;Time Helper;c:\windows\system32\svchost.exe -k netsvcs [4/14/2008 12:00 PM 14336]
S2 txtkvrjpm;Microsoft Security;c:\windows\system32\svchost.exe -k netsvcs [4/14/2008 12:00 PM 14336]
S2 yehzclam;Installer Time;c:\windows\system32\svchost.exe -k netsvcs [4/14/2008 12:00 PM 14336]
S3 3xHybrid;SAA7130 TV Card Service;c:\windows\system32\drivers\3xHybrid.sys [9/16/2010 5:14 PM 716160]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [11/5/2010 1:18 PM 1691480]
S3 FGUARD32;FGUARD32;c:\program files\Folder Guard\FGUARD32.sys [10/8/2010 4:14 PM 55376]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [9/10/2010 12:23 AM 11520]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - YEHZCLAM
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
uxtuneup
.
pzplpaq
bckbn
txtkvrjpm
yehzclam
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-15 c:\windows\Tasks\Automatic troubleshooting.job
- c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-12-17 22:18]
.
.
------- Supplementary Scan -------
.
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send by Bluetooth - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
IE: Send via &Message... - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
TCP: Interfaces\{ABFE3FC1-0335-40E1-93B7-35955E58DFA1}: NameServer = 82.119.88.5 82.119.88.5
FF - ProfilePath - c:\documents and settings\Razor\Application Data\Mozilla\Firefox\Profiles\ss8x115l.default\
FF - prefs.js: browser.search.selectedEngine - YouTube Video Search
FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-Adobe ARM - c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
AddRemove-HijackThis - c:\program files\HiJackThis Portable\HijackThis.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-15 20:22
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\bckbn]
"ServiceDll"="c:\windows\system32\cnepd.dll"
--
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\pzplpaq]
"ServiceDll"="c:\windows\system32\cnepd.dll"
--
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\txtkvrjpm]
"ServiceDll"="c:\windows\system32\cnepd.dll"
--
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\yehzclam]
"ServiceDll"="c:\windows\system32\cnepd.dll"
.
Completion time: 2011-09-15 20:27:04
ComboFix-quarantined-files.txt 2011-09-15 17:27
.
Pre-Run: 30 750 343 168 bytes free
Post-Run: 30 709 075 968 bytes free
.
- - End Of File - - 044B1894067F1156C202AA3E650001A6

15 септември 201115 г.

Сега изтеглете следния файл:

Провлачете и го пуснете в Combofix, както е показано на снимката:

Публикувано изображение

Забележка: По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си коментар.

15 септември 201115 г.

