Здравейте Преди около 40 мин. започнаха да ми излизат вируси на екрана и аз нали ги трия но те пак се появяват. ОС ми е XP - антивирусната Avast.. един и същ вирус трия го и след няколко минути пак се появява и така.. - троянски кон Като си спра интернета и вирусите не се появяват...

Привет. Опитайте да изпълните т.5 от тази тема. Очаквам логовете от DDS: DDS.txt и Attach.txt

тези вируси почват да ме изнервят вече.. . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_24 Run by user at 19:57:09 on 2011-12-27 . ============== Running Processes =============== . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\explorer.exe C:\WINDOWS\AGRSMMSG.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\All Users\fmtcsr.exe C:\Program Files\OSTEC\CoolGram\CoolGram.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Alwil Software\Avast4\ashSimpl.exe C:\Program Files\Alwil Software\Avast4\ashChest.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Documents and Settings\user\My Documents\Downloads\dds.scr C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService . ============== Pseudo HJT Report =============== . uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1750559 uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local mSearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=4c8846a4000000000000000e35f88b08&tlver=1.4.19.19&affID=17160 uURLSearchHooks: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - c:\program files\bs_player\tbBS_1.dll mWinlogon: SfcDisable=-99 (0xffffff9d) uWinlogon: Shell=c:\documents and settings\user\local settings\application data\4e968e86\X BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll BHO: Keyword Search: {31a0d938-3055-46ba-8919-59e44e0d7e51} - c:\program files\keyword search\torangcomz.dll BHO: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - c:\program files\softonic-eng7\tbSof2.dll BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - c:\program files\bs_player\tbBS_1.dll BHO: Softonic English FF Toolbar: {ffa0793e-3980-4be4-8234-048fa665f700} - c:\program files\softonic_english_ff\tbSof2.dll TB: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - c:\program files\softonic-eng7\tbSof2.dll TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: Softonic English FF Toolbar: {ffa0793e-3980-4be4-8234-048fa665f700} - c:\program files\softonic_english_ff\tbSof2.dll TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll TB: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - c:\program files\bs_player\tbBS_1.dll TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File uRun: [Gadwin PrintScreen] "c:\program files\gadwin systems\printscreen\PrintScreen.exe" /nosplash uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [fmtcsr] c:\documents and settings\all users\fmtcsr.exe uRun: [csconfig] c:\documents and settings\user\application data\csconfig.exe mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [CoolStartUp] c:\program files\ostec\coolgram\CoolGramS.exe mRun: [fmtcsr] c:\documents and settings\all users\fmtcsr.exe mRun: [csconfig] c:\documents and settings\user\application data\csconfig.exe dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE dRunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe LSP: mswsock.dll DPF: {108D3206-846A-4A93-BACB-F0572D043ED7} - hxxp://192.168.0.104/webrec.cab DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files/Fishdom/Images/stg_drm.ocx DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1279480841956 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1279480822558 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files/Fishdom/Images/armhelper.ocx TCP: DhcpNameServer = 212.50.10.50 212.50.10.51 TCP: Interfaces\{C2DF3B30-45D0-4549-9394-885F8FF4F18A} : DhcpNameServer = 212.50.10.50 212.50.10.51 Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll STS: ObjectDockShellExt: {1984d045-52cf-49cd-db77-08f378fea4db} - ObjectDockShlExt Class SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No File . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\user\application data\mozilla\firefox\profiles\ygson9qv.default\ FF - prefs.js: browser.startup.homepage - www.google.bg FF - plugin: c:\docume~1\user\applic~1\powerc~1\nppowerloader.dll FF - plugin: c:\program files\inhatchteam\inhatch\npinhatch.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll . ============= SERVICES / DRIVERS =============== . R? archlp;archlp R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86 R? MEMSWEEP2;MEMSWEEP2 R? sensorsview;sensorsview R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0 S? {E6759E0C-470B-44DC-A4A1-627E68BB3A85};AIM 3.0 SI164 S? aswFsBlk;aswFsBlk S? aswSP;avast! Self Protection S? avast! Antivirus;avast! Antivirus S? avast! Mail Scanner;avast! Mail Scanner S? avast! Web Scanner;avast! Web Scanner S? LMPC2;LMPC2 . =============== Created Last 30 ================ . 2011-12-27 17:04:37 -------- d-sh--w- c:\documents and settings\user\local settings\application data\4e968e86 2011-12-27 17:04:30 66560 ----a-w- c:\documents and settings\all users\fmtcsr.exe . ==================== Find3M ==================== . 2011-12-26 14:55:00 54488 ----a-w- c:\windows\UninstCool.exe 2011-11-23 18:30:52 98304 ----a-w- c:\windows\system32\CoolGramA.OCX . ============= FINISH: 19:59:51.17 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 01.3.2010 г. 16:07:38 System Uptime: 27.12.2011 г. 19:10:18 (0 hours ago) . Motherboard: FUJITSU | | FJNB182 Processor: Intel® Pentium® M processor 1.60GHz | Onboard | 591/400mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 14 GiB total, 2.993 GiB free. D: is FIXED (NTFS) - 42 GiB total, 3.164 GiB free. E: is CDROM () F: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP334: 03.12.2011 г. 13:15:38 - Контролна точка на системата RP335: 04.12.2011 г. 17:28:53 - Контролна точка на системата RP336: 06.12.2011 г. 17:41:36 - Контролна точка на системата RP337: 07.12.2011 г. 21:43:03 - Контролна точка на системата RP338: 09.12.2011 г. 21:21:56 - Контролна точка на системата RP339: 18.12.2011 г. 13:43:44 - Контролна точка на системата RP340: 21.12.2011 г. 13:18:00 - Контролна точка на системата RP341: 22.12.2011 г. 16:15:55 - Контролна точка на системата RP342: 26.12.2011 г. 17:30:37 - Контролна точка на системата . ==== Installed Programs ====================== . µTorrent Adobe Anchor Service CS3 Adobe Asset Services CS3 Adobe Bridge CS3 Adobe Bridge Start Meeting Adobe Camera Raw 4.0 Adobe CMaps Adobe Color - Photoshop Specific Adobe Color Common Settings Adobe Color EU Extra Settings Adobe Color JA Extra Settings Adobe Color NA Recommended Settings Adobe Default Language CS3 Adobe Device Central CS3 Adobe ExtendScript Toolkit 2 Adobe Flash Player 10 Plugin Adobe Flash Player ActiveX Adobe Fonts All Adobe Help Viewer CS3 Adobe Linguistics CS3 Adobe PDF Library Files Adobe Photoshop CS3 Adobe Setup Adobe Shockwave Player Adobe Stock Photos 1.0 Adobe Stock Photos CS3 Adobe Type Support Adobe Update Manager CS3 Adobe Version Cue CS3 Client Adobe WinSoft Linguistics Plugin Adobe XMP Panels CS3 Advanced SystemCare 3 Agere Systems AC'97 Modem Ask Toolbar Audacity 1.2.6 avast! Antivirus BS.Player FREE BS_Player Toolbar Conduit Engine CoolGram EVEREST Ultimate Edition v5.50 Favorite-Games 5.19 Foxit Reader Gadwin PrintScreen Hotfix for Windows XP (KB942288-v3) Inhatch web plugins Intel® Extreme Graphics 2 Driver Java Auto Updater Java 6 Update 24 K-Lite Mega Codec Pack 6.2.0 Keyword Search Lock My PC 3.6 for Windows 98/ME and Windows 2000/XP Microsoft .NET Framework 2.0 Microsoft .NET Framework 3.0 Microsoft .NET Framework 4 Client Profile Microsoft Kernel-Mode Driver Framework Feature Pack 1.9 Microsoft PowerPoint Viewer Microsoft Silverlight Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 mIRC Mozilla Firefox 8.0 (x86 bg) MSXML 6.0 Parser (KB925673) neroxml OpenOffice.org 3.2 OpenOffice.org 3.2 SDK PDF Settings Power Challenge Game Plugin Security Update for Windows Internet Explorer 7 (KB938127-v2) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows XP (KB960715) SigmaTel AC97 Audio Drivers SkypeLauncher Skype™ 5.5 Smart Defrag Softonic-Eng7 Toolbar Softonic English FF Toolbar Synaptics Pointing Device Driver The KMPlayer (remove only) WebFldrs XP Winamp Winamp Detector Plug-in Windows Bulgarian Interface Pack Windows Communication Foundation Windows Driver Package - Intel (NETw3x32) net (07/02/2006 10.5.1.57) Windows Driver Package - Intel (w29n51) net (06/26/2006 9.0.4.17) Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray Windows Presentation Foundation Windows Workflow Foundation WinRAR archiver x264vfw - H.264/MPEG-4 AVC codec (remove only) XML Paper Specification Shared Components Pack 1.0 . ==== Event Viewer Messages From Past Week ======== . 27.12.2011 г. 19:12:19, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview 27.12.2011 г. 16:57:44, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview 27.12.2011 г. 08:53:59, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview 26.12.2011 г. 16:54:43, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview 26.12.2011 г. 16:23:05, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview 24.12.2011 г. 08:16:25, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview 23.12.2011 г. 20:26:57, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview 23.12.2011 г. 09:00:55, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview 23.12.2011 г. 08:02:56, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview 23.12.2011 г. 06:51:42, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview 22.12.2011 г. 11:49:05, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview 22.12.2011 г. 06:56:48, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview 21.12.2011 г. 12:30:58, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview 20.12.2011 г. 12:22:57, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: archlp sensorsview . ==== End Of File ===========================

