Здравейте!Имам следния проблем - чатех във Facebook и свалих файл *.jpeg - не знам точно името.Започнах да заразявам и други хора с които чатя.... направих всичко както е описано от вас ето ги файловете надявам се да ми помогнете :virusinfo_syscure.zip virusinfo_syscheck.zip

Здравейте!Имам следния проблем - чатех във Facebook и свалих файл *.jpeg - не знам точно името.Започнах да заразявам и други хора с които чатя.... направих всичко както е описано от вас ето ги файловете надявам се да ми помогнете :virusinfo_syscure.zip virusinfo_syscheck.zip

Здравей! Прочети внимателно тази тема http://www.kaldata.com/forums/index.php?showtopic=132819 Сканирай и публикувай логовете от DDS и момчетата от HJT Team ще ти помогнат. Успех!

Здравейте..!

Изключете антивирусната си програма и защитната си стена.

AVZ, меню "Файл -- Выполнить скрипт" -- Копирате долунаписания скрипт-- Натиснете бутон "Запустить".

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
TerminateProcessByName('c:\docume~1\user\locals~1\temp\x30811.exe');
TerminateProcessByName('c:\documents and settings\user\start menu\programs\startup\winlogo.exe');
  QuarantineFile('c:\docume~1\user\locals~1\temp\x30811.exe','');
  QuarantineFile('C:\WINDOWS\system32\nview.dll','');
  QuarantineFile('C:\Documents and Settings\User\Application Data\Yvqeqc.exe','');
  QuarantineFile('C:\Documents and Settings\User\Start Menu\Programs\Startup\stepx2.exe','');
  QuarantineFile('c:\documents and settings\user\start menu\programs\startup\winlogo.exe','');
  DeleteFile('c:\documents and settings\user\start menu\programs\startup\winlogo.exe');
  DeleteFile('C:\Documents and Settings\User\Start Menu\Programs\Startup\stepx2.exe');
  DeleteFile('C:\Documents and Settings\User\Application Data\Yvqeqc.exe');
  DeleteFile('c:\docume~1\user\locals~1\temp\x30811.exe');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Yvqeqc');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.

След изпълнение на скрипта компютъра ви ще се рестартира.

След рестарта изпълнете следния скрипт:

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine .zip');
end.

В резултат на изпълнение на втория скрипт ще се сформира quarantine.zip (карантина).Отправете получения файл quarantine.zip от инсталационната папка на AVZ, на [email protected]

• Изтеглете DDS: от BleepingComputer.
• След изтегляне на файла го запишете (бутон Save => Save as) DDS на вашия десктоп, снимка:

  

• След като изтеглите DDS на десктопа, иконката на програмата би трябвало да изглежда така:
• Прекратете временно работата на всички скрипт блокиращи приложения, ако има такива или разрешете изпълнението на dds.scr. След това стартирайте DDS с двоен клик на иконката, като потвърдите с Run.
• След приключване на работата на DDS копирайте с Copy текста от двата файлови лога, които ще се появят в Notepad: DDS.txt и Attach.txt и ги запазете (бутон Save => Save as) на десктопа.Копирайте и поставете съдържанието на DDS.txt и Attach.txt във вашата тема. Моля, не ги прикачвайте!

. DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_26 Run by User at 15:22:18 on 2011-10-13 Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.2047.1465 [GMT 3:00] . . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\System Control Manager\MGSysCtrl.exe C:\Program Files\Eset\UpdateReminder.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe C:\WINDOWS\system32\CNAB4RPK.EXE C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\WINDOWS\system32\agrsmsvc.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\System Control Manager\edd.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe . ============== Pseudo HJT Report =============== . uSearch Page = uStart Page = hxxp://bwrk.startya.com/?cfg=2-490-0-0&engine_id=3&provider_id=3&product_id=490&country=BG uWindow Title = Microsoft Internet Explorer uSearch Bar = mSearchAssistant = BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: PandoraTV Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: PandoraTV Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" uRun: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMBgMonitor.exe" uRun: [MediaGet2] c:\documents and settings\user\local settings\application data\mediaget2\mediaget.exe --minimized mRun: [nod32kui] "c:\program files\eset\nod32kui.exe" /WAITSERVICE mRun: [iTSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START mRun: [MGSysCtrl] c:\program files\system control manager\MGSysCtrl.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe" mRun: [nwiz] nwiz.exe /install mRun: [updateReminder] c:\program files\eset\UpdateReminder.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE dRun: [Nokia.PCSync] c:\program files\nokia\nokia pc suite 6\PcSync2.exe /NoDialog dRunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth toshiba stack\TosBtMng.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL LSP: c:\windows\system32\imon.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{C03B6754-C0BA-48BE-B7B7-7451CF409CB7} : DhcpNameServer = 192.168.1.1 TCP: Interfaces\{F297C546-EE3B-4FD1-92BE-6A167EBDD776} : NameServer = 78.90.99.1,89.190.192.162 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\user\application data\mozilla\firefox\profiles\6fpungyz.default\ FF - prefs.js: browser.startup.homepage - www.google.bg FF - plugin: c:\documents and settings\user\application data\facebook\npfbplugin_1_0_3.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\veetle\player\npvlc.dll FF - plugin: c:\program files\veetle\plugins\npVeetle.dll FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll . ============= SERVICES / DRIVERS =============== . R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2007-4-3 39680] R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2010-3-1 15424] R2 NishService;SCM Driver Daemon;c:\program files\system control manager\edd.exe [2010-3-1 40960] R2 NOD32krn;NOD32 Kernel Service;c:\program files\eset\nod32krn.exe [2010-3-1 549256] R3 MGHwCtrl;MGHwCtrl;c:\windows\system32\drivers\MGHwCtrl.sys [2010-3-1 9088] S2 gupdate;Услуга на Google Актуализация (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-7-26 136176] S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\user\locals~1\temp\zbk42da.tmp --> c:\docume~1\user\locals~1\temp\ZBK42DA.tmp [?] S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\garena\plugins\ui\safedrv.sys --> c:\program files\garena\plugins\ui\safedrv.sys [?] S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-7-26 136176] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2010-4-14 137344] S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2010-4-14 8320] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?] . =============== Created Last 30 ================ . 2011-10-12 21:27:52 398081 ----a-w- c:\documents and settings\user\application data\1A.exe 2011-10-12 21:27:45 355129 ----a-w- c:\documents and settings\user\application data\10.exe 2011-10-12 19:39:07 163328 ----a-w- c:\documents and settings\user\application data\121B.tmp 2011-10-12 19:39:03 355129 ----a-w- c:\documents and settings\user\application data\1213.exe 2011-10-12 19:38:56 398081 ----a-w- c:\documents and settings\user\application data\1209.exe . ==================== Find3M ==================== . 2011-10-12 21:27:56 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl . ============= FINISH: 15:22:42,12 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 01.3.2010 г. 01:40:19 System Uptime: 13.10.2011 г. 15:15:11 (0 hours ago) . Motherboard: MSI | | MS-1719x Processor: Intel® Core2 Duo CPU T5550 @ 1.83GHz | CPU 1 | 987/167mhz Processor: Intel® Core2 Duo CPU T5550 @ 1.83GHz | CPU 1 | 987/167mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 37 GiB total, 29,451 GiB free. D: is FIXED (NTFS) - 196 GiB total, 60,466 GiB free. E: is CDROM () F: is CDROM (CDFS) G: is CDROM (UDF) H: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Realtek PCIe GBE Family Controller Device ID: PCI\VEN_10EC&DEV_8168&SUBSYS_43271462&REV_01\4&8314FBF&0&00E4 Manufacturer: Realtek Semiconductor Corp. Name: Realtek PCIe GBE Family Controller PNP Device ID: PCI\VEN_10EC&DEV_8168&SUBSYS_43271462&REV_01\4&8314FBF&0&00E4 Service: RTLE8023xp . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Bluetooth Personal Area Network Device ID: BLUETOOTH\0004&0007\0000 Manufacturer: Toshiba Name: Bluetooth Personal Area Network PNP Device ID: BLUETOOTH\0004&0007\0000 Service: tosrfnds . ==== System Restore Points =================== . RP20: 06.5.2010 г. 08:11:38 - Before uninstalling MP3 Cutter Joiner 5.00 RP21: 11.5.2010 г. 00:15:48 - Before uninstalling Skype™ 3.8 RP22: 11.5.2010 г. 00:16:02 - Премахнат Skype™ 3.8 RP23: 11.5.2010 г. 00:22:22 - Before uninstalling Skype™ 3.8 RP24: 11.5.2010 г. 00:23:12 - Премахнат Skype™ 3.8 RP25: 13.5.2010 г. 18:31:52 - Installed Java 6 Update 20 RP26: 06.6.2010 г. 12:30:10 - Before uninstalling Audio Tools Factory Toolbar RP27: 04.8.2010 г. 23:08:23 - Before uninstalling Disciples 2 Gold Gallean RP28: 04.8.2010 г. 23:09:45 - Before uninstalling Disciples II Rise of the Elves RP29: 11.8.2010 г. 23:42:46 - Installed Java 6 Update 21 RP30: 10.9.2010 г. 18:58:38 - Before uninstalling World of Warcraft RP31: 23.10.2010 г. 19:47:58 - Installed Java 6 Update 22 RP32: 28.10.2010 г. 07:34:19 - Before uninstalling SmileyCentral RP33: 08.11.2010 г. 16:47:03 - Before uninstalling Lineage II RP34: 04.1.2011 г. 11:04:37 - Installed Java 6 Update 23 RP35: 02.3.2011 г. 17:43:24 - Installed Java 6 Update 24 RP36: 13.3.2011 г. 23:22:07 - Installed Compatibility Pack for the 2007 Office system RP37: 04.6.2011 г. 23:47:12 - Before uninstalling MediaGet2 version 2.1.577.0 RP38: 07.6.2011 г. 18:43:59 - Before uninstalling FoxTab FLV Player RP39: 07.6.2011 г. 18:46:24 - Before uninstalling K-Lite Mega Codec Pack 7.1.0 RP40: 07.6.2011 г. 18:59:58 - Before uninstalling Codec Pack de ELISOFT v14.0 RP41: 09.6.2011 г. 17:50:28 - Before uninstalling Need for Speed Underground 2 RP42: 28.6.2011 г. 19:41:26 - Installed Majestic Chess RP43: 07.7.2011 г. 23:34:09 - Installed Java 6 Update 26 RP44: 17.7.2011 г. 17:52:16 - Before uninstalling Majestic Chess RP45: 17.7.2011 г. 17:52:35 - Removed Majestic Chess RP46: 17.8.2011 г. 05:38:35 - Before uninstalling Inpaint 3.0 RP47: 03.9.2011 г. 00:32:05 - Before uninstalling Torrent-Client MediaGet RP48: 13.10.2011 г. 00:01:54 - Before uninstalling CCleaner RP49: 13.10.2011 г. 00:21:36 - Before uninstalling Mozilla Firefox 7.0.1 (x86 bg) . ==== Installed Programs ====================== . µTorrent Adobe Flash Player 10 ActiveX Adobe Flash Player 11 Plugin Ask Toolbar Batch XLSX to XLS Converter Bit Che Canon LBP2900 Compatibility Pack for the 2007 Office system Facebook Plug-In FIFA 07 Garena 2010 Google Земя Google Update Helper Inpaint 3.0 Java Auto Updater K-Lite Mega Codec Pack 7.1.0 Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Mozilla Firefox 7.0.1 (x86 bg) Need for Speed Underground 2 Realtek High Definition Audio Driver Skype™ 3.8 Starcraft The KMPlayer (remove only) VLC media player 1.1.0 World of Warcraft Your Uninstaller! 2010 YouTube Downloader 2.6.1 . ==== Event Viewer Messages From Past Week ======== . 11.10.2011 г. 19:50:57, error: ACPIEC [1] - \Device\ACPIEC: The embedded controller (EC) hardware didn't respond within the timeout period. This may indicate an error in the EC hardware or firmware, or possibly a poorly designed BIOS which accesses the EC in an unsafe manner. The EC driver will retry the failed transaction if possible. 09.10.2011 г. 21:08:49, error: ACPIEC [1] - \Device\ACPIEC: The embedded controller (EC) hardware didn't respond within the timeout period. This may indicate an error in the EC hardware or firmware, or possibly a poorly designed BIOS which accesses the EC in an unsafe manner. The EC driver will retry the failed transaction if possible. 09.10.2011 г. 12:05:24, error: ACPIEC [1] - \Device\ACPIEC: The embedded controller (EC) hardware didn't respond within the timeout period. This may indicate an error in the EC hardware or firmware, or possibly a poorly designed BIOS which accesses the EC in an unsafe manner. The EC driver will retry the failed transaction if possible. 08.10.2011 г. 01:12:25, error: ACPIEC [1] - \Device\ACPIEC: The embedded controller (EC) hardware didn't respond within the timeout period. This may indicate an error in the EC hardware or firmware, or possibly a poorly designed BIOS which accesses the EC in an unsafe manner. The EC driver will retry the failed transaction if possible. 07.10.2011 г. 21:00:37, error: ACPIEC [1] - \Device\ACPIEC: The embedded controller (EC) hardware didn't respond within the timeout period. This may indicate an error in the EC hardware or firmware, or possibly a poorly designed BIOS which accesses the EC in an unsafe manner. The EC driver will retry the failed transaction if possible. 07.10.2011 г. 16:24:20, error: ACPIEC [1] - \Device\ACPIEC: The embedded controller (EC) hardware didn't respond within the timeout period. This may indicate an error in the EC hardware or firmware, or possibly a poorly designed BIOS which accesses the EC in an unsafe manner. The EC driver will retry the failed transaction if possible. . ==== End Of File =========================== Имам само проблем - не мога да прикача файла quarantine.zip в мейла си и нямам идея защо е така?