Автор

ComboFix 11-09-15.05 - Razor 09.2011 г. 21:59:46.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.3071.2461 [GMT 3:00]
Running from: c:\documents and settings\Razor\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Razor\Desktop\CFScript.txt
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
FILE ::
"c:\windows\system32\cnepd.dll"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_BCKBN
-------\Legacy_PZPLPAQ
-------\Legacy_TXTKVRJPM
-------\Legacy_YEHZCLAM
-------\Service_bckbn
-------\Service_pzplpaq
-------\Service_txtkvrjpm
-------\Service_yehzclam
.
.
((((((((((((((((((((((((( Files Created from 2011-08-15 to 2011-09-15 )))))))))))))))))))))))))))))))
.
.
2011-09-14 22:26 . 2011-09-14 22:26 -------- d-----w- c:\documents and settings\Administrator
2011-09-13 18:35 . 2011-09-13 18:35 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles
2011-09-06 21:18 . 2011-09-06 21:18 -------- d-----w- c:\program files\Xenocode
2011-09-04 12:56 . 2011-09-04 12:57 -------- d-----w- c:\documents and settings\Razor\Application Data\GetRightToGo
2011-09-04 12:54 . 2007-03-01 10:26 108336 ----a-w- c:\windows\system32\MSWINSCK.OCX
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-15 07:30 . 2011-05-15 10:25 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-30 09:47 . 2011-07-30 09:47 45056 ----a-r- c:\documents and settings\Razor\Application Data\Microsoft\Installer\{336DD6B4-B100-4048-B2B7-FBA7059FD959}\NewShortcut2_42519298BFF84444A0D4589027E45BA4.exe
2011-07-30 09:47 . 2011-07-30 09:47 40960 ----a-r- c:\documents and settings\Razor\Application Data\Microsoft\Installer\{336DD6B4-B100-4048-B2B7-FBA7059FD959}\NewShortcut3_42519298BFF84444A0D4589027E45BA4.exe
2011-07-30 09:47 . 2011-07-30 09:47 40960 ----a-r- c:\documents and settings\Razor\Application Data\Microsoft\Installer\{336DD6B4-B100-4048-B2B7-FBA7059FD959}\NewShortcut1_42519298BFF84444A0D4589027E45BA4.exe
2011-07-09 22:03 . 2011-07-09 22:03 724992 ----a-w- c:\windows\iun6002.exe
2011-07-06 16:52 . 2010-02-19 12:29 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 16:52 . 2010-02-19 12:29 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-07 07:34 . 2011-07-10 16:07 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-14 . BD0D8A40D28A07DB96913D6DA2E6B5A3 . 100864 . . [5.4.3790.5512] . . c:\windows\system32\wuauclt.exe
[-] 2008-04-14 . BD0D8A40D28A07DB96913D6DA2E6B5A3 . 100864 . . [5.4.3790.5512] . . c:\windows\system32\dllcache\wuauclt.exe
.
[-] 2008-04-14 . FAF0B7CBC359831970AF068390A0CB4C . 3507200 . . [6.00.2900.5512] . . c:\windows\system32\mshtml.dll
[-] 2008-04-14 . FAF0B7CBC359831970AF068390A0CB4C . 3507200 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\mshtml.dll
.
[-] 2008-04-14 . 8A513E79E7980018DAEDCA586B866BC3 . 699904 . . [6.00.2900.5512] . . c:\windows\system32\wininet.dll
[-] 2008-04-14 . 8A513E79E7980018DAEDCA586B866BC3 . 699904 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\wininet.dll
.
[-] 2008-04-14 . 561A50497324F378E30F55D09B4E1258 . 975872 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 561A50497324F378E30F55D09B4E1258 . 975872 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe
.
[-] 2008-04-14 . 0B720CAE71F51A2B93811816F187BC0A . 224256 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[-] 2008-04-14 . 0B720CAE71F51A2B93811816F187BC0A . 224256 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regedit.exe
.
[-] 2008-04-14 . AAC9DAE0E7C43BD26C43FC7436E2F1B0 . 832512 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\iexplore.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-02-04 289584]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"Hard Disk Sentinel"="c:\program files\Hard Disk Sentinel\HDSentinel.exe" [2010-02-04 3458560]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"BtTray"="c:\program files\IVT Corporation\BlueSoleil\BtTray.exe" [2009-02-27 278016]
"RTHDCPL"="RTHDCPL.EXE" [2010-10-05 19580520]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PixelView Schedule Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PixelView Schedule Agent.lnk
backup=c:\windows\pss\PixelView Schedule Agent.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2010-10-05 16:10 64104 ----a-w- c:\windows\ALCMTR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 09:00 110592 ----a-w- c:\windows\system32\bthprops.cpl
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
2007-08-16 11:24 167368 ----a-w- c:\program files\DAEMON Tools\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2011-05-25 14:29 1951112 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-07-06 16:52 449584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2007-12-05 01:41 1626112 ----a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-04-08 09:59 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TV Card Remote Control Device Monitor]
2007-09-14 01:00 466944 ----a-w- c:\windows\713xRMT.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload]
2007-03-03 12:12 341488 ----a-w- c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"TuneUp.Defrag"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Opera Portable\\Opera1010usb\\OperaUSB.exe"=
"c:\\Program Files\\sysreset Portable\\mirc.exe"=
"d:\\Consoles\\ Kaillera Server\\kaillerasrv.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe"=
"c:\\Program Files\\zbattle.net\\zbattle.net.exe"=
"d:\\Diablo II\\Game.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"d:\\Yu-Gi-Oh!\\joey_pc.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Documents and Settings\\Razor\\Application Data\\GameRanger\\GameRanger\\GameRanger.exe"=
"c:\\Program Files\\xchat\\xchat.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [1/7/2009 11:39 PM 20744]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2/6/2010 5:22 PM 685816]
R2 BsMobileCS;BsMobileCS;c:\program files\IVT Corporation\BlueSoleil\BsMobileCS.exe [2/27/2009 4:40 PM 143467]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [5/25/2011 5:29 PM 1336712]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [12/18/2009 1:12 AM 1044808]
R3 3xHybrid;SAA7130 TV Card Service;c:\windows\system32\drivers\3xHybrid.sys [9/16/2010 5:14 PM 716160]
R3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [12/7/2008 12:44 PM 30088]
R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [7/2/2008 2:58 PM 26248]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [10/14/2009 8:24 AM 10064]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [11/5/2010 1:18 PM 1691480]
S3 FGUARD32;FGUARD32;c:\program files\Folder Guard\FGUARD32.sys [10/8/2010 4:14 PM 55376]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [9/10/2010 12:23 AM 11520]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
uxtuneup
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-15 c:\windows\Tasks\Automatic troubleshooting.job
- c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-12-17 22:18]
.
.
------- Supplementary Scan -------
.
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send by Bluetooth - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
IE: Send via &Message... - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
FF - ProfilePath - c:\documents and settings\Razor\Application Data\Mozilla\Firefox\Profiles\ss8x115l.default\
FF - prefs.js: browser.startup.homepage - hxxp://bg.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:bg:official
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-15 22:10
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2856)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\BsMobileSDK.dll
c:\windows\system32\BsLangInDepRes.dll
c:\windows\system32\Bs2Res.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\program files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
c:\program files\Common Files\InterVideo\DeviceService\DevSvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\IVT Corporation\BlueSoleil\BsHelpCS.exe
c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-09-15 22:13:30 - machine was rebooted
ComboFix-quarantined-files.txt 2011-09-15 19:13
ComboFix2.txt 2011-09-15 17:27
.
Pre-Run: 30 321 246 208 bytes free
Post-Run: 30 210 961 408 bytes free
.
- - End Of File - - 09F79E81FDC2E5853A52AED9B8F7D4B0

След ребуута (по време на създаването на лога) някои startup програми се пуснаха, надявам се да не е проблем.

15 септември 201115 г.

О.К. Сега да пооправим още малко системата. Ето един файл: Трябва да се разархивира и да се стартира. След това ми трябва един бърз скан от MBAM и резултатите. Има ли някакви сериозни проблеми с Windows? Какви startup програми се пуснаха?

15 септември 201115 г.

Автор

utorrent, скайп, Hard Disk Sentinel. MBAM не открива нищо. Windows-ът се държи нормално, не намирам видими проблеми.

Добре дошли!

Антивирусни сайтове/microsoft.com/прочее не се отварят [решен]

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)