Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Съмнение за инфектирана машина

sarr
в Премахване на зловреден софтуер

Featured Replies

Здравейте, имам съмнения, че системата ми е заразена. Често когато компа не се ползва 10-15 минути интернета спира, въпреки че иконката в трея показва че има интернет. Прекъсвам връзката, пускам интернета и всичко е наред. Наблюдавам и необичайна активност на твърдия диск без да има пуснато приложение. И накрая антивирусната пищи за някаква ARP атака. . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 Run by SM at 19:46:16 on 2011-12-06 Microsoft Windows 7 Professional 6.1.7601.1.1251.359.1026.18.3837.2322 [GMT 2:00] . AV: ESET Smart Security 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1} SP: ESET Smart Security 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Лична защитна стена на ESET *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskhost.exe C:\Windows\Explorer.EXE C:\Windows\SysWOW64\IoctlSvc.exe C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe C:\Windows\SysWOW64\vmnat.exe C:\Program Files (x86)\Winstep\WsxService.exe C:\Windows\SysWOW64\vmnetdhcp.exe C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files (x86)\Winstep\Nexus.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files (x86)\Translate Client\translateclient.exe C:\Program Files (x86)\XFast USB\XFastUsb.exe E:\VMare\vmware-tray.exe E:\VMare\vmware-authd.exe E:\VMare\vmware-hostd.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Program Files (x86)\XArp\xarp.exe D:\Brauzer\Palemoon\Palemoon-Portable.exe D:\Brauzer\Palemoon\Bin\Palemoon\Palemoon.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe D:\Brauzer\Palemoon\Bin\Palemoon\plugin-container.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\DllHost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.yandex.ru/?clid=124990 mWinlogon: Userinit=userinit.exe, BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED uRun: [Nexus] C:\Program Files (x86)\Winstep\Nexus.exe autostart uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun mRun: [XFast USB] C:\Program Files (x86)\XFast USB\XFastUsb.exe mRun: [vmware-tray] "E:\VMare\vmware-tray.exe" mRun: [XArp] C:\Program Files (x86)\XArp\xarp.exe hide StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\TRANSL~1.LNK - C:\Program Files (x86)\Translate Client\translateclient.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: &Експортиране към Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: &Изпрати към OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll LSP: %SystemRoot%\system32\vsocklib.dll TCP: Interfaces\{0074664A-1E7F-4A58-8507-74401C74B683} : DhcpNameServer = 192.168.2.1 TCP: Interfaces\{20CC86F5-5885-444C-A06B-C96D6D2E9A01} : DhcpNameServer = 192.168.2.1 TCP: Interfaces\{59DE1615-A880-48B4-87AD-F7F9C6EE9237} : NameServer = 212.36.23.129 Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL BHO-X64: URLRedirectionBHO - No File mRun-x64: [XFast USB] C:\Program Files (x86)\XFast USB\XFastUsb.exe mRun-x64: [vmware-tray] "E:\VMare\vmware-tray.exe" mRun-x64: [XArp] C:\Program Files (x86)\XArp\xarp.exe hide . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\SM\AppData\Roaming\Mozilla\Firefox\Profiles\poooyc0u.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2995820&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?hl=bg FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=685749&p= FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ============= SERVICES / DRIVERS =============== . R0 epfwwfp;epfwwfp;C:\Windows\system32\DRIVERS\epfwwfp.sys --> C:\Windows\system32\DRIVERS\epfwwfp.sys [?] R1 EpfwLWF;Epfw NDIS LightWeight Filter;C:\Windows\system32\DRIVERS\EpfwLWF.sys --> C:\Windows\system32\DRIVERS\EpfwLWF.sys [?] R1 FNETURPX;FNETURPX;C:\Windows\system32\drivers\FNETURPX.SYS --> C:\Windows\system32\drivers\FNETURPX.SYS [?] R2 eamonm;eamonm;C:\Windows\system32\DRIVERS\eamonm.sys --> C:\Windows\system32\DRIVERS\eamonm.sys [?] R2 ekrn;ESET Service;C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2011-9-22 974944] R2 OS Selector;Acronis OS Selector activator;C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe [2010-9-29 2139400] R2 VMUSBArbService;VMware USB Arbitration Service;C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2011-8-21 846448] R2 VMwareHostd;VMware Workstation Server;E:\VMare\vmware-hostd.exe -u "C:\ProgramData\VMware\hostd\config.xml" --> E:\VMare\vmware-hostd.exe -u C:\ProgramData\VMware\hostd\config.xml [?] R2 Winstep Xtreme Service;Winstep Xtreme Service;C:\Program Files (x86)\Winstep\WsxService --> C:\Program Files (x86)\Winstep\WsxService [?] R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?] S3 FNETTBOH_305;FNETTBOH_305;C:\Windows\system32\drivers\FNETTBOH_305.SYS --> C:\Windows\system32\drivers\FNETTBOH_305.SYS [?] S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] S3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver;C:\Windows\system32\DRIVERS\Rtnic64.sys --> C:\Windows\system32\DRIVERS\Rtnic64.sys [?] S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?] . =============== Created Last 30 ================ . 2011-12-05 21:09:17 -------- d-----w- C:\Users\SM\AppData\Roaming\Process Hacker 2 2011-12-05 18:01:35 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6B02A8C9-97F6-4D78-A6E0-6244B238F3F5}\offreg.dll 2011-12-05 15:33:52 -------- d-----w- C:\Users\SM\love 2011-12-05 15:33:19 -------- d-----w- C:\Games 2011-12-03 06:31:10 8822856 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6B02A8C9-97F6-4D78-A6E0-6244B238F3F5}\mpengine.dll 2011-12-02 10:17:08 -------- d-----w- C:\ProgramData\Alawar Stargaze 2011-12-02 07:56:04 -------- d-----w- C:\Program Files\ESET 2011-12-01 13:46:31 -------- d-----w- C:\Users\SM\AppData\Local\Xenocode 2011-11-28 18:13:41 -------- d-----w- C:\Users\SM\AppData\Roaming\xarp-SM 2011-11-28 18:13:36 -------- d-----w- C:\Program Files (x86)\WinPcap 2011-11-28 18:13:16 -------- d-----w- C:\Program Files (x86)\XArp 2011-11-27 17:53:22 99840 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\HPZPPLHN.DLL 2011-11-27 07:39:12 6144 ------w- C:\Windows\System32\FCCE.tmp 2011-11-27 07:33:26 -------- d-----w- C:\TDSSKiller_Quarantine 2011-11-27 07:01:20 6144 ------w- C:\Windows\System32\2DA6.tmp 2011-11-27 07:00:42 6144 ------w- C:\Windows\System32\9B77.tmp 2011-11-26 11:25:59 -------- d-----w- C:\Нова папка 2011-11-22 18:46:44 -------- d-----w- C:\Users\SM\AppData\Local\VMware 2011-11-22 18:44:18 31344 ----a-w- C:\Windows\System32\drivers\VMparport.sys 2011-11-22 18:44:17 62064 ----a-w- C:\Windows\System32\drivers\vmx86.sys 2011-11-22 18:43:44 354416 ----a-w- C:\Windows\SysWow64\vmnetdhcp.exe 2011-11-22 18:43:36 432752 ----a-w- C:\Windows\SysWow64\vmnat.exe 2011-11-22 18:43:35 30320 ----a-w- C:\Windows\System32\drivers\vmnetuserif.sys 2011-11-22 18:43:31 942192 ----a-w- C:\Windows\System32\vnetlib64.dll 2011-11-22 18:43:27 39024 ----a-w- C:\Windows\System32\drivers\hcmon.sys 2011-11-22 18:42:29 -------- d-----w- C:\Program Files (x86)\VMware 2011-11-22 18:42:26 -------- d-----w- C:\Program Files (x86)\Common Files\VMware 2011-11-22 18:42:04 -------- d-----w- C:\Program Files\Common Files\VMware 2011-11-22 14:34:46 -------- d-----w- C:\Users\SM\AppData\Local\Criterion Games 2011-11-22 14:33:28 -------- d-----w- C:\ProgramData\AlawarWrapper 2011-11-22 14:31:55 -------- d-----w- C:\ProgramData\Rumbic Studio 2011-11-22 14:24:34 -------- d-----w- C:\Program Files (x86)\MSXML 4.0 2011-11-22 14:19:44 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys 2011-11-22 14:19:41 886784 ----a-w- C:\Program Files\Common Files\System\wab32.dll 2011-11-22 14:19:41 708608 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll 2011-11-22 14:19:29 3144704 ----a-w- C:\Windows\System32\win32k.sys 2011-11-22 13:42:31 -------- d-----w- C:\ProgramData\Fenomen Games . ==================== Find3M ==================== . 2011-11-22 14:05:29 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2011-10-19 16:36:46 272480 ----a-w- C:\Windows\System32\drivers\snapman.sys 2011-10-19 13:37:15 32320 ----a-w- C:\Windows\System32\drivers\FNETTBOH_305.SYS 2011-10-19 13:37:10 15936 ----a-w- C:\Windows\System32\drivers\FNETURPX.SYS 2011-09-22 18:43:08 3578880 ----a-w- C:\Windows\SysWow64\ffdshow.ax 2011-09-22 17:08:56 3902976 ----a-w- C:\Windows\SysWow64\ffmpeg.dll 2011-09-15 14:33:26 4423168 ----a-w- C:\Windows\System32\ffdshow.ax 2011-09-15 14:31:36 3926016 ----a-w- C:\Windows\System32\ffmpeg.dll . ============= FINISH: 19:46:51,28 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Professional Boot Device: \Device\HarddiskVolume1 Install Date: 19.10.2011 г. 16:15:56 System Uptime: 5.12.2011 г. 19:58:48 (24 hours ago) . Motherboard: ASRock | | G41M-VS2 Processor: Intel® Celeron® CPU E3300 @ 2.50GHz | CPUSocket | 2493/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 73 GiB total, 33,16 GiB free. D: is FIXED (NTFS) - 146 GiB total, 77,044 GiB free. E: is FIXED (NTFS) - 246 GiB total, 149,163 GiB free. F: is CDROM () H: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Realtek RTL8139/810x Family Fast Ethernet NIC Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_813910EC&REV_10\4&2C30955E&0&10F0 Manufacturer: Realtek Semiconductor Corp. Name: Realtek RTL8139/810x Family Fast Ethernet NIC PNP Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_813910EC&REV_10\4&2C30955E&0&10F0 Service: RTL8023x64 . Class GUID: Description: Device ID: ACPI\PNP0C0F\1 Manufacturer: Name: PNP Device ID: ACPI\PNP0C0F\1 Service: . ==== System Restore Points =================== . RP38: 5.12.2011 г. 08:49:23 - Планирана контролна точка RP39: 5.12.2011 г. 19:47:00 - Revo Uninstaller's restore point - ESET Online Scanner v3 RP40: 5.12.2011 г. 19:49:42 - Revo Uninstaller's restore point - Sophos Anti-Rootkit 1.5.20 RP41: 5.12.2011 г. 20:16:58 - Revo Uninstaller's restore point - X-NetStat Pro 5.57 . ==== Installed Programs ====================== . Грибоед 1.0 µTorrent Acronis Disk Director 11 Home Adobe Reader 9.4.6 - Bulgarian AIMP2 Arctic Quest 2 ASRock IES v2.0.8 ASRock InstantBoot v1.23 ASRock OC DNA v1.5 Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver Client for Google Translate Definition update for Microsoft Office 2010 (KB982726) 32-Bit Edition Driver Magician 3.5 GOM Player Malwarebytes' Anti-Malware, версия 1.51.2.1300 Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Excel MUI (Bulgarian) 2010 Microsoft Office OneNote MUI (Bulgarian) 2010 Microsoft Office Outlook MUI (Bulgarian) 2010 Microsoft Office PowerPoint MUI (Bulgarian) 2010 Microsoft Office Proof (Bulgarian) 2010 Microsoft Office Proof (English) 2010 Microsoft Office Proof (German) 2010 Microsoft Office Proof (Russian) 2010 Microsoft Office Proofing (Bulgarian) 2010 Microsoft Office Publisher MUI (Bulgarian) 2010 Microsoft Office Shared MUI (Bulgarian) 2010 Microsoft Office Standard 2010 Microsoft Office Word MUI (Bulgarian) 2010 Microsoft Silverlight Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Mozilla Firefox 8.0.1 (x86 bg) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nero 7 Premium neroxml Nexus 11.6 Realtek High Definition Audio Driver Revo Uninstaller 1.93 Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft Excel 2010 (KB2553070) Security Update for Microsoft Office 2010 (KB2553091) Security Update for Microsoft Office 2010 (KB2553096) Security Update for Microsoft SharePoint Workspace 2010 (KB2566445) Skype™ 5.6 tools-freebsd tools-linux tools-netware tools-solaris tools-windows tools-winPre2k Universal Viewer Free, версия 5.5.6.2 Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft Office 2010 (KB2494150) Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition Update for Microsoft Office 2010 (KB2553455) 32-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2553323) 32-Bit Edition Update for Microsoft Outlook Social Connector (KB2583935) VMware Workstation Windows 7 Codec Pack 3.4.0 WinPcap 4.1.2 XArp 2.2.2 XFast USB «Colin McRae Rally 2005», версия 1.0 . ==== Event Viewer Messages From Past Week ======== . 