Имам само проблем - не мога да прикача файла quarantine.zip в мейла си и нямам идея защо е така?

Защо на вашия е- мейл..на моя го пратете или го качете на този сървър http://www.zippyshare.com/ и публикувайте линк...!

Не виждам антивирусна програма - само някъкви остатъци от Eset се мяркат - почистете ги с помоща на този инструмент:http://download.eset...Uninstaller.exe.

Нали за да го изпратя на вашия имейл първо трябва да го прикача в моя - е там не става грешка некаква ми дава.А за да "остатъците" от Eset ми иска някакъв sequence number of AV product каде да го видя това?

Uninstaller -a вижда кой точно продук е инсталиран и ако са повече ги подрежда подред ....Взависимост кой подред е продукта който искаш да деинсталираш - въвеждаш и номера ( виж снимката - тук има един продукт и въвеждате " 1" )

Цялата инструкция - http://kb.eset.com/e...ent&id=SOLN2289

Добре гледай сега аз направо ще си преинсталирам windows-a има ли вероятност този вирус (ако е такъв изобщо) да ми е засегнал и Local Disk (D:) понеже харда ми е разделен на 2 и Windows-a ми е в Local Disk (C:). И ще помоля за някаква стабилна антивирусна програма.

Ама вие защо ме разигравате .....аз ви изчистих компютъра ....още със скрипта...за ваше сведение не беше един вирус ....а цели четири..възможно е да има и още....но понеже вие решавате да преинсталирате....аз повече няма какво да ви кажа..!Лека вечер..!