Съмнение за вирус [РЕШЕН]

25 януари 201214 г.

Здравейте значи от известно време компютъра ми работи адски бавно най вече когато съм в интернет. Правил съм проверка с Ad-Aware Pro и в момента съм с нея за постоянна защита но тя открива само Cookies никакви по сериозни заплахи. Ето малко полезна информация за компютъра. Microsoft Windows XP Professional 32-bit Sp3 2002 AAWService.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe AAWTray.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe cidaemon.exe C:\WINDOWS\system32\cidaemon.exe cisvc.exe C:\WINDOWS\system32\cisvc.exe ctfmon.exe C:\WINDOWS\system32\ctfmon.exe DTAgent.exe C:\Program Files\DAEMON Tools Pro\DTAgent.exe DTShellHlp.exe C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe everest.exe C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe Explorer.EXE C:\WINDOWS\Explorer.EXE firefox.exe C:\Program Files\Mozilla Firefox\firefox.exе FType2K.exe C:\Program Files\Datecs\FlexType 2K\FType2K.exe lsass.exe C:\WINDOWS\system32\lsass.exe nvsvc32.exe C:\WINDOWS\system32\nvsvc32.exe oodag.exe C:\Program Files\OO Software\Defrag\oodag.exe oodtray.exe C:\Program Files\OO Software\Defrag\oodtray.exe plugin-container.exe C:\Program Files\Mozilla Firefox\plugin-container.exe RTHDCPL.EXE C:\WINDOWS\RTHDCPL.EXE RunDLL32.exe C:\WINDOWS\system32\RunDLL32.exe SeaPort.EXE C:\Program Files\Microsoft\BingBar\SeaPort.EXE services.exe C:\WINDOWS\system32\services.exe smss.exe C:\WINDOWS\System32\smss.exe spoolsv.exe C:\WINDOWS\system32\spoolsv.exe sqlwriter.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe StartManSvc.exe C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe svchost.exe C:\WINDOWS\system32\svchost.exe svchost.exe C:\WINDOWS\System32\svchost.exe svchost.exe C:\WINDOWS\System32\svchost.exe uTorrent.exe C:\Program Files\uTorrent\uTorrent.exe winlogon.exe C:\WINDOWS\system32\winlogon.exe wmplayer.exe C:\Program Files\Windows Media Player\wmplayer.exe CPU - Intel Pentium E2180 @ 2.00GHz 29 °C Conroe 65nm Technology RAM - 2.00 ГБ Single-Channel DDR2 @ 399MHz Motherboard - ASUSTeK Computer INC. P5KPL (Socket 775) 31 °C Video - 1024MB GeForce 9400 GT (CardExpert Technology) 66 °C NEC FE791SB (1024x768@60Hz) Hard Drives - 244GB ExcelStor Technology J9250S (SATA) 32 °C Audio - Realtek High Definition Audio

Редактирано 25 януари 201214 г. от Em0_TyoN (преглед на промените)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

25 януари 201214 г.

Здравейте..!

Моля прочетете внимателно и направете сканирането от тази тема:Системата ми е инфектирана - Какво да правя сега? Очаквам дневниците за анализ....!

25 януари 201214 г.