6.12.2011 г. 18:19:07, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 18:19:06, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 18:19:03, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 18:19:03, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 18:18:54, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 18:18:52, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 18:18:51, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 17:43:42, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 17:43:41, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 17:43:41, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 17:18:54, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 17:18:54, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 17:18:46, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 17:18:46, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 17:18:41, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 17:18:41, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 13:52:47, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 13:52:47, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 13:52:45, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 13:52:44, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 13:52:34, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 13:52:34, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 12:58:50, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 12:58:50, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 12:58:41, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 12:58:32, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 12:58:26, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 12:58:26, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 12:58:26, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 12:58:22, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 12:07:59, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 12:07:59, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 12:07:59, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 12:07:58, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 12:07:57, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:49:29, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:49:25, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:49:25, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:49:25, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:49:15, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:48:33, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:48:32, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:48:29, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:48:29, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:48:17, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:48:13, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:48:13, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:48:13, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:48:13, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 11:48:13, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 07:59:15, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 07:59:13, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 07:59:12, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 07:59:12, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 07:17:58, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 07:17:58, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 07:11:23, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 07:11:18, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 07:11:12, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 07:10:11, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 07:10:11, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 07:10:08, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 6.12.2011 г. 07:10:07, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 23:14:28, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 23:14:26, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 23:14:26, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 23:14:18, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 23:14:18, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 20:01:31, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 20:01:30, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 20:01:30, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 19:59:08, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 19:59:07, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 19:58:24, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 19:58:24, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 18:05:18, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 18:05:17, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 18:05:11, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 18:05:11, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 18:02:13, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 18:02:13, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 17:56:48, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 17:56:45, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 17:56:45, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 17:56:43, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 17:56:32, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 16:04:59, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 16:04:56, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 16:04:55, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 16:04:10, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 16:04:03, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 14:35:07, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 14:35:07, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 14:31:12, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 14:31:10, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 14:30:31, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 14:30:31, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 13:57:53, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 13:57:42, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 13:57:02, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 13:56:35, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 13:56:35, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 13:55:45, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 13:55:45, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 11:18:32, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 11:18:31, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 11:18:24, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 11:18:24, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 10:58:39, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 10:56:10, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 10:56:10, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 07:30:48, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 07:30:48, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 07:30:02, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 07:30:01, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 07:29:21, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 5.12.2011 г. 07:29:21, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 4.12.2011 г. 20:58:59, Error: RasMan [20062] - Internal Error: Disconnect operation on The connection was terminated by the remote computer before it could be completed. completed with an error. PPPoE4-0 4.12.2011 г. 20:53:15, Error: Service Control Manager [7032] - Диспечерът за управление на услуги се опита да предприеме коригиращо действие (Рестартиране на услугата) след неочакваното прекъсване на услуга DNS Client, но това действие се оказа неуспешно поради следната грешка: Вече се изпълнява екземпляр на услугата. 4.12.2011 г. 20:51:15, Error: Service Control Manager [7031] - Услуга Workstation беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). След 60000 милисекунди ще бъде предприето следното коригиращо действие: Рестартиране на услугата. 4.12.2011 г. 20:51:15, Error: Service Control Manager [7031] - Услуга Network Location Awareness беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). След 100 милисекунди ще бъде предприето следното коригиращо действие: Рестартиране на услугата. 4.12.2011 г. 20:51:15, Error: Service Control Manager [7031] - Услуга DNS Client беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). След 120000 милисекунди ще бъде предприето следното коригиращо действие: Рестартиране на услугата. 4.12.2011 г. 20:51:15, Error: Service Control Manager [7031] - Услуга Cryptographic Services беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). След 60000 милисекунди ще бъде предприето следното коригиращо действие: Рестартиране на услугата. 4.12.2011 г. 20:51:15, Error: Service Control Manager [7031] - Услуга Телефонна връзка беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). След 120000 милисекунди ще бъде предприето следното коригиращо действие: Рестартиране на услугата. 3.12.2011 г. 13:22:59, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. . ==== End Of File ===========================