Спокойно. Имате Zero Access. Ще го оправим. Затова:

1. Изтеглете ComboFix от BleepingComputer

и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. Ако получите предупреждение от UAC, съгласете се.

5 ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

6 Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

Забележка: Ако се появи следното съобщение при отварянето на различни програми след завършване на сканирането с Combofix - "illegal operation on a registry key that has been marked for deletion." просто рестартирайте компютъра още веднъж и то ще изчезне.

По време на сканирането не използвайте компютъра си !

изписа ми някаква грешка..

Пробвайте с този файл: ComboFix.exe

а сега на къде..

Ако ComboFix иска инсталиране на Recovery Console, просто го прескочете (No). Опитайте пак, съжалявам ,че не ви предупредих.

Мисля, че вирусите вече ги няма. Благодаря Ви много.

ComboFix 11-12-27.01 - user 12.2011 г. 21:29:05.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.502.163 [GMT 2:00]

Running from: c:\documents and settings\user\Desktop\ComboFix.exe

AV: avast! antivirus 4.8.1282 [VPS 111227-1] *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\All Users\Application Data\TEMP

c:\documents and settings\All Users\fmtcsr.exe

c:\documents and settings\user\Application Data\.#

c:\documents and settings\user\Application Data\csconfig.exe

c:\documents and settings\user\Application Data\PriceGong

c:\documents and settings\user\Application Data\PriceGong\Data\1.xml

c:\documents and settings\user\Application Data\PriceGong\Data\a.xml

c:\documents and settings\user\Application Data\PriceGong\Data\b.xml

c:\documents and settings\user\Application Data\PriceGong\Data\c.xml

c:\documents and settings\user\Application Data\PriceGong\Data\d.xml

c:\documents and settings\user\Application Data\PriceGong\Data\e.xml

c:\documents and settings\user\Application Data\PriceGong\Data\f.xml

c:\documents and settings\user\Application Data\PriceGong\Data\g.xml

c:\documents and settings\user\Application Data\PriceGong\Data\h.xml

c:\documents and settings\user\Application Data\PriceGong\Data\i.xml

c:\documents and settings\user\Application Data\PriceGong\Data\J.xml

c:\documents and settings\user\Application Data\PriceGong\Data\k.xml

c:\documents and settings\user\Application Data\PriceGong\Data\l.xml

c:\documents and settings\user\Application Data\PriceGong\Data\m.xml

c:\documents and settings\user\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\user\Application Data\PriceGong\Data\n.xml

c:\documents and settings\user\Application Data\PriceGong\Data\o.xml

c:\documents and settings\user\Application Data\PriceGong\Data\p.xml

c:\documents and settings\user\Application Data\PriceGong\Data\q.xml

c:\documents and settings\user\Application Data\PriceGong\Data\r.xml

c:\documents and settings\user\Application Data\PriceGong\Data\s.xml

c:\documents and settings\user\Application Data\PriceGong\Data\t.xml

c:\documents and settings\user\Application Data\PriceGong\Data\u.xml

c:\documents and settings\user\Application Data\PriceGong\Data\v.xml

c:\documents and settings\user\Application Data\PriceGong\Data\w.xml

c:\documents and settings\user\Application Data\PriceGong\Data\x.xml

c:\documents and settings\user\Application Data\PriceGong\Data\y.xml

c:\documents and settings\user\Application Data\PriceGong\Data\z.xml

c:\documents and settings\user\Local Settings\Application Data\4e968e86\U\000000c0.@

c:\documents and settings\user\Local Settings\Application Data\4e968e86\U\800000cb.@

c:\documents and settings\user\Local Settings\Application Data\4e968e86\U\800000cf.@

c:\documents and settings\user\Local Settings\Application Data\4e968e86\X

c:\documents and settings\user\torangcomz_query_list.txt

c:\program files\Keyword Search

c:\program files\Keyword Search\torangcomz.dll

c:\program files\Keyword Search\uninstall.exe

c:\windows\assembly\GAC_MSIL\desktop.ini

c:\windows\libmysql.dll

c:\windows\system32\

c:\windows\XSxS

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_VCS

.