Автор

. DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 Run by User at 20:44:33 on 2012-01-25 Microsoft Windows XP Professional 5.1.2600.3.1251.1.1033.18.2047.1064 [GMT 2:00] . AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33} . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft\BingBar\SeaPort.EXE C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\OO Software\Defrag\oodtray.exe C:\Program Files\OO Software\Defrag\oodag.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Pro\DTAgent.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe svchost.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe C:\Program Files\Datecs\FlexType 2K\FType2K.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ uURLSearchHooks: Winamp Toolbar Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll mURLSearchHooks: Winamp Toolbar Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Winamp Toolbar Loader: {25cee8ec-5730-41bc-8b58-22ddc8ab8c20} - c:\program files\winamp toolbar\winamptb.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll" TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll" TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [DAEMON Tools Pro Agent] "c:\program files\daemon tools pro\DTAgent.exe" -autorun uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe" /MINIMIZED mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [RTHDCPL] RTHDCPL.EXE mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet mRun: [<NO NAME>] mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [OODefragTray] c:\program files\oo software\defrag\oodtray.exe dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~2.lnk - c:\program files\adobe\reader 8.0\reader\AdobeCollabSync.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\flexty~1.lnk - c:\program files\datecs\flextype 2k\FType2K.exe uPolicies-explorer: NoInstrumentation = 1 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1327192801484 DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: Interfaces\{90E4FBCD-033A-4CF7-8FFC-076E136323D1} : NameServer = 192.168.15.9,195.24.48.5 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll LSA: Authentication Packages = msv1_0 nwprovau . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\user\application data\mozilla\firefox\profiles\27pxir0q.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - www.Google.com FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B645a7e85-a57a-4321-a416-b3489c7296de%7D&mid=d556aff27beb47d18276d1568051330c-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&ds=AVG&v=9.0.0.23&lang=en&pr=fr&d=2012-01-23%2017%3A48%3A54&sap=ku&q= FF - prefs.js: network.proxy.type - 4 FF - component: c:\program files\mozilla firefox\extensions\[email protected]\components\qfaservices.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll . ---- FIREFOX POLICIES ---- FF - user.js: network.protocol-handler.warn-external.dnupdate - false FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . ============= SERVICES / DRIVERS =============== . R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2012-1-23 64512] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2012-1-22 232512] R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [2012-1-23 21592] R2 BBUpdate;BBUpdate;c:\program files\microsoft\bingbar\SeaPort.EXE [2011-10-13 249648] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2011-8-27 2152152] R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2012-1-22 2253120] R2 OODefragAgent;O&O Defrag Agent;c:\program files\oo software\defrag\oodag.exe [2011-11-17 2489680] R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2012-1-22 793056] R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2012-1-23 74968] R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [2012-1-21 37376] R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2011-8-27 15232] S2 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-10-21 196176] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2012-1-21 1684736] S3 DMDefragService;PC Tools Performance Toolkit Defrag Service;c:\program files\pc tools\pc tools utilities\tools\defrag\DMDefragSrv.exe [2012-1-22 1038304] S3 DMRepairService;PC Tools Performance Toolkit Repair Service;c:\program files\pc tools\pc tools utilities\tools\repair\DMRepairSrv.exe [2012-1-22 1030112] S3 PCTDMDefrag;PCTDMDefrag;c:\windows\system32\drivers\PCTDMDefrag.sys [2012-1-22 108864] S3 PCTDSMon;PCTDSMon;c:\windows\system32\drivers\PCTDSMon.sys [2012-1-22 128120] S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2012-1-22 27064] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-3 14336] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2008-7-10 47128] S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [2008-7-10 242712] S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2008-7-10 369688] . =============== Created Last 30 ================ . 2012-01-25 18:26:10 -------- d-----w- c:\program files\Speccy 2012-01-25 17:45:17 -------- d-----w- c:\program files\Lavalys 2012-01-25 10:55:21 724992 ----a-w- c:\program files\common files\installshield\professional\runtime\09\00\intel32\iKernel.dll 2012-01-25 10:55:21 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\09\00\intel32\ctor.dll 2012-01-25 10:55:21 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\09\00\intel32\DotNetInstaller.exe 2012-01-25 10:55:21 266240 ----a-w- c:\program files\common files\installshield\professional\runtime\09\00\intel32\iscript.dll 2012-01-25 10:55:21 192512 ----a-w- c:\program files\common files\installshield\professional\runtime\09\00\intel32\iuser.dll 2012-01-25 10:54:56 184452 ----a-w- c:\program files\common files\installshield\professional\runtime\09\00\intel32\iGdi.dll 2012-01-25 10:54:55 311428 ----a-w- c:\program files\common files\installshield\professional\runtime\09\00\intel32\Setup.dll 2012-01-25 09:35:49 -------- d-----w- c:\documents and settings\all users\application data\MFAData 2012-01-25 07:33:57 -------- d-----w- c:\windows\SxsCaPendDel 2012-01-25 07:04:08 749568 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\iKernel.dll 2012-01-25 07:04:08 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\ctor.dll 2012-01-25 07:04:08 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\DotNetInstaller.exe 2012-01-25 07:04:08 274432 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\iscript.dll 2012-01-25 07:04:08 180224 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\iuser.dll 2012-01-25 07:04:06 323716 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\setup.dll 2012-01-25 07:04:06 192644 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\iGdi.dll 2012-01-24 20:21:49 -------- d-----w- c:\documents and settings\user\application data\TuneUp Software 2012-01-24 20:20:43 -------- d-----w- c:\documents and settings\all users\application