Здравейте..!Извинявам се за закъснението....така,да направим още проверки:

Публикувано изображение Изтеглете ComboFix Публикувано изображение от тук или тук и го запазете на десктопа си.

  • Изключете вашата антивирусна и антишпионска програма, обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.
Бележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs
  • Стартирайте Combo-Fix.com Публикувано изображение и следвайте инструкциите.
Бележка: ComboFix ще се стартира без инсталирана Recovery Console.
  • Като част от неговата работа, ComboFix ще провери дали Microsoft Windows Recovery Console е инсталирана. Предвид бързо развиващия се зловреден софтуер е силно препоръчително да бъде инсталирана преди премахването на зловредния софтуер. Това ще Ви позволи да влезете в специален recovery/repair режим, който ще ни позволи по-лесно да решите проблем, който би могъл да възникне при премахване на зловредния софтуер.
  • Следвайте инструкциите, за да позволите на ComboFix да изтегли и инсталира Microsoft Windows Recovery Console. В един момент ще бъдете попитани дали сте съгласни с лицензното споразумение. Необходимо е да потвърдите, че сте съгласни, за да инсталирате Microsoft Windows Recovery Console.
** Забележете: Ако Microsoft Windows Recovery Console е вече инсталирана, ComboFix ще продължи към процеса по премахване на зловредния софтуер.

Публикувано изображение

След като Microsoft Windows Recovery Console е инсталирана, използвайки ComboFix, Вие ще видите следното съобщение:

Публикувано изображение

Изберете Yes, за да продължи сканирането за зловреден софтуер.

Когато процесът приключи успешно, инструментът ще създаде лог файл. Моля, включете съдържанието на C:\ComboFix.txt в следващия Ви коментар в тази тема.