.

((((((((((((((((((((((((( Files Created from 2011-11-27 to 2011-12-27 )))))))))))))))))))))))))))))))

.

.

2011-12-27 19:46 . 2011-12-27 19:46 -------- d-----w- c:\windows\system32\xircom

2011-12-27 19:46 . 2011-12-27 19:46 -------- d-----w- c:\windows\system32\wbem\snmp

2011-12-27 19:46 . 2011-12-27 19:46 -------- d-----w- c:\program files\microsoft frontpage

2011-12-27 17:04 . 2011-12-27 19:43 -------- d-sh--w- c:\documents and settings\user\Local Settings\Application Data\4e968e86

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-26 14:55 . 2011-11-23 18:30 54488 ----a-w- c:\windows\UninstCool.exe

2011-11-23 18:30 . 2011-11-23 18:30 98304 ----a-w- c:\windows\system32\CoolGramA.OCX

2011-11-10 05:09 . 2011-08-02 10:53 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2009-01-08 . 5AE1C2695F6523AD98B948F2887D8C5E . 361600 . . [5.1.2600.5649] . . c:\windows\system32\drivers\tcpip.sys

.

.

[-] 2009-01-08 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

.

c:\windows\System32\wuauclt.exe ... is missing !!

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_1.dll" [2011-11-28 2735200]

.

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2010-12-09 10:51 3911776 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]

2010-10-18 10:26 3908192 ----a-w- c:\program files\Softonic-Eng7\tbSof2.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2010-05-26 12:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

2011-11-28 05:05 2735200 ----a-w- c:\program files\BS_Player\tbBS_1.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ffa0793e-3980-4be4-8234-048fa665f700}]

2010-10-18 10:26 3908192 ----a-w- c:\program files\Softonic_English_FF\tbSof2.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}"= "c:\program files\Softonic-Eng7\tbSof2.dll" [2010-10-18 3908192]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

"{ffa0793e-3980-4be4-8234-048fa665f700}"= "c:\program files\Softonic_English_FF\tbSof2.dll" [2010-10-18 3908192]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]

"{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_1.dll" [2011-11-28 2735200]

.

[HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CLASSES_ROOT\clsid\{ffa0793e-3980-4be4-8234-048fa665f700}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

"{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3}"= "c:\program files\Softonic-Eng7\tbSof2.dll" [2010-10-18 3908192]

"{FFA0793E-3980-4BE4-8234-048FA665F700}"= "c:\program files\Softonic_English_FF\tbSof2.dll" [2010-10-18 3908192]

"{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}"= "c:\program files\BS_Player\tbBS_1.dll" [2011-11-28 2735200]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]

.

[HKEY_CLASSES_ROOT\clsid\{ffa0793e-3980-4be4-8234-048fa665f700}]

.

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Gadwin PrintScreen"="c:\program files\Gadwin Systems\PrintScreen\PrintScreen.exe" [2008-12-09 495616]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AGRSMMSG"="AGRSMMSG.exe" [2004-07-05 88363]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-12 81000]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]

"CoolStartUp"="c:\program files\OSTEC\CoolGram\CoolGramS.exe" [2011-11-23 107728]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"_nltide_2"="shell32" [X]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^Adobe Gamma.lnk]

path=c:\documents and settings\user\Start Menu\Programs\Startup\Adobe Gamma.lnk

backup=c:\windows\pss\Adobe Gamma.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadwin PrintScreen]

2008-12-09 11:08 495616 ----a-w- c:\program files\Gadwin Systems\PrintScreen\PrintScreen.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2003-10-02 11:19 118784 ----a-w- c:\windows\system32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2003-10-02 11:37 155648 ----a-w- c:\windows\system32\igfxtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LtMoh]

2004-07-05 22:00 184320 ------w- c:\program files\ltmoh\ltmoh.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 03:42 1695232 ------w- c:\program files\Messenger\msmsgs.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-10-29 12:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

2004-05-27 12:58 532480 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]

2004-05-27 12:59 98304 ----a-w- c:\program files\Synaptics\SynTP\SynTPLpr.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"23069:TCP"= 23069:TCP:BitComet 23069 TCP

"23069:UDP"= 23069:UDP:BitComet 23069 UDP

"443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443

"443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443

"37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674

"37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674

"37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675

"2706:TCP"= 2706:TCP:Inhatch P2P Streaming

"2707:TCP"= 2707:TCP:Inhatch P2P Streaming

"2708:TCP"= 2708:TCP:Inhatch P2P Streaming

"2709:TCP"= 2709:TCP:Inhatch P2P Streaming

.

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14.5.2010 г. 09:01 691696]

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [11.5.2010 г. 16:46 110160]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11.5.2010 г. 16:46 20560]

R3 {E6759E0C-470B-44DC-A4A1-627E68BB3A85};AIM 3.0 SI164;c:\windows\system32\drivers\A302.sys [01.3.2010 г. 16:41 11831]

R3 LMPC2;LMPC2;c:\windows\system32\drivers\lmpc2.sys [03.9.2010 г. 09:25 4224]

S1 archlp;archlp;c:\windows\system32\drivers\archlp.sys --> c:\windows\system32\drivers\archlp.sys [?]

S1 sensorsview;sensorsview;\??\c:\program files\SensorsViewPro41\drv\sensorsview32.sys --> c:\program files\SensorsViewPro41\drv\sensorsview32.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 г. 12:16 130384]

S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\F9.tmp --> c:\windows\system32\F9.tmp [?]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 г. 12:16 753504]

.

Contents of the 'Scheduled Tasks' folder

.

2011-12-27 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job

- c:\program files\Ask.com\UpdateTask.exe [2010-05-26 12:23]

.

2011-12-11 c:\windows\Tasks\SmartDefrag.job

- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2010-06-24 09:57]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1750559

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 212.50.10.50 212.50.10.51

DPF: {108D3206-846A-4A93-BACB-F0572D043ED7} - hxxp://192.168.0.104/webrec.cab

FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\ygson9qv.default\

FF - prefs.js: browser.startup.homepage - www.google.bg

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-fmtcsr - c:\documents and settings\All Users\fmtcsr.exe

HKCU-Run-csconfig - c:\documents and settings\user\Application Data\csconfig.exe

HKLM-Run-fmtcsr - c:\documents and settings\All Users\fmtcsr.exe

HKLM-Run-csconfig - c:\documents and settings\user\Application Data\csconfig.exe

SharedTaskScheduler-{1984D045-52CF-49cd-DB77-08F378FEA4DB} - (no file)

ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)

AddRemove-Keyword Search - c:\program files\Keyword Search\uninstall.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-12-27 21:47

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]

"ImagePath"="\??\c:\windows\system32\F9.tmp"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(2460)

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\msi.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Alwil Software\Avast4\aswUpdSv.exe

c:\program files\Alwil Software\Avast4\ashServ.exe

c:\windows\AGRSMMSG.exe

c:\windows\system32\wscntfy.exe

c:\program files\Alwil Software\Avast4\ashMaiSv.exe

c:\program files\Alwil Software\Avast4\ashWebSv.exe

c:\program files\Alwil Software\Avast4\setup\avast.setup

.