data\TuneUp Software 2012-01-24 20:20:19 -------- d-sh--w- c:\documents and settings\all users\application data\{32364CEA-7855-4A3C-B674-53D8E9B97936} 2012-01-24 19:54:49 -------- d-----w- c:\program files\OO Software 2012-01-24 19:53:45 -------- d-----w- c:\windows\system32\oodag 2012-01-24 19:51:54 -------- d-----w- c:\documents and settings\user\local settings\application data\O&O 2012-01-24 19:50:42 -------- d-----w- c:\documents and settings\user\local settings\application data\Downloaded Installations 2012-01-24 15:31:03 193824 ----a-w- c:\documents and settings\all users\application data\microsoft\vbexpress\9.0\1033\ResourceCache.dll 2012-01-24 14:07:28 50200 ----a-w- c:\windows\system32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.0.1600.22.dll 2012-01-24 14:07:01 79896 ----a-w- c:\windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.0.1600.22.dll 2012-01-24 14:06:04 -------- d-----w- c:\windows\system32\RsFx 2012-01-24 14:05:06 -------- d-----w- c:\program files\MSXML 6.0 2012-01-24 13:56:14 -------- d-----w- c:\program files\Microsoft SQL Server 2012-01-24 13:55:41 112640 ----a-w- c:\documents and settings\all users\application data\microsoft\vcexpress\9.0\1033\ResourceCache.dll 2012-01-24 13:55:11 416 ----a-w- c:\documents and settings\all users\application data\microsoft\msdn\9.0\1033\ResourceCache.dll 2012-01-24 11:50:01 65032 ----a-w- c:\windows\system32\XAPOFX1_0.dll 2012-01-24 11:50:01 507400 ----a-w- c:\windows\system32\XAudio2_1.dll 2012-01-24 11:50:00 238088 ----a-w- c:\windows\system32\xactengine3_1.dll 2012-01-24 11:22:38 98304 ----a-w- c:\windows\system32\CmdLineExt.dll 2012-01-23 19:27:40 -------- d-----w- c:\documents and settings\user\application data\NVIDIA 2012-01-23 18:40:05 16432 ----a-w- c:\windows\system32\lsdelete.exe 2012-01-23 18:35:26 74968 ----a-w- c:\windows\system32\drivers\sbapifs.sys 2012-01-23 18:35:25 21592 ----a-w- c:\windows\system32\drivers\sbaphd.sys 2012-01-23 18:33:03 -------- d-----w- c:\documents and settings\user\local settings\application data\Sunbelt Software 2012-01-23 18:32:23 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys 2012-01-23 18:28:41 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys 2012-01-23 18:28:35 -------- d-----w- c:\program files\Lavasoft 2012-01-23 18:00:31 -------- d-----w- c:\documents and settings\user\application data\PC Tools Performance Toolkit 2012-01-23 16:18:04 -------- d--h--w- C:\$AVG 2012-01-23 15:51:49 -------- d-----w- c:\documents and settings\user\application data\AVG2012 2012-01-23 15:39:54 -------- d--h--w- c:\documents and settings\all users\application data\Common Files 2012-01-23 06:55:02 -------- d-----w- c:\documents and settings\user\local settings\application data\AskToolbar 2012-01-23 06:53:28 -------- d-----w- c:\program files\The KMPlayer 2012-01-22 22:03:40 16736 ----a-w- c:\windows\system32\mucltui.dll.mui 2012-01-22 22:03:38 274288 ----a-w- c:\windows\system32\mucltui.dll 2012-01-22 21:05:16 -------- d-----w- c:\documents and settings\user\application data\f-secure 2012-01-22 20:59:30 476904 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll 2012-01-22 20:59:30 472808 ----a-w- c:\windows\system32\deployJava1.dll 2012-01-22 20:32:28 -------- d-----w- c:\documents and settings\user\application data\QuickScan 2012-01-22 16:49:50 -------- d-----w- C:\NVIDIA 2012-01-22 15:56:50 -------- d-----w- c:\windows\system32\winrm 2012-01-22 15:56:47 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$ 2012-01-22 15:50:00 -------- d-----w- c:\documents and settings\user\local settings\application data\ApplicationHistory 2012-01-22 15:35:13 -------- d-----w- c:\documents and settings\user\application data\Windows Search 2012-01-22 12:42:01 -------- d-----w- c:\program files\NVIDIA Corporation 2012-01-22 12:41:30 -------- d-----w- c:\documents and settings\user\Tracing 2012-01-22 12:40:28 -------- d-----w- c:\program files\Microsoft Office Outlook Connector 2012-01-22 12:38:53 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll 2012-01-22 12:37:30 -------- d-----w- c:\program files\Microsoft 2012-01-22 12:37:12 -------- d-----w- c:\program files\Windows Live SkyDrive 2012-01-22 12:36:26 4927864 ----a-w- c:\program files\common files\windows live\.cache\7557c4b01ccd902\Silverlight.2.0.exe 2012-01-22 12:35:06 74520 ----a-w- c:\program files\common files\windows live\.cache\45a8bcb01ccd902\DSETUP.dll 2012-01-22 12:35:06 484632 ----a-w- c:\program files\common files\windows live\.cache\45a8bcb01ccd902\DXSETUP.exe 2012-01-22 12:35:06 1670936 ----a-w- c:\program files\common files\windows live\.cache\45a8bcb01ccd902\dsetup32.dll 2012-01-22 12:34:53 1013800 ----a-w- c:\program files\common files\windows live\.cache\3df7664c1ccd902\WindowsXP-KB954708-x86-ENU.exe 2012-01-22 12:31:08 -------- d-----w- c:\program files\common files\Windows Live 2012-01-22 12:25:54 -------- d-----w- c:\windows\system32\XPSViewer 2012-01-22 12:25:31 89088 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll 2012-01-22 12:25:17 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2012-01-22 12:25:17 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2012-01-22 12:25:17 597504 ------w- c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe 2012-01-22 12:25:17 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll 2012-01-22 12:25:17 575488 ------w- c:\windows\system32\xpsshhdr.dll 2012-01-22 12:25:17 117760 ------w- c:\windows\system32\prntvpt.dll 2012-01-22 12:25:16 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll 2012-01-22 12:25:16 1676288 ------w- c:\windows\system32\xpssvcs.dll 2012-01-22 12:20:39 -------- d-----w- c:\documents and settings\user\local settings\application data\Identities 2012-01-22 12:20:11 -------- d-----w- c:\program files\Windows Desktop Search 2012-01-22 12:20:10 -------- d-----w- c:\windows\system32\GroupPolicy 2012-01-22 12:19:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll 2012-01-22 12:19:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll 2012-01-22 12:19:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll 2012-01-22 12:17:50 -------- d-----w- c:\windows\system32\URTTEMP 2012-01-22 12:17:13 6144 -c----w- c:\windows\system32\dllcache\iecompat.dll 2012-01-22 09:49:30 -------- d-----w- c:\documents and settings\user\local settings\application data\Winamp Toolbar 2012-01-22 09:48:51 -------- d--h--w- c:\program files\Phyxion.net 2012-01-22 09:25:28 -------- d-----w- c:\documents and settings\user\DoctorWeb 2012-01-22 08:18:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll 2012-01-22 08:18:05 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll 2012-01-22 08:18:00 -------- d-----w- c:\windows\Logs 2012-01-22 08:16:49 -------- d-----w- c:\program files\Winamp Toolbar 2012-01-22 08:16:49 -------- d-----w- c:\documents and settings\all