Бележка:

  • Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
  • ComboFix ще нулира всички настройки на Microsoft Internet Explorer, включително да направи IE браузър по подразбиране.
  • ComboFix ще изключи autorun функцията на ВСИЧКИ CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и Ви защити от бъдещи вируси/заплахи, които поразяват чрез autorun. Ако това е проблем за вас - моля, уведомете ме.
  • ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той ще прекрати интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
  • В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.
Публикувано изображение Моля, не прикачвайте лог файла/овете от програмата, а го/ги копирайте и поставете в следващия Ви коментар в тази тема.
  • Автор

ComboFix 11-12-06.01 - SM 12.2011 г. 20:54:01.1.2 - x64 Microsoft Windows 7 Professional 6.1.7601.1.1251.359.1026.18.3837.2240 [GMT 2:00] Running from: c:\users\SM\Desktop\ComboFix.exe AV: ESET Smart Security 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1} FW: Лична защитна стена на ESET *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA} SP: ESET Smart Security 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2011-11-06 to 2011-12-06 ))))))))))))))))))))))))))))))) . . 2011-12-06 19:03 . 2011-12-06 19:03 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-12-05 21:09 . 2011-12-05 21:09 -------- d-----w- c:\users\SM\AppData\Roaming\Process Hacker 2 2011-12-05 18:01 . 2011-12-05 18:01 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B02A8C9-97F6-4D78-A6E0-6244B238F3F5}\offreg.dll 2011-12-05 15:33 . 2011-12-05 15:33 -------- d-----w- c:\users\SM\love 2011-12-05 15:33 . 2011-12-05 15:33 -------- d-----w- C:\Games 2011-12-03 06:31 . 2011-11-21 11:40 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B02A8C9-97F6-4D78-A6E0-6244B238F3F5}\mpengine.dll 2011-12-02 10:17 . 2011-12-02 10:17 -------- d-----w- c:\programdata\Alawar Stargaze 2011-12-02 07:56 . 2011-12-02 07:56 -------- d-----w- c:\program files\ESET 2011-12-01 13:46 . 2011-12-01 13:46 -------- d-----w- c:\users\SM\AppData\Local\Xenocode 2011-11-28 18:13 . 2011-12-06 16:19 -------- d-----w- c:\users\SM\AppData\Roaming\xarp-SM 2011-11-28 18:13 . 2011-11-28 18:13 -------- d-----w- c:\program files (x86)\WinPcap 2011-11-28 18:13 . 2011-11-28 18:13 -------- d-----w- c:\program files (x86)\XArp 2011-11-27 17:53 . 2008-05-07 17:59 99840 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPLHN.DLL 2011-11-27 07:39 . 2011-05-12 12:03 6144 ------w- c:\windows\system32\FCCE.tmp 2011-11-27 07:33 . 2011-12-05 12:29 -------- d-----w- C:\TDSSKiller_Quarantine 2011-11-27 07:01 . 2011-05-12 12:03 6144 ------w- c:\windows\system32\2DA6.tmp 2011-11-27 07:00 . 2011-05-12 12:03 6144 ------w- c:\windows\system32\9B77.tmp 2011-11-26 11:25 . 2011-11-26 11:26 -------- d-----w- C:\Нова папка 2011-11-22 18:46 . 2011-12-06 12:39 -------- d-----w- c:\users\SM\AppData\Local\VMware 2011-11-22 18:46 . 2011-12-06 12:39 -------- d-----w- c:\users\SM\AppData\Roaming\VMware 2011-11-22 18:44 . 2011-08-22 15:07 31344 ----a-w- c:\windows\system32\drivers\VMparport.sys 2011-11-22 18:44 . 2011-08-22 15:07 62064 ----a-w- c:\windows\system32\drivers\vmx86.sys 2011-11-22 18:43 . 2011-08-22 15:07 354416 ----a-w- c:\windows\SysWow64\vmnetdhcp.exe 2011-11-22 18:43 . 2011-08-22 15:06 432752 ----a-w- c:\windows\SysWow64\vmnat.exe 2011-11-22 18:43 . 2011-08-22 15:06 30320 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys 2011-11-22 18:43 . 2011-08-22 15:07 942192 ----a-w- c:\windows\system32\vnetlib64.dll 2011-11-22 18:43 . 2011-08-21 21:11 39024 ----a-w- c:\windows\system32\drivers\hcmon.sys 2011-11-22 18:42 . 2011-11-22 18:42 -------- d-----w- c:\program files (x86)\VMware 2011-11-22 18:42 . 2011-12-06 12:26 -------- d-----w- c:\programdata\VMware 2011-11-22 18:42 . 2011-11-22 18:42 -------- d-----w- c:\program files (x86)\Common Files\VMware 2011-11-22 18:42 . 2011-11-22 18:42 -------- d-----w- c:\program files\Common Files\VMware 2011-11-22 14:34 . 2011-11-22 14:34 -------- d-----w- c:\users\SM\AppData\Local\Criterion Games 2011-11-22 14:33 . 2011-11-23 18:32 -------- d-----w- c:\programdata\AlawarWrapper 2011-11-22 14:31 . 2011-11-22 14:31 -------- d-----w- c:\programdata\Rumbic Studio 2011-11-22 14:24 . 2011-11-22 14:24 -------- d-----w- c:\program files (x86)\MSXML 4.0 2011-11-22 14:19 . 2011-09-29 16:29 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys 2011-11-22 14:19 . 2011-10-01 05:45 886784 ----a-w- c:\program files\Common Files\System\wab32.dll 2011-11-22 14:19 . 2011-10-01 04:37 708608 ----a-w- c:\program files (x86)\Common Files\System\wab32.dll 2011-11-22 14:19 . 2011-09-29 04:03 3144704 ----a-w- c:\windows\system32\win32k.sys 2011-11-22 13:42 . 2011-11-22 13:42 -------- d-----w- c:\programdata\Fenomen Games . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-11-22 14:05 . 2011-10-19 14:02 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-10-19 16:36 . 2011-10-19 16:36 272480 ----a-w- c:\windows\system32\drivers\snapman.sys 2011-10-19 15:26 . 2011-10-19 15:26 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll 2011-10-19 15:26 . 2011-10-19 15:26 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2011-10-19 15:26 . 2011-10-19 15:26 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe 2011-10-19 15:26 . 2011-10-19 15:26 74752 ----a-w- c:\windows\SysWow64\iesetup.dll 2011-10-19 15:26 . 2011-10-19 15:26 63488 ----a-w- c:\windows\SysWow64\tdc.ocx 2011-10-19 15:26 . 2011-10-19 15:26 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll 2011-10-19 15:26 . 2011-10-19 15:26 367104 ----a-w- c:\windows\SysWow64\html.iec 2011-10-19 15:26 . 2011-10-19 15:26 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll 2011-10-19 15:26 . 2011-10-19 15:26 1798144 ----a-w- c:\windows\SysWow64\jscript9.dll 2011-10-19 15:26 . 2011-10-19 15:26 161792 ----a-w- c:\windows\SysWow64\msls31.dll 2011-10-19 15:26 . 2011-10-19 15:26 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2011-10-19 15:26 . 2011-10-19 15:26 1126912 ----a-w- c:\windows\SysWow64\wininet.dll 2011-10-19 15:26 . 2011-10-19 15:26 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll 2011-10-19 15:26 . 2011-10-19 15:26 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2011-10-19 15:26 . 