**************************************************************************

.

Completion time: 2011-12-27 21:52:29 - machine was rebooted

ComboFix-quarantined-files.txt 2011-12-27 19:52

.

Pre-Run: 3 175 022 592 bytes free

Post-Run: 3 150 417 920 bytes free

.

- - End Of File - - E90D4A7459D32AB2A8D5FB33898A4E6F

Редактирано 27 декември 201114 г. от powerful (преглед на промените)

Супер. Сега ми дайте малко време да помисля какво да направим по-нататък. Моля, архивирайте папката C:\Qoobox\Quarantine => и я качете на този адрес => http://file.bg/

Копирайте линка за download в следващия си пост за да я изтеглим.

http://file.bg/c139199qNJoM

• Сега изтеглете Junction.zip и го запазете на вашия десктоп. Разархивирайте файла и го копирайте файла junction.exe в C:\Windows.
• Изтеглете следния файл:
• Разархивирайте fix.zip и стартирайте стартирайте файла fix.bat с десен бутон → Run as administrator
• Изчакайте да завърши проверката и да се появи лог файла (този лог файл ще се намира на С:\ с име log.txt).
• Копирайте съдържанието му в следващия си коментар.

Junction v1.06 - Windows junction creator and reparse point viewer Copyright © 2000-2010 Mark Russinovich Sysinternals - www.sysinternals.com ... . Print Name : c:\windows\system32\config Substitute Name: \systemroot\system32\config Print Name : C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 Substitute Name: C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 ... Print Name : C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 Substitute Name: C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 ...

Редактирано 27 декември 201114 г. от powerful (преглед на промените)

Странно, Junction би трябвало дa тръгне, независимо от GUI. Както и да е, искам още една проверка, става бързо:

Моля изтеглете TDSSKiller от тук и я запазете на вашия декстоп.

• Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.

  

• Сложете отметки пред Verify Driver Digital Signature и Detect TDLFS file system и натиснете ОК.

  

• Натиснете бутона Start Scan.

  

• Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.

  

• Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.

  Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

  

  Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.

• Лог файл ще бъде създаден в свободната директория на дял C:\ . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