users\application data\Winamp Toolbar 2012-01-22 08:16:40 -------- d-----w- c:\program files\common files\Software Update Utility 2012-01-22 08:16:37 819200 ----a-w- c:\program files\windows media player\wmsetsdk.exe 2012-01-22 08:16:37 47616 ----a-w- c:\program files\windows media player\msoobci.dll 2012-01-22 08:16:11 -------- d-----w- c:\windows\RegisteredPackages 2012-01-22 08:15:41 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys 2012-01-22 08:15:41 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys 2012-01-22 08:15:41 59888 ------w- c:\windows\system32\pxwma.dll 2012-01-22 08:15:41 133616 ------w- c:\windows\system32\pxafs.dll 2012-01-22 08:15:41 126448 ------w- c:\windows\system32\pxinsi64.exe 2012-01-22 08:15:41 123888 ------w- c:\windows\system32\pxcpyi64.exe 2012-01-22 07:15:38 -------- d--h--w- c:\program files\MSXML 4.0 2012-01-22 06:17:15 -------- d-----w- c:\program files\Conduit 2012-01-22 06:13:05 -------- d-----w- c:\program files\uTorrent 2012-01-22 06:12:25 -------- d-----w- c:\documents and settings\user\application data\uTorrent 2012-01-22 06:03:53 -------- d-----w- c:\documents and settings\user\local settings\application data\VS Revo Group 2012-01-22 06:03:14 27064 ----a-w- c:\windows\system32\drivers\revoflt.sys 2012-01-22 06:03:11 -------- d-----w- c:\program files\VS Revo Group 2012-01-22 04:03:02 -------- d-----w- c:\documents and settings\user\local settings\application data\Norman Malware Cleaner 2012-01-22 02:40:10 -------- d-----w- c:\documents and settings\user\application data\SUPERAntiSpyware.com 2012-01-22 02:39:52 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll 2012-01-22 02:39:51 978944 -c----w- c:\windows\system32\dllcache\mfc42.dll 2012-01-22 02:39:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll 2012-01-22 02:38:25 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys 2012-01-22 02:36:40 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys 2012-01-22 02:36:38 105472 -c----w- c:\windows\system32\dllcache\mup.sys 2012-01-22 02:33:55 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys 2012-01-22 02:33:19 -------- d-sh--w- c:\documents and settings\user\IECompatCache 2012-01-22 02:31:36 -------- d-sh--w- c:\documents and settings\user\PrivacIE 2012-01-22 02:31:35 45568 -c----w- c:\windows\system32\dllcache\wab.exe 2012-01-22 01:53:19 -------- d-----w- c:\documents and settings\user\application data\Malwarebytes 2012-01-22 01:51:56 -------- d-sh--w- c:\documents and settings\user\IETldCache 2012-01-22 01:49:43 -------- d-----w- c:\windows\system32\scripting 2012-01-22 01:49:43 -------- d-----w- c:\windows\l2schemas 2012-01-22 01:49:42 -------- d-----w- c:\windows\system32\en 2012-01-22 01:49:42 -------- d-----w- c:\windows\system32\bits 2012-01-22 01:40:07 443448 ------w- c:\windows\system32\drivers\sptd.sys 2012-01-22 01:37:19 232512 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2012-01-22 01:37:07 -------- d-----w- c:\program files\DAEMON Tools Pro 2012-01-22 01:36:40 -------- d-----w- c:\documents and settings\user\application data\DAEMON Tools Pro 2012-01-22 01:36:40 -------- d-----w- c:\documents and settings\all users\application data\DAEMON Tools Pro 2012-01-22 01:28:49 -------- d-----w- c:\windows\ie8updates 2012-01-22 01:28:23 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll 2012-01-22 01:28:23 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2012-01-22 01:28:23 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2012-01-22 01:26:36 -------- dc-h--w- c:\windows\ie8 2012-01-22 01:26:36 -------- d-----w- c:\windows\system32\bg-BG 2012-01-22 01:22:59 452736 ------w- c:\windows\system32\drivers\mtxparhm.sys 2012-01-22 01:06:46 -------- d-----r- c:\program files\Skype 2012-01-22 01:03:25 -------- d-----w- c:\windows\ServicePackFiles 2012-01-22 00:58:07 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe 2012-01-22 00:57:01 293376 ------w- c:\windows\system32\browserchoice.exe 2012-01-22 00:55:48 456320 -c----w- c:\windows\system32\dllcache\mrxsmb.sys 2012-01-22 00:55:32 357888 -c----w- c:\windows\system32\dllcache\srv.sys 2012-01-22 00:53:59 -------- d-----w- c:\documents and settings\all users\application data\PC Tools 2012-01-22 00:53:57 -------- d-----w- c:\documents and settings\user\application data\Product_PT 2012-01-22 00:48:35 272128 -c----w- c:\windows\system32\dllcache\bthport.sys 2012-01-22 00:48:35 272128 ------w- c:\windows\system32\drivers\bthport.sys 2012-01-22 00:48:32 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys 2012-01-22 00:44:53 -------- d-----w- c:\windows\system32\PreInstall 2012-01-22 00:21:00 -------- d-----w- c:\program files\Defraggler 2012-01-22 00:18:54 -------- d-----w- c:\program files\CCleaner 2012-01-21 23:50:19 -------- d-----w- c:\documents and settings\user\local settings\application data\Temp 2012-01-21 23:50:00 -------- d-----w- c:\documents and settings\user\local settings\application data\Google 2012-01-21 19:07:46 -------- d-s---w- c:\windows\system32\Microsoft 2012-01-21 19:00:59 70144 -c--a-w- c:\windows\system32\dllcache\pintlphr.exe . ==================== Find3M ==================== . 2012-01-22 16:51:25 285176 ----a-w- c:\windows\system32\nvdrsdb0.bin 2012-01-22 16:51:25 1 ----a-w- c:\windows\system32\nvdrssel.bin 2012-01-22 16:51:20 285176 ----a-w- c:\windows\system32\nvdrsdb1.bin 2012-01-21 23:59:53 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-12-12 10:17:34 128120 ----a-w- c:\windows\system32\drivers\PCTDSMon.sys 2011-12-12 10:17:28 108864 ----a-w- c:\windows\system32\drivers\PCTDMDefrag.sys 2011-12-12 10:16:44 37344 ----a-w- c:\windows\system32\CleanMFT32.exe 2011-11-25 21:57:19 293376 ----a-w- c:\windows\system32\winsrv.dll 2011-11-23 13:25:32 1859584 ----a-w- c:\windows\system32\win32k.sys 2011-11-18 12:35:08 60416 ----a-w- c:\windows\system32\packager.exe 2011-11-17 16:18:18 1630544 ----a-w- c:\windows\system32\ooscrsav.scr 2011-11-17 16:17:12 277328 ----a-w- c:\windows\system32\oodbs.exe 2011-11-17 16:15:58 536400 ----a-w- c:\windows\system32\oodssrs.dll 2011-11-17 16:15:38 10064 ----a-w- c:\windows\system32\oodbsrs.dll 2011-11-16 14:21:44 354816 ----a-w- c:\windows\system32\winhttp.dll 2011-11-16 14:21:44 152064 ----a-w- c:\windows\system32\schannel.dll 2011-11-04 19:20:51 916992 ----a-w- c:\windows\system32\wininet.dll 2011-11-04 19:20:51 43520 ----a-w- c:\windows\system32\licmgr10.dll 2011-11-04 19:20:51 1469440 ------w- c:\windows\system32\inetcpl.cpl 2011-11-04 11:23:59 385024 ----a-w- c:\windows\system32\html.iec 2011-11-03 15:28:36 386048 ----a-w- c:\windows\system32\qdvd.dll 2011-11-03 15:28:36 1292288 ----a-w- c:\windows\system32\quartz.dll 2011-11-01 16:07:10 1288704 ----a-w- c:\windows\system32\ole32.dll 2011-10-28 05:31:48 33280 ----a-w- c:\windows\system32\csrsrv.dll . ============= FINISH: 20:46:05.70 ===============