2011-10-19 15:26 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe 2011-10-19 15:26 . 2011-10-19 15:26 76800 ----a-w- c:\windows\system32\tdc.ocx 2011-10-19 15:26 . 2011-10-19 15:26 49664 ----a-w- c:\windows\system32\imgutil.dll 2011-10-19 15:26 . 2011-10-19 15:26 48640 ----a-w- c:\windows\system32\mshtmler.dll 2011-10-19 15:26 . 2011-10-19 15:26 420864 ----a-w- c:\windows\SysWow64\vbscript.dll 2011-10-19 15:26 . 2011-10-19 15:26 35840 ----a-w- c:\windows\SysWow64\imgutil.dll 2011-10-19 15:26 . 2011-10-19 15:26 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb 2011-10-19 15:26 . 2011-10-19 15:26 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2011-10-19 15:26 . 2011-10-19 15:26 2309120 ----a-w- c:\windows\system32\jscript9.dll 2011-10-19 15:26 . 2011-10-19 15:26 222208 ----a-w- c:\windows\system32\msls31.dll 2011-10-19 15:26 . 2011-10-19 15:26 173056 ----a-w- c:\windows\system32\ieUnatt.exe 2011-10-19 15:26 . 2011-10-19 15:26 152064 ----a-w- c:\windows\SysWow64\wextract.exe 2011-10-19 15:26 . 2011-10-19 15:26 150528 ----a-w- c:\windows\SysWow64\iexpress.exe 2011-10-19 15:26 . 2011-10-19 15:26 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe 2011-10-19 15:26 . 2011-10-19 15:26 1389056 ----a-w- c:\windows\system32\wininet.dll 2011-10-19 15:26 . 2011-10-19 15:26 135168 ----a-w- c:\windows\system32\IEAdvpack.dll 2011-10-19 15:26 . 2011-10-19 15:26 12288 ----a-w- c:\windows\system32\mshta.exe 2011-10-19 15:26 . 2011-10-19 15:26 11776 ----a-w- c:\windows\SysWow64\mshta.exe 2011-10-19 15:26 . 2011-10-19 15:26 114176 ----a-w- c:\windows\system32\admparse.dll 2011-10-19 15:26 . 2011-10-19 15:26 111616 ----a-w- c:\windows\system32\iesysprep.dll 2011-10-19 15:26 . 2011-10-19 15:26 101888 ----a-w- c:\windows\SysWow64\admparse.dll 2011-10-19 15:26 . 2011-10-19 15:26 85504 ----a-w- c:\windows\system32\iesetup.dll 2011-10-19 15:26 . 2011-10-19 15:26 603648 ----a-w- c:\windows\system32\vbscript.dll 2011-10-19 15:26 . 2011-10-19 15:26 448512 ----a-w- c:\windows\system32\html.iec 2011-10-19 15:26 . 2011-10-19 15:26 30720 ----a-w- c:\windows\system32\licmgr10.dll 2011-10-19 15:26 . 2011-10-19 15:26 165888 ----a-w- c:\windows\system32\iexpress.exe 2011-10-19 15:26 . 2011-10-19 15:26 160256 ----a-w- c:\windows\system32\wextract.exe 2011-10-19 15:26 . 2011-10-19 15:26 1492992 ----a-w- c:\windows\system32\inetcpl.cpl 2011-10-19 13:37 . 2011-10-19 13:37 32320 ----a-w- c:\windows\system32\drivers\FNETTBOH_305.SYS 2011-10-19 13:37 . 2011-10-19 13:37 15936 ----a-w- c:\windows\system32\drivers\FNETURPX.SYS 2011-09-22 18:43 . 2011-09-22 18:43 3578880 ----a-w- c:\windows\SysWow64\ffdshow.ax 2011-09-22 17:08 . 2011-09-22 17:08 3902976 ----a-w- c:\windows\SysWow64\ffmpeg.dll 2011-09-15 14:33 . 2011-09-15 14:33 4423168 ----a-w- c:\windows\system32\ffdshow.ax 2011-09-15 14:31 . 2011-09-15 14:31 3926016 ----a-w- c:\windows\system32\ffmpeg.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-10-19 641400] "Nexus"="c:\program files (x86)\Winstep\Nexus.exe" [2011-11-18 13599872] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "XFast USB"="c:\program files (x86)\XFast USB\XFastUsb.exe" [2011-10-19 4878912] "vmware-tray"="e:\vmare\vmware-tray.exe" [2011-08-22 103536] "XArp"="c:\program files (x86)\XArp\xarp.exe" [2011-04-01 10413568] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Translate Client.lnk - c:\program files (x86)\Translate Client\translateclient.exe [2011-8-9 1687552] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 VMwareHostd;VMware Workstation Server;e:\vmare\vmware-hostd.exe [2011-08-22 11837440] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x] R3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [x] R3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver;c:\windows\system32\DRIVERS\Rtnic64.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x] S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [x] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x] S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [x] S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [x] S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x] S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-09-22 974944] S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x] S2 OS Selector;Acronis OS Selector activator;c:\program files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe [2010-09-29 2139400] S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2011-08-21 846448] S2 vstor2-mntapi10-shared;Vstor2 MntApi 1.0 Driver (shared);SysWOW64\drivers\vstor2-mntapi10-shared.sys [x] S2 Winstep Xtreme Service;Winstep Xtreme Service;c:\program files (x86)\Winstep\WsxService [x] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [x] S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] . . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-18 8067616] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-08 165912] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-08 387608] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-08 365592] "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-22 4035152] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.yandex.ru/?clid=124990 mLocal Page = c:\windows\SysWOW64\blank.htm IE: &Експортиране към Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: &Изпрати към OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 LSP: %SystemRoot%\system32\vsocklib.dll TCP: DhcpNameServer = 192.168.2.1 TCP: Interfaces\{59DE1615-A880-48B4-87AD-F7F9C6EE9237}: NameServer = 212.36.23.129 FF - ProfilePath - c:\users\SM\AppData\Roaming\Mozilla\Firefox\Profiles\poooyc0u.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2995820&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?hl=bg FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=685749&p= . - - - - ORPHANS REMOVED - - - - . SafeBoot-87576351.sys . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winstep Xtreme Service] "ImagePath"="c:\program files (x86)\Winstep\WsxService" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="c:\\Program Files\\CCleaner\\ccleaner.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-12-06 21:21:09 ComboFix-quarantined-files.txt 2011-12-06 19:21 . Pre-Run: 35 446 763 520 bytes free Post-Run: 35 081 580 544 bytes free . - - End Of File - - E5B59E9E138EACE4EF4574CC5A7FA542