22:54:45.0231 0824 TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16 22:54:45.0721 0824 ============================================================ 22:54:45.0721 0824 Current date / time: 2011/12/27 22:54:45.0721 22:54:45.0721 0824 SystemInfo: 22:54:45.0721 0824 22:54:45.0721 0824 OS Version: 5.1.2600 ServicePack: 3.0 22:54:45.0721 0824 Product type: Workstation 22:54:45.0721 0824 ComputerName: MARTATA 22:54:45.0721 0824 UserName: user 22:54:45.0721 0824 Windows directory: C:\WINDOWS 22:54:45.0721 0824 System windows directory: C:\WINDOWS 22:54:45.0721 0824 Processor architecture: Intel x86 22:54:45.0721 0824 Number of processors: 1 22:54:45.0721 0824 Page size: 0x1000 22:54:45.0721 0824 Boot type: Normal boot 22:54:45.0721 0824 ============================================================ 22:54:49.0847 0824 Initialize success 22:57:06.0934 3756 ============================================================ 22:57:06.0934 3756 Scan started 22:57:06.0934 3756 Mode: Manual; SigCheck; TDLFS; 22:57:06.0934 3756 ============================================================ 22:57:09.0398 3756 Aavmker4 (e4a81aed3c4eae3949fc9420f2a5ab43) C:\WINDOWS\system32\drivers\Aavmker4.sys 22:57:10.0179 3756 Aavmker4 - ok 22:57:10.0299 3756 Abiosdsk - ok 22:57:10.0339 3756 abp480n5 - ok 22:57:10.0389 3756 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 22:57:12.0923 3756 ACPI - ok 22:57:13.0093 3756 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 22:57:13.0283 3756 ACPIEC - ok 22:57:13.0324 3756 adpu160m - ok 22:57:13.0404 3756 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 22:57:13.0794 3756 aec - ok 22:57:13.0864 3756 AFD (38d7b715504da4741df35e3594fe2099) C:\WINDOWS\System32\drivers\afd.sys 22:57:13.0994 3756 AFD - ok 22:57:14.0235 3756 AgereSoftModem (b2b65df27edd281a757972e13b36ff33) C:\WINDOWS\system32\DRIVERS\AGRSM.sys 22:57:14.0475 3756 AgereSoftModem - ok 22:57:14.0525 3756 Aha154x - ok 22:57:14.0565 3756 aic78u2 - ok 22:57:14.0605 3756 aic78xx - ok 22:57:14.0665 3756 AliIde - ok 22:57:14.0706 3756 amsint - ok 22:57:14.0926 3756 archlp - ok 22:57:14.0996 3756 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys 22:57:15.0316 3756 Arp1394 - ok 22:57:15.0477 3756 asc - ok 22:57:15.0507 3756 asc3350p - ok 22:57:15.0537 3756 asc3550 - ok 22:57:15.0627 3756 aswFsBlk (5db4826ce026f0e0bd982137d3bc42d1) C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys 22:57:15.0637 3756 aswFsBlk - ok 22:57:15.0737 3756 aswMon2 (67c281467ff8fdad8c430e4898b97165) C:\WINDOWS\system32\drivers\aswMon2.sys 22:57:15.0797 3756 aswMon2 - ok 22:57:15.0927 3756 aswRdr (5c09acb2a721225d76ef10752bead097) C:\WINDOWS\system32\drivers\aswRdr.sys 22:57:15.0937 3756 aswRdr - ok 22:57:16.0007 3756 aswSP (e1b96fdce71dbd67f75d2979dda4df8d) C:\WINDOWS\system32\drivers\aswSP.sys 22:57:16.0077 3756 aswSP - ok 22:57:16.0138 3756 aswTdi (9bb4b307ba4dcde9fc98f4fdf8851d37) C:\WINDOWS\system32\drivers\aswTdi.sys 22:57:16.0178 3756 aswTdi - ok 22:57:16.0258 3756 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 22:57:16.0628 3756 AsyncMac - ok 22:57:16.0728 3756 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 22:57:16.0969 3756 atapi - ok 22:57:17.0069 3756 Atdisk - ok 22:57:17.0129 3756 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 22:57:17.0389 3756 Atmarpc - ok 22:57:17.0469 3756 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 22:57:17.0740 3756 audstub - ok 22:57:17.0920 3756 b57w2k (3f09ac7cbef693554092664deef9ad00) C:\WINDOWS\system32\DRIVERS\b57xp32.sys 22:57:18.0000 3756 b57w2k - ok 22:57:18.0070 3756 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 22:57:18.0381 3756 Beep - ok 22:57:18.0411 3756 catchme - ok 22:57:18.0561 3756 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 22:57:18.0992 3756 cbidf2k - ok 22:57:19.0062 3756 cd20xrnt - ok 22:57:19.0122 3756 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 22:57:19.0422 3756 Cdaudio - ok 22:57:19.0512 3756 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 22:57:19.0933 3756 Cdfs - ok 22:57:20.0013 3756 Cdrom (4b0a100eaf5c49ef3cca8c641431eacc) C:\WINDOWS\system32\DRIVERS\cdrom.sys 22:57:20.0093 3756 Cdrom - ok 22:57:20.0213 3756 Changer - ok 22:57:20.0394 3756 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys 22:57:20.0904 3756 CmBatt - ok 22:57:20.0965 3756 CmdIde - ok 22:57:20.0995 3756 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys 22:57:21.0195 3756 Compbatt - ok 22:57:21.0275 3756 Cpqarray - ok 22:57:21.0325 3756 CrystalSysInfo - ok 22:57:21.0385 3756 dac2w2k - ok 22:57:21.0415 3756 dac960nt - ok 22:57:21.0495 3756 Disk (47b6aaec570f2c11d8bad80a064d8ed1) C:\WINDOWS\system32\DRIVERS\disk.sys 22:57:21.0605 3756 Disk - ok 22:57:21.0876 3756 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 22:57:22.0557 3756 dmboot - ok 22:57:22.0677 3756 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 22:57:23.0027 3756 dmio - ok 22:57:23.0088 3756 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 22:57:23.0358 3756 dmload - ok 22:57:23.0448 3756 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 22:57:23.0668 3756 DMusic - ok 22:57:23.0698 3756 dpti2o - ok 22:57:23.0769 3756 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 22:57:23.0979 3756 drmkaud - ok 22:57:24.0169 3756 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 22:57:24.0339 3756 Fastfat - ok 22:57:24.0419 3756 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys 22:57:24.0600 3756 Fdc - ok 22:57:24.0730 3756 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 22:57:25.0100 3756 Fips - ok 22:57:25.0201 3756 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 22:57:25.0491 3756 Flpydisk - ok 22:57:25.0601 3756 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 22:57:25.0912 3756 FltMgr - ok 22:57:25.0992 3756 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 22:57:26.0222 3756 Fs_Rec - ok 22:57:26.0322 3756 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 22:57:26.0593 3756 Ftdisk - ok 22:57:26.0713 3756 FUJ02B1 (00845dcd64fe6348ddf7890c310c17b9) C:\WINDOWS\system32\DRIVERS\FUJ02B1.sys 22:57:26.0863 3756 FUJ02B1 - ok 22:57:26.0953 3756 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 22:57:27.0274 3756 Gpc - ok 22:57:27.0364 3756 hamachi (833051c6c6c42117191935f734cfbd97) C:\WINDOWS\system32\DRIVERS\hamachi.sys 22:57:27.0394 3756 hamachi - ok 22:57:27.0534 3756 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 22:57:27.0965 3756 HidUsb - ok 22:57:28.0055 3756 hpn - ok 22:57:28.0135 3756 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys 22:57:28.0345 3756 HTTP - ok 22:57:28.0385 3756 i2omgmt - ok 22:57:28.0425 3756 i2omp - ok 22:57:28.0515 3756 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 22:57:28.0876 3756 i8042prt - ok 22:57:29.0026 3756 ialm (b076eb745ec3c669d4ae953225366f1d) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys 22:57:29.0377 3756 ialm - ok 22:57:29.0577 3756 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 22:57:30.0068 3756 Imapi - ok 22:57:30.0108 3756 