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

25 януари 201214 г.

Ехе ...доста остатъци от антивирусни програми....!Използвайте тази програма за да премахнете всичко:

Изтеглете AppRemover и го запазете на вашия десктоп.

Стартирате програмата:

Next >> Уверете се ще е маркиран "Remove Security Application"

Next >> AppRemover ще сканира всички приложения, свързани със сигурността на вашия компютър.

Маркирайте всички приложения които са излишни и си оставете само действащите...и кликате Next>> два пъти.

Следвайте допълнителните инструкциите на екрана. Ако поиска рестарт, моля направете го.

Освен това не виждам втория лог от програмата DDS - Attach.txt..?

25 януари 201214 г.

Автор

Ехе ...доста остатъци от антивирусни програми....!Използвайте тази програма за да премахнете всичко:

Изтеглете AppRemover и го запазете на вашия десктоп.

Стартирате програмата:

Next >> Уверете се ще е маркиран "Remove Security Application"

Next >> AppRemover ще сканира всички приложения, свързани със сигурността на вашия компютър.

Маркирайте всички приложения които са излишни и си оставете само действащите...и кликате Next>> два пъти.

Следвайте допълнителните инструкциите на екрана. Ако поиска рестарт, моля направете го.

Освен това не виждам втория лог от програмата DDS - Attach.txt..?

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 1/21/2012 9:01:23 PM

System Uptime: 1/25/2012 2:24:41 PM (7 hours ago)

.

Motherboard: ASUSTeK Computer INC. | | P5KPL

Processor: Intel® Pentium® Dual CPU E2180 @ 2.00GHz | Socket 775 | 1999/200mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 117 GiB total, 68.925 GiB free.

D: is FIXED (NTFS) - 100 GiB total, 95.119 GiB free.

E: is FIXED (NTFS) - 15 GiB total, 11.021 GiB free.

F: is CDROM (UDF)

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: Realtek RTL8139/810x Family Fast Ethernet NIC

Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_813910EC&REV_10\4&CF81C54&0&10F0

Manufacturer: Realtek Semiconductor Corp.

Name: Realtek RTL8139/810x Family Fast Ethernet NIC

PNP Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_813910EC&REV_10\4&CF81C54&0&10F0

Service: RTL8023xp

.

Class GUID: {4D36E97D-E325-11CE-BFC1-08002BE10318}

Description:

Device ID: ACPI\ATK0110\1010110

Manufacturer: ATK

Name:

PNP Device ID: ACPI\ATK0110\1010110

Service:

.

==== System Restore Points ===================

.