Копирайте текста в карето на notepad и го запазвате с име CFScript.txt на десктопа си:

KILLALL::

File::
c:\windows\system32\2DA6.tmp
c:\windows\system32\9B77.tmp
c:\windows\system32\FCCE.tmp
C:\TDSSKiller_Quarantine

След съхранението преместете CFScript.txt на иконата на ComboFix.exe

Публикувано изображение

Генерирания рапорт прикачете в следващия си пост..!

  • Автор

ComboFix 11-12-06.01 - SM 12.2011 г. 21:48:18.2.2 - x64 Microsoft Windows 7 Professional 6.1.7601.1.1251.359.1026.18.3837.2337 [GMT 2:00] Running from: c:\users\SM\Desktop\ComboFix.exe Command switches used :: c:\users\SM\Desktop\CFScript.txt AV: ESET Smart Security 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1} FW: Лична защитна стена на ESET *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA} SP: ESET Smart Security 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "C:\TDSSKiller_Quarantine" "c:\windows\system32\2DA6.tmp" "c:\windows\system32\9B77.tmp" "c:\windows\system32\FCCE.tmp" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\system32\2DA6.tmp c:\windows\system32\9B77.tmp c:\windows\system32\FCCE.tmp . . ((((((((((((((((((((((((( Files Created from 2011-11-06 to 2011-12-06 ))))))))))))))))))))))))))))))) . . 2011-12-06 20:01 . 2011-12-06 20:01 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B02A8C9-97F6-4D78-A6E0-6244B238F3F5}\offreg.dll 2011-12-06 19:57 . 2011-12-06 19:57 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-12-06 19:21 . 2011-12-06 19:21 -------- d-----w- c:\users\Преки пътища\AppData 2011-12-05 21:09 . 2011-12-05 21:09 -------- d-----w- c:\users\SM\AppData\Roaming\Process Hacker 2 2011-12-05 15:33 . 2011-12-05 15:33 -------- d-----w- c:\users\SM\love 2011-12-05 15:33 . 2011-12-05 15:33 -------- d-----w- C:\Games 2011-12-03 06:31 . 2011-11-21 11:40 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B02A8C9-97F6-4D78-A6E0-6244B238F3F5}\mpengine.dll 2011-12-02 10:17 . 2011-12-02 10:17 -------- d-----w- c:\programdata\Alawar Stargaze 2011-12-02 07:56 . 2011-12-02 07:56 -------- d-----w- c:\program files\ESET 2011-12-01 13:46 . 2011-12-01 13:46 -------- d-----w- c:\users\SM\AppData\Local\Xenocode 2011-11-28 18:13 . 2011-12-06 19:58 -------- d-----w- c:\users\SM\AppData\Roaming\xarp-SM 2011-11-28 18:13 . 2011-11-28 18:13 -------- d-----w- c:\program files (x86)\WinPcap 2011-11-28 18:13 . 2011-11-28 18:13 -------- d-----w- c:\program files (x86)\XArp 2011-11-27 17:53 . 2008-05-07 17:59 99840 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPLHN.DLL 2011-11-27 07:33 . 2011-12-05 12:29 -------- d-----w- C:\TDSSKiller_Quarantine 2011-11-26 11:25 . 2011-11-26 11:26 -------- d-----w- C:\Нова папка 2011-11-22 18:46 . 2011-12-06 12:39 -------- d-----w- c:\users\SM\AppData\Local\VMware 2011-11-22 18:46 . 2011-12-06 12:39 -------- d-----w- c:\users\SM\AppData\Roaming\VMware 2011-11-22 18:44 . 2011-08-22 15:07 31344 ----a-w- c:\windows\system32\drivers\VMparport.sys 2011-11-22 18:44 . 2011-08-22 15:07 62064 ----a-w- c:\windows\system32\drivers\vmx86.sys 2011-11-22 18:43 . 2011-08-22 15:07 354416 ----a-w- c:\windows\SysWow64\vmnetdhcp.exe 2011-11-22 18:43 . 2011-08-22 15:06 432752 ----a-w- c:\windows\SysWow64\vmnat.exe 2011-11-22 18:43 . 2011-08-22 15:06 30320 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys 2011-11-22 18:43 . 2011-08-22 15:07 942192 ----a-w- c:\windows\system32\vnetlib64.dll 2011-11-22 18:43 . 2011-08-21 21:11 39024 ----a-w- c:\windows\system32\drivers\hcmon.sys 2011-11-22 18:42 . 2011-11-22 18:42 -------- d-----w- c:\program files (x86)\VMware 2011-11-22 18:42 . 2011-12-06 19:59 -------- d-----w- c:\programdata\VMware 2011-11-22 18:42 . 2011-11-22 18:42 -------- d-----w- c:\program files (x86)\Common Files\VMware 2011-11-22 18:42 . 2011-11-22 18:42 -------- d-----w- c:\program files\Common Files\VMware 2011-11-22 14:34 . 2011-11-22 14:34 -------- d-----w- c:\users\SM\AppData\Local\Criterion Games 2011-11-22 14:33 . 2011-11-23 18:32 -------- d-----w- c:\programdata\AlawarWrapper 2011-11-22 14:31 . 2011-11-22 14:31 -------- d-----w- c:\programdata\Rumbic Studio 2011-11-22 14:24 . 2011-11-22 14:24 -------- d-----w- c:\program files (x86)\MSXML 4.0 2011-11-22 14:19 . 2011-09-29 16:29 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys 2011-11-22 14:19 . 2011-10-01 05:45 886784 ----a-w- c:\program files\Common Files\System\wab32.dll 2011-11-22 14:19 . 2011-10-01 04:37 708608 ----a-w- c:\program files (x86)\Common Files\System\wab32.dll 2011-11-22 14:19 . 2011-09-29 04:03 3144704 ----a-w- c:\windows\system32\win32k.sys 2011-11-22 13:42 . 2011-11-22 13:42 -------- d-----w- c:\programdata\Fenomen Games . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-11-22 14:05 . 2011-10-19 14:02 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-10-19 16:36 . 2011-10-19 16:36 272480 ----a-w- c:\windows\system32\drivers\snapman.sys 2011-10-19 15:26 . 2011-10-19 15:26 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll 2011-10-19 15:26 . 2011-10-19 15:26 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2011-10-19 15:26 . 2011-10-19 15:26 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe 2011-10-19 15:26 . 2011-10-19 15:26 74752 ----a-w- c:\windows\SysWow64\iesetup.dll 2011-10-19 15:26 . 2011-10-19 15:26 63488 ----a-w- c:\windows\SysWow64\tdc.ocx 2011-10-19 15:26 . 2011-10-19 15:26 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll 2011-10-19 15:26 . 2011-10-19 15:26 367104 ----a-w- c:\windows\SysWow64\html.iec 2011-10-19 15:26 . 2011-10-19 15:26 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll 2011-10-19 15:26 . 2011-10-19 15:26 1798144 ----a-w- c:\windows\SysWow64\jscript9.dll 2011-10-19 15:26 . 2011-10-19 15:26 161792 ----a-w- c:\windows\SysWow64\msls31.dll 2011-10-19 15:26 . 2011-10-19 15:26 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2011-10-19 15:26 . 2011-10-19 15:26 1126912 ----a-w- c:\windows\SysWow64\wininet.dll 2011-10-19 15:26 . 2011-10-19 15:26 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll 2011-10-19 15:26 . 2011-10-19 15:26 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2011-10-19 15:26 . 2011-10-19 15:26 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe 2011-10-19 15:26 . 2011-10-19 15:26 76800 ----a-w- c:\windows\system32\tdc.ocx 2011-10-19 15:26 . 2011-10-19 15:26 49664 ----a-w- c:\windows\system32\imgutil.dll 2011-10-19 15:26 . 2011-10-19 15:26 48640 ----a-w- c:\windows\system32\mshtmler.dll 2011-10-19 15:26 . 2011-10-19 15:26 420864 ----a-w- c:\windows\SysWow64\vbscript.dll 2011-10-19 15:26 . 2011-10-19 15:26 35840 ----a-w- c:\windows\SysWow64\imgutil.dll 2011-10-19 15:26 . 2011-10-19 15:26 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb 2011-10-19 15:26 . 2011-10-19 15:26 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2011-10-19 15:26 . 2011-10-19 15:26 2309120 ----a-w- c:\windows\system32\jscript9.dll 2011-10-19 15:26 . 2011-10-19 15:26 222208 ----a-w- c:\windows\system32\msls31.dll 2011-10-19 15:26 . 2011-10-19 15:26 173056 ----a-w- c:\windows\system32\ieUnatt.exe 2011-10-19 15:26 . 