ini910u - ok 22:57:30.0208 3756 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys 22:57:30.0418 3756 IntelIde - ok 22:57:30.0488 3756 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 22:57:30.0688 3756 intelppm - ok 22:57:30.0899 3756 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 22:57:31.0109 3756 Ip6Fw - ok 22:57:31.0189 3756 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 22:57:31.0480 3756 IpFilterDriver - ok 22:57:31.0530 3756 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 22:57:31.0700 3756 IpInIp - ok 22:57:31.0800 3756 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 22:57:31.0980 3756 IpNat - ok 22:57:32.0040 3756 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 22:57:32.0201 3756 IPSec - ok 22:57:32.0361 3756 irda (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys 22:57:32.0461 3756 irda - ok 22:57:32.0541 3756 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 22:57:32.0741 3756 IRENUM - ok 22:57:33.0012 3756 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 22:57:33.0272 3756 isapnp - ok 22:57:33.0342 3756 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 22:57:33.0573 3756 Kbdclass - ok 22:57:33.0683 3756 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 22:57:33.0913 3756 kmixer - ok 22:57:34.0103 3756 KSecDD (1705745d900dabf2d89f90ebaddc7517) C:\WINDOWS\system32\drivers\KSecDD.sys 22:57:34.0434 3756 KSecDD - ok 22:57:34.0494 3756 lbrtfdc - ok 22:57:34.0594 3756 LMPC2 (f0eb59df0219143d769a90f8a47741a1) C:\WINDOWS\system32\drivers\LMPC2.sys 22:57:34.0814 3756 LMPC2 ( UnsignedFile.Multi.Generic ) - warning 22:57:34.0814 3756 LMPC2 - detected UnsignedFile.Multi.Generic (1) 22:57:34.0895 3756 MEMSWEEP2 - ok 22:57:34.0975 3756 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 22:57:35.0315 3756 mnmdd - ok 22:57:35.0445 3756 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 22:57:35.0626 3756 Modem - ok 22:57:35.0706 3756 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 22:57:36.0056 3756 Mouclass - ok 22:57:36.0176 3756 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 22:57:36.0337 3756 mouhid - ok 22:57:36.0417 3756 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 22:57:36.0637 3756 MountMgr - ok 22:57:36.0707 3756 mraid35x - ok 22:57:36.0817 3756 MRxDAV (0a25b866933d126d1e831fd025a278c2) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 22:57:36.0857 3756 MRxDAV - ok 22:57:36.0958 3756 MRxSmb (7170ab42b51954def2781a4d1cce65f4) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 22:57:37.0108 3756 MRxSmb - ok 22:57:37.0238 3756 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 22:57:37.0568 3756 Msfs - ok 22:57:37.0699 3756 MSIRCOMM (95c6432151ccff8617352f8e616a1aa4) C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys 22:57:37.0949 3756 MSIRCOMM - ok 22:57:38.0079 3756 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 22:57:38.0370 3756 MSKSSRV - ok 22:57:38.0430 3756 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 22:57:38.0860 3756 MSPCLOCK - ok 22:57:38.0890 3756 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 22:57:39.0061 3756 MSPQM - ok 22:57:39.0171 3756 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 22:57:39.0321 3756 mssmbios - ok 22:57:39.0401 3756 Mup (6546fe6639499fa4bef180bdf08266a1) C:\WINDOWS\system32\drivers\Mup.sys 22:57:39.0461 3756 Mup - ok 22:57:39.0521 3756 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 22:57:39.0822 3756 NDIS - ok 22:57:39.0882 3756 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 22:57:40.0122 3756 NdisTapi - ok 22:57:40.0192 3756 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 22:57:40.0412 3756 Ndisuio - ok 22:57:40.0463 3756 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 22:57:40.0743 3756 NdisWan - ok 22:57:40.0973 3756 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys 22:57:41.0264 3756 NDProxy - ok 22:57:41.0314 3756 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 22:57:41.0604 3756 NetBIOS - ok 22:57:41.0654 3756 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 22:57:41.0885 3756 NetBT - ok 22:57:41.0975 3756 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys 22:57:42.0135 3756 NIC1394 - ok 22:57:42.0215 3756 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 22:57:42.0405 3756 Npfs - ok 22:57:42.0566 3756 Ntfs (4c51d5275ae8a16999edfe7e647d00de) C:\WINDOWS\system32\drivers\Ntfs.sys 22:57:42.0686 3756 Ntfs - ok 22:57:42.0786 3756 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 22:57:42.0996 3756 Null - ok 22:57:43.0076 3756 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 22:57:43.0697 3756 NwlnkFlt - ok 22:57:43.0887 3756 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 22:57:44.0078 3756 NwlnkFwd - ok 22:57:44.0148 3756 ohci1394 (2553f7c60b8d291b5a812245e6d4da6e) C:\WINDOWS\system32\DRIVERS\ohci1394.sys 22:57:44.0248 3756 ohci1394 - ok 22:57:44.0358 3756 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys 22:57:44.0689 3756 Parport - ok 22:57:44.0849 3756 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 22:57:45.0149 3756 PartMgr - ok 22:57:45.0239 3756 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 22:57:45.0530 3756 ParVdm - ok 22:57:45.0600 3756 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 22:57:45.0830 3756 PCI - ok 22:57:45.0900 3756 PCIDump - ok 22:57:46.0001 3756 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 22:57:46.0171 3756 PCIIde - ok 22:57:46.0261 3756 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys 22:57:46.0411 3756 Pcmcia - ok 22:57:46.0461 3756 PDCOMP - ok 22:57:46.0521 3756 PDFRAME - ok 22:57:46.0561 3756 PDRELI - ok 22:57:46.0591 3756 PDRFRAME - ok 22:57:46.0631 3756 perc2 - ok 22:57:46.0692 3756 perc2hib - ok 22:57:46.0842 3756 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 22:57:47.0092 3756 PptpMiniport - ok 22:57:47.0192 3756 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 22:57:47.0443 3756 PSched - ok 22:57:47.0563 3756 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 22:57:47.0923 3756 Ptilink - ok 22:57:48.0043 3756 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys 22:57:48.0053 3756 PxHelp20 - ok 22:57:48.0084 3756 ql1080 - ok 22:57:48.0144 3756 Ql10wnt - ok 22:57:48.0174 3756 ql12160 - ok 22:57:48.0214 3756 ql1240 - ok 22:57:48.0284 3756 ql1280 - ok 22:57:48.0364 3756 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 22:57:48.0704 3756 RasAcd - ok 22:57:48.0754 3756 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys 22:57:48.0925 3756 Rasirda - ok 22:57:49.0035 3756 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 22:57:49.0235 3756 Rasl2tp - ok 22:57:49.0315 3756 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 22:57:49.0546 3756 RasPppoe - ok 22:57:49.0616 3756 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 22:57:49.0936 3756 Raspti - ok 22:57:50.0046 3756 Rdbss (77050c6615f6eb5402f832b27fd695e0) C:\WINDOWS\system32\DRIVERS\rdbss.sys 22:57:50.0166 3756 Rdbss - ok 22:57:50.0397 3756 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 