RP96: 1/24/2012 10:21:24 PM - TuneUp Utilities 2012 е инсталиран

RP97: 1/25/2012 7:42:03 AM - Revo Uninstaller Pro's restore point - Counter-Strike 1.6

RP98: 1/25/2012 7:42:17 AM - Removed Counter-Strike 1.6

RP99: 1/25/2012 7:44:03 AM - Revo Uninstaller Pro's restore point - KMPlayer Toolbar Updater

RP100: 1/25/2012 7:45:10 AM - Revo Uninstaller Pro's restore point - GTA San Andreas

RP101: 1/25/2012 7:45:21 AM - Removed GTA San Andreas

RP102: 1/25/2012 7:46:54 AM - Revo Uninstaller Pro's restore point - GAMES

RP103: 1/25/2012 8:05:44 AM - Revo Uninstaller Pro's restore point - GTA San Andreas User Files

RP104: 1/25/2012 8:06:53 AM - Revo Uninstaller Pro's restore point - Euro Truck Simulator

RP105: 1/25/2012 9:05:49 AM - Installed GTA San Andreas

RP106: 1/25/2012 9:29:34 AM - Removed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

RP107: 1/25/2012 9:30:06 AM - Removed Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu

RP108: 1/25/2012 9:30:57 AM - Removed Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries

RP109: 1/25/2012 9:33:27 AM - Removed Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32

RP110: 1/25/2012 9:33:43 AM - Removed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

RP111: 1/25/2012 9:34:20 AM - Removed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

RP112: 1/25/2012 9:35:55 AM - Microsoft Visual C++ 2005 Redistributable е инсталиран

RP113: 1/25/2012 9:38:31 AM - Microsoft Visual C++ 2005 Redistributable е премахнат

RP114: 1/25/2012 10:57:33 AM - Removed Microsoft SQL Server 2005 Compact Edition [ENU]

RP115: 1/25/2012 10:58:11 AM - Removed Microsoft SQL Server Compact 3.5 SP1 Design Tools English

RP116: 1/25/2012 10:58:39 AM - Removed Microsoft SQL Server Compact 3.5 SP1 English

RP117: 1/25/2012 10:59:00 AM - Software Distribution Service 3.0

RP118: 1/25/2012 12:55:37 PM - Installed Counter-Strike 1.6

RP119: 1/25/2012 6:12:12 PM - Revo Uninstaller Pro's restore point - TuneUp Utilities 2012

RP120: 1/25/2012 6:12:54 PM - TuneUp Utilities 2012 е премахнат

RP121: 1/25/2012 6:13:26 PM - Removed TuneUp Utilities Language Pack (en-US)

.

==== Installed Programs ======================

.

П°єµт ·° µ·ёєѕІ ёЅтµрфµ№с Ѕ° Windows

50 FREE MP3s +1 Free Audiobook!

Ad-Aware

Adobe Flash Player 10 Plugin

Adobe Flash Player 11 ActiveX

Adobe Reader 8

Atheros Communications Inc.® L1 Gigabit Ethernet Driver

Bing Bar

CCleaner

Counter-Strike 1.6

DAEMON Tools Pro

Defraggler

Download Updater (AOL LLC)

EVEREST Ultimate Edition v5.50

FlexType 2K

GTA San Andreas

High Definition Audio Driver Package - KB888111

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Media Format SDK (KB902344)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB915800-v4)

Hotfix for Windows XP (KB942288-v3)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB954708)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB976002-v5)

Hotfix for Windows XP (KB981793)

K-Lite Codec Pack 5.4.0 (Full)

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2656353)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Base Smart Card Cryptographic Service Provider Package

Microsoft Choice Guard

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft National Language Support Downlevel APIs

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office Live Add-in 1.3

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook Connector

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft Software Update for Web Folders (English) 12

Microsoft SQL Server 2008

Microsoft SQL Server 2008 Browser

Microsoft SQL Server 2008 Common Files

Microsoft SQL Server 2008 Database Engine Services

Microsoft SQL Server 2008 Database Engine Shared

Microsoft SQL Server 2008 Management Objects

Microsoft SQL Server 2008 Native Client

Microsoft SQL Server 2008 RsFx Driver

Microsoft SQL Server 2008 Setup Support Files (English)

Microsoft SQL Server VSS Writer

Microsoft Sync Framework Runtime Native v1.0 (x86)

Microsoft Sync Framework Services Native v1.0 (x86)

Microsoft VC9 runtime libraries

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Mozilla Firefox 9.0.1 (x86 bg)

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 6.0 Parser (KB933579)

Nero 7 Premium

NVIDIA Control Panel 285.58

NVIDIA Graphics Driver 285.58

NVIDIA Install Application

NVIDIA nView 135.95

NVIDIA PhysX

NVIDIA PhysX System Software 9.11.0621

NVIDIA Update 1.5.20

NVIDIA Update Components

O&O Defrag Professional

PC Tools Performance Toolkit 2.0

PowerDVD

Realtek High Definition Audio Driver

Recuva

Revo Uninstaller Pro 2.5.7

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 7 (KB938127-v2)

Security Update for Windows Internet Explorer 7 (KB982381)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2618444)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player (KB979402)

Security Update for Windows Search 4 - KB963093

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB971961)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981349)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982665)

Segoe UI

Skype Click to Call

Skype™ 5.5

Speccy

Sql Server Customer Experience Improvement Program

SQL Server System CLR Types

The KMPlayer (remove only)

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596686) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition

Update for Microsoft Office Access 2007 Help (KB963663)

Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office Infopath 2007 Help (KB963662)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Publisher 2007 Help (KB963667)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Update for Windows Internet Explorer 8 (KB2598845)

Update for Windows Internet Explorer 8 (KB2632503)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2492386)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2641690)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB961503)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

WebFldrs XP

Winamp

Winamp Toolbar

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Internet Explorer 7

Windows Internet Explorer 8

Windows Live Communications Platform

Windows Live Photo Gallery

Windows Live Sign-in Assistant

Windows Live Sync

Windows Live Upload Tool

Windows Management Framework Core

Windows Media Format Runtime

Windows XP Service Pack 3

WinRAR 4.10 (32-±ётѕІ° Іµрсёя)

µTorrent

.