2011-10-19 15:26 152064 ----a-w- c:\windows\SysWow64\wextract.exe 2011-10-19 15:26 . 2011-10-19 15:26 150528 ----a-w- c:\windows\SysWow64\iexpress.exe 2011-10-19 15:26 . 2011-10-19 15:26 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe 2011-10-19 15:26 . 2011-10-19 15:26 1389056 ----a-w- c:\windows\system32\wininet.dll 2011-10-19 15:26 . 2011-10-19 15:26 135168 ----a-w- c:\windows\system32\IEAdvpack.dll 2011-10-19 15:26 . 2011-10-19 15:26 12288 ----a-w- c:\windows\system32\mshta.exe 2011-10-19 15:26 . 2011-10-19 15:26 11776 ----a-w- c:\windows\SysWow64\mshta.exe 2011-10-19 15:26 . 2011-10-19 15:26 114176 ----a-w- c:\windows\system32\admparse.dll 2011-10-19 15:26 . 2011-10-19 15:26 111616 ----a-w- c:\windows\system32\iesysprep.dll 2011-10-19 15:26 . 2011-10-19 15:26 101888 ----a-w- c:\windows\SysWow64\admparse.dll 2011-10-19 15:26 . 2011-10-19 15:26 85504 ----a-w- c:\windows\system32\iesetup.dll 2011-10-19 15:26 . 2011-10-19 15:26 603648 ----a-w- c:\windows\system32\vbscript.dll 2011-10-19 15:26 . 2011-10-19 15:26 448512 ----a-w- c:\windows\system32\html.iec 2011-10-19 15:26 . 2011-10-19 15:26 30720 ----a-w- c:\windows\system32\licmgr10.dll 2011-10-19 15:26 . 2011-10-19 15:26 165888 ----a-w- c:\windows\system32\iexpress.exe 2011-10-19 15:26 . 2011-10-19 15:26 160256 ----a-w- c:\windows\system32\wextract.exe 2011-10-19 15:26 . 2011-10-19 15:26 1492992 ----a-w- c:\windows\system32\inetcpl.cpl 2011-10-19 13:37 . 2011-10-19 13:37 32320 ----a-w- c:\windows\system32\drivers\FNETTBOH_305.SYS 2011-10-19 13:37 . 2011-10-19 13:37 15936 ----a-w- c:\windows\system32\drivers\FNETURPX.SYS 2011-09-22 18:43 . 2011-09-22 18:43 3578880 ----a-w- c:\windows\SysWow64\ffdshow.ax 2011-09-22 17:08 . 2011-09-22 17:08 3902976 ----a-w- c:\windows\SysWow64\ffmpeg.dll 2011-09-15 14:33 . 2011-09-15 14:33 4423168 ----a-w- c:\windows\system32\ffdshow.ax 2011-09-15 14:31 . 2011-09-15 14:31 3926016 ----a-w- c:\windows\system32\ffmpeg.dll . . ((((((((((((((((((((((((((((( SnapShot@2011-12-06_19.04.10 ))))))))))))))))))))))))))))))))))))))))) . + 2009-07-14 05:10 . 2011-12-06 20:00 39882 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-10-19 13:45 . 2011-12-06 20:00 5146 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-311355016-2286594628-1724791517-1000_UserData.bin + 2011-12-06 19:58 . 2011-12-06 19:58 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-12-05 17:59 . 2011-12-05 17:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-12-06 19:58 . 2011-12-06 19:58 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2011-12-05 17:59 . 2011-12-05 17:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-07-14 05:01 . 2011-12-05 17:58 402172 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2011-12-06 19:58 402172 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2011-10-19 17:47 . 2011-12-06 19:58 820796 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-311355016-2286594628-1724791517-1000-12288.dat - 2011-10-19 17:47 . 2011-12-05 12:30 820796 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-311355016-2286594628-1724791517-1000-12288.dat + 2011-10-19 14:30 . 2011-12-06 19:58 7754664 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-311355016-2286594628-1724791517-1000-8192.dat - 2011-10-19 14:30 . 2011-12-05 17:58 7754664 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-311355016-2286594628-1724791517-1000-8192.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-10-19 641400] "Nexus"="c:\program files (x86)\Winstep\Nexus.exe" [2011-11-18 13599872] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "XFast USB"="c:\program files (x86)\XFast USB\XFastUsb.exe" [2011-10-19 4878912] "vmware-tray"="e:\vmare\vmware-tray.exe" [2011-08-22 103536] "XArp"="c:\program files (x86)\XArp\xarp.exe" [2011-04-01 10413568] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Translate Client.lnk - c:\program files (x86)\Translate Client\translateclient.exe [2011-8-9 1687552] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x] R3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [x] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] R3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver;c:\windows\system32\DRIVERS\Rtnic64.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x] S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [x] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x] S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [x] S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [x] S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x] S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-09-22 974944] S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x] S2 OS Selector;Acronis OS Selector activator;c:\program files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe [2010-09-29 2139400] S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2011-08-21 846448] S2 VMwareHostd;VMware Workstation Server;e:\vmare\vmware-hostd.exe [2011-08-22 11837440] S2 vstor2-mntapi10-shared;Vstor2 MntApi 1.0 Driver (shared);SysWOW64\drivers\vstor2-mntapi10-shared.sys [x] S2 Winstep Xtreme Service;Winstep Xtreme Service;c:\program files (x86)\Winstep\WsxService [x] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [x] . . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-18 8067616] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-08 165912] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-08 387608] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-08 365592] "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-22 4035152] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.yandex.ru/?clid=124990 mLocal Page = c:\windows\SysWOW64\blank.htm IE: &Експортиране към Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: &Изпрати към OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 LSP: %SystemRoot%\system32\vsocklib.dll TCP: DhcpNameServer = 192.168.2.1 TCP: Interfaces\{59DE1615-A880-48B4-87AD-F7F9C6EE9237}: NameServer = 212.36.23.129 FF - ProfilePath - c:\users\SM\AppData\Roaming\Mozilla\Firefox\Profiles\poooyc0u.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2995820&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?hl=bg FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=685749&p= . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winstep Xtreme Service] "ImagePath"="c:\program files (x86)\Winstep\WsxService" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\B20@O=5 *=0 *C*C*l*e*a*n*e*r*& \command] @="c:\\Program Files\\CCleaner\\ccleaner.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\windows\SysWOW64\IoctlSvc.exe c:\windows\SysWOW64\vmnat.exe c:\program files (x86)\Winstep\WsxService.exe e:\vmare\vmware-authd.exe c:\windows\SysWOW64\vmnetdhcp.exe . ************************************************************************** . Completion time: 2011-12-06 22:18:05 - machine was rebooted ComboFix-quarantined-files.txt 2011-12-06 20:17 ComboFix2.txt 2011-12-06 19:21 . Pre-Run: 35 126 591 488 bytes free Post-Run: 35 080 462 336 bytes free . - - End Of File - - 1B3CC9CE5331F8CA3EC54244526F0727