22:57:51.0028 3756 RDPCDD - ok 22:57:51.0158 3756 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 22:57:51.0398 3756 rdpdr - ok 22:57:51.0498 3756 RDPWD (e8e3107243b16a549b88d145ec051b06) C:\WINDOWS\system32\drivers\RDPWD.sys 22:57:51.0629 3756 RDPWD - ok 22:57:51.0829 3756 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 22:57:51.0999 3756 redbook - ok 22:57:52.0099 3756 rspndr (743d7d59767073a617b1dcc6c546f234) C:\WINDOWS\system32\DRIVERS\rspndr.sys 22:57:52.0159 3756 rspndr - ok 22:57:52.0249 3756 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 22:57:52.0340 3756 Secdrv - ok 22:57:52.0390 3756 sensorsview - ok 22:57:52.0440 3756 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys 22:57:52.0600 3756 serenum - ok 22:57:52.0750 3756 Serial (9276ee5d6f498e30e48d6272487ffd66) C:\WINDOWS\system32\DRIVERS\serial.sys 22:57:52.0840 3756 Serial ( UnsignedFile.Multi.Generic ) - warning 22:57:52.0840 3756 Serial - detected UnsignedFile.Multi.Generic (1) 22:57:52.0971 3756 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 22:57:53.0211 3756 Sfloppy - ok 22:57:53.0271 3756 Simbad - ok 22:57:53.0351 3756 SMCIRDA (707647a1aa0edb6cbef61b0c75c28ed3) C:\WINDOWS\system32\DRIVERS\smcirda.sys 22:57:53.0501 3756 SMCIRDA - ok 22:57:53.0561 3756 Sparrow - ok 22:57:53.0702 3756 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 22:57:54.0032 3756 splitter - ok 22:57:54.0212 3756 sptd (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys 22:57:54.0232 3756 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505 22:57:54.0232 3756 sptd ( LockedFile.Multi.Generic ) - warning 22:57:54.0232 3756 sptd - detected LockedFile.Multi.Generic (1) 22:57:54.0312 3756 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 22:57:54.0413 3756 sr - ok 22:57:54.0523 3756 Srv (ae4d13b572399b206b43d65da4d9983d) C:\WINDOWS\system32\DRIVERS\srv.sys 22:57:54.0653 3756 Srv - ok 22:57:54.0843 3756 STAC97 (032dc5b04f69e9a67710e75d59b0c057) C:\WINDOWS\system32\drivers\stac97.sys 22:57:54.0963 3756 STAC97 - ok 22:57:55.0054 3756 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 22:57:55.0434 3756 swenum - ok 22:57:55.0544 3756 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 22:57:55.0795 3756 swmidi - ok 22:57:55.0855 3756 symc810 - ok 22:57:55.0915 3756 symc8xx - ok 22:57:56.0025 3756 sym_hi - ok 22:57:56.0055 3756 sym_u3 - ok 22:57:56.0165 3756 SynTP (f05fc946694a4a0682c8cf035ae687a0) C:\WINDOWS\system32\DRIVERS\SynTP.sys 22:57:56.0215 3756 SynTP - ok 22:57:56.0295 3756 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 22:57:56.0516 3756 sysaudio - ok 22:57:56.0676 3756 Tcpip (5ae1c2695f6523ad98b948f2887d8c5e) C:\WINDOWS\system32\DRIVERS\tcpip.sys 22:57:56.0756 3756 Tcpip ( UnsignedFile.Multi.Generic ) - warning 22:57:56.0756 3756 Tcpip - detected UnsignedFile.Multi.Generic (1) 22:57:57.0026 3756 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 22:57:57.0347 3756 TDPIPE - ok 22:57:57.0417 3756 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 22:57:57.0607 3756 TDTCP - ok 22:57:57.0868 3756 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 22:57:58.0098 3756 TermDD - ok 22:57:58.0148 3756 TosIde - ok 22:57:58.0208 3756 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 22:57:58.0368 3756 Udfs - ok 22:57:58.0388 3756 ultra - ok 22:57:58.0468 3756 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 22:57:58.0679 3756 Update - ok 22:57:58.0889 3756 usbehci (152ee0baa614388273a0b9ae9c9fd5a0) C:\WINDOWS\system32\DRIVERS\usbehci.sys 22:57:58.0949 3756 usbehci - ok 22:57:59.0029 3756 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 22:57:59.0240 3756 usbhub - ok 22:57:59.0290 3756 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 22:57:59.0530 3756 USBSTOR - ok 22:57:59.0610 3756 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 22:57:59.0911 3756 usbuhci - ok 22:58:00.0091 3756 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 22:58:00.0251 3756 VgaSave - ok 22:58:00.0291 3756 ViaIde - ok 22:58:00.0331 3756 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 22:58:00.0511 3756 VolSnap - ok 22:58:00.0882 3756 w29n51 (68eb5bc07781a36a63633541c11e1ad6) C:\WINDOWS\system32\DRIVERS\w29n51.sys 22:58:01.0272 3756 w29n51 - ok 22:58:01.0393 3756 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 22:58:01.0793 3756 Wanarp - ok 22:58:02.0014 3756 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys 22:58:02.0074 3756 Wdf01000 - ok 22:58:02.0144 3756 WDICA - ok 22:58:02.0234 3756 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 22:58:02.0444 3756 wdmaud - ok 22:58:02.0845 3756 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys 22:58:02.0945 3756 WpdUsb - ok 22:58:03.0055 3756 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys 22:58:03.0375 3756 WS2IFSL - ok 22:58:03.0496 3756 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 22:58:03.0526 3756 WudfPf - ok 22:58:03.0636 3756 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 22:58:03.0666 3756 WudfRd - ok 22:58:03.0936 3756 {6080A529-897E-4629-A488-ABA0C29B635E} (61002db7b6efb5711685b9d79b8e8ce6) C:\WINDOWS\system32\drivers\ialmsbw.sys 22:58:04.0036 3756 {6080A529-897E-4629-A488-ABA0C29B635E} - ok 22:58:04.0147 3756 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} (35ce2baa708ea038ab72359de87bab87) C:\WINDOWS\system32\drivers\ialmkchw.sys 22:58:04.0247 3756 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} - ok 22:58:04.0307 3756 {E6759E0C-470B-44DC-A4A1-627E68BB3A85} (255a0b9c167f3390dc940bb407a1d5d0) C:\WINDOWS\system32\drivers\A302.sys 22:58:04.0537 3756 {E6759E0C-470B-44DC-A4A1-627E68BB3A85} - ok 22:58:04.0557 3756 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0 22:58:05.0028 3756 \Device\Harddisk0\DR0 - ok 22:58:05.0038 3756 Boot (0x1200) (2ccd6ead7e4630091e8ec4eaa3a3f520) \Device\Harddisk0\DR0\Partition0 22:58:05.0038 3756 \Device\Harddisk0\DR0\Partition0 - ok 22:58:05.0038 3756 Boot (0x1200) (6541b9a6eea8ab21272c91423feae30e) \Device\Harddisk0\DR0\Partition1 22:58:05.0048 3756 \Device\Harddisk0\DR0\Partition1 - ok 22:58:05.0048 3756 ============================================================ 22:58:05.0048 3756 Scan finished 22:58:05.0048 3756 ============================================================ 22:58:05.0228 3440 Detected object count: 4 22:58:05.0228 3440 Actual detected object count: 4 22:58:38.0326 3440 LMPC2 ( UnsignedFile.Multi.Generic ) - skipped by user 22:58:38.0326 3440 LMPC2 ( UnsignedFile.Multi.Generic ) - User select action: Skip 22:58:38.0346 3440 Serial ( UnsignedFile.Multi.Generic ) - skipped by user 22:58:38.0346 3440 Serial ( UnsignedFile.Multi.Generic ) - User select action: Skip 22:58:38.0346 3440 sptd ( LockedFile.Multi.Generic ) - skipped by user 22:58:38.0346 3440 sptd ( LockedFile.Multi.Generic ) - User select action: Skip 22:58:38.0366 3440 Tcpip ( UnsignedFile.Multi.Generic ) - skipped by user 22:58:38.0366 3440 Tcpip ( UnsignedFile.Multi.Generic ) - User select action: Skip 22:59:00.0277 2300 Deinitialize success