==== Event Viewer Messages From Past Week ========

.

1/22/2012 5:12:53 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

1/22/2012 3:02:59 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070652: П°єµт Microsoft Office 2007 Service Pack 2 (SP2).

1/22/2012 2:37:00 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC80.CRT. Reference error message: The referenced assembly is not installed on your system. .

1/22/2012 2:37:00 AM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\Mozilla Firefox\components\browsercomps.dll. Reference error message: The operation completed successfully. .

1/22/2012 2:37:00 AM, error: SideBySide [32] - Dependent Assembly Microsoft.VC80.CRT could not be found and Last Error was The referenced assembly is not installed on your system.

1/22/2012 2:35:29 AM, error: ipnathlp [30013] - The DHCP allocator has disabled itself on IP address 213.130.82.162, since the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses are being allocated to DHCP clients. To enable the DHCP allocator on this IP address, please change the scope to include the IP address, or change the IP address to fall within the scope.

1/22/2012 1:43:01 AM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

1/22/2012 1:42:43 AM, error: ipnathlp [31012] - The DNS proxy agent encountered an error while obtaining the local list of name-resolution servers. Some DNS or WINS servers may be inaccessible to clients on the local network. The data is the error code.

1/21/2012 8:58:27 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.nist.gov,0x1'. NtpClient will try the DNS lookup again in 120 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

1/21/2012 7:58:26 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.nist.gov,0x1'. NtpClient will try the DNS lookup again in 60 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

1/21/2012 7:28:26 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.nist.gov,0x1'. NtpClient will try the DNS lookup again in 30 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

1/21/2012 4:48:24 PM, error: ipnathlp [30013] - The DHCP allocator has disabled itself on IP address 10.0.0.20, since the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses are being allocated to DHCP clients. To enable the DHCP allocator on this IP address, please change the scope to include the IP address, or change the IP address to fall within the scope.

1/21/2012 4:31:49 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

1/21/2012 2:37:16 PM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.

1/21/2012 2:30:51 PM, error: ipnathlp [31008] - The DNS proxy agent was unable to read the local list of name-resolution servers from the registry. The data is the error code.

1/21/2012 2:20:00 PM, error: NetBT [4307] - Initialization failed because the transport refused to open initial Addresses.

1/21/2012 2:09:52 PM, error: Server [2505] - The server could not bind to the transport \Device\NwlnkNb because another computer on the network has the same name. The server could not start.

1/21/2012 12:59:24 PM, error: Dhcp [1002] - The IP address lease 192.168.0.166 for the Network Card with network address 001FC6B5DAFF has been denied by the DHCP server 10.0.0.1 (The DHCP Server sent a DHCPNACK message).

1/21/2012 11:42:58 AM, error: System Error [1003] - Error code 000000c2, parameter1 00000007, parameter2 00000cd4, parameter3 04200206, parameter4 e1aef3f8.

1/21/2012 10:58:27 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.nist.gov,0x1'. NtpClient will try the DNS lookup again in 240 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

.

==== End Of File ===========================

Значи сканирах с тази програма AppRemover но тя не откри никакви други антивирусни програми освен Lavasoft - Ad-Aware.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

25 януари 201214 г.

Изтеглете OTL.exe и го запазете на десктопа.

Стартирайте OTL (ако е необходимо, потвърдете през UAC).
Направете следните настройки:
Сложете отметка пред Scan All Users
Под менюто File Age => изберете 90 days
Под менюто Standard Registry => променете на ALL
Сложете отметки пред LOP и Purity Check

Под

с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
safebootminimal
safebootnetwork
%SYSTEMDRIVE%\*.*
%USERPROFILE%\*.*
%USERPROFILE%\Application Data\*.*
%USERPROFILE%\Local Settings\Application Data\*.*
%AllUsersProfile%\*.*
%AllUsersProfile%\Application Data\*.*
%USERPROFILE%\My Documents\*.*
%CommonProgramFiles%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\config\systemprofile\*.*
%windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.*
%windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.*
%windir%\temp*.*
%systemroot%\assembly\temp\*.* /S /MD5
%systemroot%\assembly\tmp\*.* /S /MD5
%systemroot%\assembly\GAC_32\*.* /S /MD5
%systemroot%\assembly\GAC_MSIL\*.* /S /MD5
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\*. /mp /s
/md5start
explorer.exe
lsass.exe
svchost.exe
wininit.exe
winlogon.exe
userinit.exe
atapi.sys
iaStor.sys
serial.sys
disk.sys
volsnap.sys
redbook.sys
i8042prt.sys
afd.sys
netbt.sys
tcpip.sys
ipsec.sys
hlp.dat
/md5stop

Натиснете маркираният в синьо бутон: Run Scan.
Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

25 януари 201214 г.