Добра работа..!:tease:Нещата изглеждат наред...!Но ми се иска да направим още една -две проверки..!

Сега,деинсталирайте Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

Публикувано изображение

2.Изтеглете Публикувано изображениеOTCleanIt или от тук,стартирайте и натиснете Публикувано изображение

След това:

Публикувано изображение Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Публикувано изображение Изтеглете програмата: ESET Online Scanner

  • Стартирайте esetsmartinstaller_enu.exe Публикувано изображение
  • Сложете отметка на YES, I accept the Terms of Use и изберете Start:

    Публикувано изображение

  • Скенерът ще започне да изтегля компонентите, които са му необходими:

    Публикувано изображение

  • Уверете се, че има отметки на следните редове:

    Публикувано изображение

    Накрая изберете Start

  • Скенерът ще започне да изтегля последните дефиниции.
  • След, като сканирането завърши изберете Finish.
  • Отидете в: C:\Program Files\ESET\ESET Online Scanner
  • Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.
  • Автор

Здравейте отново, ето лог файловете: Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Версия на базата от данни: 8323 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 7.12.2011 г. 06:44:12 mbam-log-2011-12-07 (06-44-12).txt Тип сканиране: Пълно сканиране (C:\|D:\|E:\|) Сканирани обекти: 291210 Изминало време: 28 минута(и), 20 секунда(и) Заразени процеси в паметта: 0 Заразени модули в паметта: 0 Заразени ключове в регистратурата: 0 Заразени стойности в регистратурата: 0 Заразени информационни обекти в регистратурата: 0 Заразени папки: 0 Заразени файлове: 0 Заразени процеси в паметта: (Не бяха открити зловредни обекти) Заразени модули в паметта: (Не бяха открити зловредни обекти) Заразени ключове в регистратурата: (Не бяха открити зловредни обекти) Заразени стойности в регистратурата: (Не бяха открити зловредни обекти) Заразени информационни обекти в регистратурата: (Не бяха открити зловредни обекти) Заразени папки: (Не бяха открити зловредни обекти) Заразени файлове: (Не бяха открити зловредни обекти) ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=dad5fa824b62c7418927998a9a057b0d # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-12-07 07:28:19 # local_time=2011-12-07 09:28:19 ) # country="Bulgaria" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776573 100 94 4055 74863424 0 0 # compatibility_mode=8206 39157117 100 74 42077 6547938 0 0 # scanned=122741 # found=0 # cleaned=0 # scan_time=9325 # nod_component=V3 Build:0x30000000

  • Автор

Благодаря ви за помощта. И в момента ARP атаките продължават, могат ли да се блокират и до колко могат да навредят на системата ми?

Извинявам се, че се намесвам в този раздел, но то е само с цел да дам информация: http://antivirus.trbk.net/%D0%BA%D0%BE%D0%BC%D0%BF%D1%8E%D1%82%D1%8A%D1%80%D0%BD%D0%B0-%D0%B8-%D0%BC%D1%80%D0%B5%D0%B6%D0%BE%D0%B2%D0%B0-%D1%81%D0%B8%D0%B3%D1%83%D1%80%D0%BD%D0%BE%D1%81%D1%82?start=18 - повече за този тип атака

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.