Сега разбрах, че нямам звук.. D:/ SystemInfomationsIpemVolume тази икона ми се появи и тя води до Control Panel всичко ми е на макс. и пак нямам звук, защо се получава така ? ПП : Оправих го в Volume Control - Wave беше без звук и го оправих..

Редактирано 28 декември 201114 г. от powerful (преглед на промените)

О.К. Имаме още малко работа, трябва да направим малко проверки.

Изтеглете Farbar Service Scanner и стартирайте FSS.exe

• Натиснете бутона Scan
• В папката, където стартирахте FSS.exe ще се създаде лог файл с име FSS.txt
• Копирайте съдържанието на лог файла в следващия си коментар

Farbar Service Scanner Ran by user (administrator) on 28-12-2011 at 10:25:31 Microsoft Windows XP Professional Service Pack 3 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Yahoo IP is accessible. File Check: ======== C:\WINDOWS\system32\dhcpcsvc.dll [2009-01-08 21:06] - [2009-01-08 21:06] - 0126976 ____A (Microsoft Corporation) C51DE19619D50CBD03708647ACA10E70 C:\WINDOWS\system32\Drivers\afd.sys [2009-01-08 21:06] - [2009-01-08 21:06] - 0138496 ____A (Microsoft Corporation) 38D7B715504DA4741DF35E3594FE2099 C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit C:\WINDOWS\system32\Drivers\tcpip.sys [2009-01-08 22:12] - [2009-01-08 22:12] - 0361600 ____A (Microsoft Corporation) 5AE1C2695F6523AD98B948F2887D8C5E C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit C:\WINDOWS\system32\svchost.exe => MD5 is legit C:\WINDOWS\system32\rpcss.dll => MD5 is legit C:\WINDOWS\system32\services.exe => MD5 is legit Extra List: ======= aswTdi(9) Gpc(4) IPSec(6) irda(3) NetBT(7) PSched(8) Tcpip(5) 0x09000000060000000100000002000000030000000400000005000000090000000700000008000000 **** End of log ****

Има още малко за триене. Затова:

• Изтеглете OTМ.exe и го запазете на десктопа.
• Стартирайте ОТМ с двукратен клик на мишката (за Vista/Windows 7 - десен клик на файла и Run As Administrator).
• Маркирайте следната текстова информация (само това, което е поставено в карето) и я копирайте с десен клик - Copy (Копирай). Може да използвате Ctrl+C:

  :Files
  c:\documents and settings\user\Local Settings\Application Data\4e968e86
  
  :Commands
  [purity]
  [emptytemp]
  [Reboot]
  

• Отидете отново на стартирания OTM и с десен клик в Paste Instructions for Items to be Moved (под жълтата лента) и изберете Paste (Постави).
• Натиснете маркираният в червено бутон Moveit!.
• Изчакайте програмата да завърши работата си. Маркирайте и копирайте с десен клик Copy (Копирай или Ctrl+С) изцяло текста, който ще се появи под сивата лента.
• Публикувайте копирания текст с Paste (постави) в следващия си коментар.
• Затворете OTM.

Забележка: Ако OTM изисква рестарт, изберете Yes. След рестарта отворете Notepad (Start-> All Programs -> Accessories -> Notepad) изберете File->Open, после в File Name въведете *.log и отидете в папка C:\_OTM\MovedFiles и отворете последния генериран файл с разширение log (mmddyyyy_hhmmss.log - тук mm е месец, dd - ден, yyyy - година, hh - час, mm - минута и ss - секунда). Маркирайте и копирайте с десен клик Copy (Копирай или Ctrl+С) изцяло текста, който се съдържа в този файл. Публикувайте копирания текст с Paste (Постави) в следващия си коментар.

All processes killed ========== FILES ========== c:\documents and settings\user\Local Settings\Application Data\4e968e86\U folder moved successfully. c:\documents and settings\user\Local Settings\Application Data\4e968e86 folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->FireFox cache emptied: 29710612 bytes ->Flash cache emptied: 914 bytes User: Administrator.MARTATA ->Temporary Internet Files folder emptied: 95641 bytes User: Administrator.MARTATA.000 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Administrator.MARTATA.001 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 78991 bytes ->FireFox cache emptied: 68695257 bytes ->Flash cache emptied: 2263 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: Guest ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: user ->Temp folder emptied: 59181 bytes ->Temporary Internet Files folder emptied: 111826 bytes ->Java cache emptied: 33769 bytes ->FireFox cache emptied: 2222442188 bytes ->Opera cache emptied: 10313845 bytes ->Flash cache emptied: 6402 bytes %systemdrive% .tmp files removed: 5858947 bytes %systemroot% .tmp files removed: 2402044 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 32768 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 2 232.00 mb OTM by OldTimer - Version 3.1.19.0 log created on 12282011_111907 Files moved on Reboot... File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot. C:\WINDOWS\temp\Perflib_Perfdata_1b0.dat moved successfully. Registry entries deleted on Reboot...

Следвайте последователно ето това, стъпка по стъпка:

Стъпка 1

Стартирайте Windows бутона + R (за да стартирате RUN прозореца).

С Copy/Paste въведете следната команда, маркирана в синьо:

Combofix /Uninstall

(има празно място между Combofix и /Uninstall).

Натиснете Enter => това ще деинсталира Combofix и ще изтрие всички файлове и папки асоциирани с инструмента.

Ще занули и старите System Restore точки.

Стартирайте и OTM.exe и натиснете бутона CleanUp!

Това ще почисти всички използвани от нас инструменти, лог файлове и папки и накрая ще се самоизтрие.

Стъпка 2

Имате липсващи системни файлове и такива с малко кофти MD5, също така Windows XP, моднат с nLite. Затова изтеглете Service Pack 3 за Windows XP от тук (316 МВ) и стартирайте файла WindowsXP-KB936929-SP3-x86-ENU.exe

Тази инсталация ще замести някои файлове и ще инсталира липсващите. След като инсталирате SP3, пуснете отново Farbar Service Scanner и копирайте съдържанието на FSS.txt в следващия си коментар.

C:\windows\system32\drivers\serial.sys Троянски кон Аваста ми изписва че не може да обработи файла..и само ми се появява.. да направя ли рестарт и да изключа антивирусната или да направя рестарт и да ми даде друг файл защото този е заразен ?

Редактирано 28 декември 201114 г. от powerful (преглед на промените)

Според мен Service Pack 3 ще замести файла, както и другите, които са повредени. Ще го оправим, ако не стане със SP3.

Farbar Service Scanner Ran by user (administrator) on 28-12-2011 at 15:20:58 Microsoft Windows XP Professional Service Pack 3 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Yahoo IP is accessible. File Check: ======== C:\WINDOWS\system32\dhcpcsvc.dll [2009-01-08 21:06] - [2009-01-08 21:06] - 0126976 ____A (Microsoft Corporation) C51DE19619D50CBD03708647ACA10E70 C:\WINDOWS\system32\Drivers\afd.sys [2009-01-08 21:06] - [2009-01-08 21:06] - 0138496 ____A (Microsoft Corporation) 38D7B715504DA4741DF35E3594FE2099 C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit C:\WINDOWS\system32\Drivers\tcpip.sys [2009-01-08 22:12] - [2009-01-08 22:12] - 0361600 ____A (Microsoft Corporation) 5AE1C2695F6523AD98B948F2887D8C5E C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit C:\WINDOWS\system32\svchost.exe => MD5 is legit C:\WINDOWS\system32\rpcss.dll => MD5 is legit C:\WINDOWS\system32\services.exe => MD5 is legit Extra List: ======= aswTdi(9) Gpc(4) IPSec(6) irda(3) NetBT(7) PSched(8) Tcpip(5) 0x09000000060000000100000002000000030000000400000005000000090000000700000008000000 **** End of log ****

Инсталиран ли е SP3 от линка, който дадох?