Автор

Ето резултатите

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

25 януари 201214 г.

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7B645a7e85-a57a-4321-a416-b3489c7296de%7D&mid=d556aff27beb47d18276d1568051330c-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&ds=AVG&v=9.0.0.23&lang=en&pr=fr&d=2012-01-23%2017%3A48%3A54&sap=ku&q="
O4 - HKLM..\Run: []  File not found
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Install.exe -- [2004/10/21 19:38:02 | 000,126,976 | R--- | M] (Macrovision Corporation)
MsConfig - StartUpReg: [b]ApnUpdater[/b] - hkey= - key= -  File not found
[2012/01/23 18:18:04 | 000,000,000 | -H-D | C] -- C:\$AVG
[2012/01/23 17:51:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\AVG2012
[2012/01/22 11:25:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\DoctorWeb
[2012/01/22 01:57:25 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\McAfee
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\3076
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\2052
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1054
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1042
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1041
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1037
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1033
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1031
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1028
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1025
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0D786AE3

:Reg

:files
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\*.tmp
C:\*.tmp

autorun.inf /alldrives
autorun.exe /alldrives
recycler /alldrives
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[clearallrestorepoints]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

25 януари 201214 г.

Автор

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7B645a7e85-a57a-4321-a416-b3489c7296de%7D&mid=d556aff27beb47d18276d1568051330c-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&ds=AVG&v=9.0.0.23&lang=en&pr=fr&d=2012-01-23%2017%3A48%3A54&sap=ku&q="
O4 - HKLM..\Run: []  File not found
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Install.exe -- [2004/10/21 19:38:02 | 000,126,976 | R--- | M] (Macrovision Corporation)
MsConfig - StartUpReg: [b]ApnUpdater[/b] - hkey= - key= -  File not found
[2012/01/23 18:18:04 | 000,000,000 | -H-D | C] -- C:\$AVG
[2012/01/23 17:51:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\AVG2012
[2012/01/22 11:25:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\DoctorWeb
[2012/01/22 01:57:25 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\McAfee
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\3076
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\2052
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1054
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1042
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1041
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1037
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1033
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1031
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1028
[2012/01/21 12:46:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1025
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0D786AE3

:Reg

:files
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\*.tmp
C:\*.tmp

autorun.inf /alldrives
autorun.exe /alldrives
recycler /alldrives
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[clearallrestorepoints]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

All processes killed

========== OTL ==========

Prefs.js: "AVG Secure Search" removed from browser.search.defaultenginename

Prefs.js: "AVG Secure Search" removed from browser.search.selectedEngine

Prefs.js: "http://isearch.avg.com/search?cid=%7B645a7e85-a57a-4321-a416-b3489c7296de%7D&mid=d556aff27beb47d18276d1568051330c-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&ds=AVG&v=9.0.0.23&lang=en&pr=fr&d=2012-01-23%2017%3A48%3A54&sap=ku&q=" removed from keyword.URL

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.

File move failed. F:\Install.exe scheduled to be moved on reboot.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\ApnUpdater\ deleted successfully.

C:\$AVG\$VAULT folder moved successfully.

C:\$AVG folder moved successfully.

C:\Documents and Settings\User\Application Data\AVG2012 folder moved successfully.

C:\Documents and Settings\User\DoctorWeb folder moved successfully.

C:\Documents and Settings\All Users\Application Data\McAfee\MCLOGS\PartnerCustom\SSScheduler folder moved successfully.

C:\Documents and Settings\All Users\Application Data\McAfee\MCLOGS\PartnerCustom folder moved successfully.

C:\Documents and Settings\All Users\Application Data\McAfee\MCLOGS folder moved successfully.

C:\Documents and Settings\All Users\Application Data\McAfee folder moved successfully.

C:\WINDOWS\System32\3076 folder moved successfully.

C:\WINDOWS\System32\2052 folder moved successfully.

C:\WINDOWS\System32\1054 folder moved successfully.

C:\WINDOWS\System32\1042 folder moved successfully.

C:\WINDOWS\System32\1041 folder moved successfully.

C:\WINDOWS\System32\1037 folder moved successfully.

Folder move failed. C:\WINDOWS\System32\1033 scheduled to be moved on reboot.

C:\WINDOWS\System32\1031 folder moved successfully.

C:\WINDOWS\System32\1028 folder moved successfully.

C:\WINDOWS\System32\1025 folder moved successfully.

ADS C:\Documents and Settings\All Users\Application Data\TEMP:0D786AE3 deleted successfully.

========== REGISTRY ==========

========== FILES ==========

C:\WINDOWS\System32\CONFIG.TMP moved successfully.

C:\WINDOWS\System32\SETB3.tmp moved successfully.

C:\WINDOWS\System32\SETB5.tmp moved successfully.

C:\WINDOWS\System32\SETB8.tmp moved successfully.

C:\WINDOWS\002898_.tmp moved successfully.

C:\WINDOWS\SET3.tmp moved successfully.

C:\WINDOWS\SET4.tmp moved successfully.

C:\WINDOWS\SET8.tmp moved successfully.

C:\USMT.TMP\DIR0002.TMP folder moved successfully.

C:\USMT.TMP\DIR0001.TMP folder moved successfully.

C:\USMT.TMP\DIR0000.TMP folder moved successfully.

C:\USMT.TMP folder moved successfully.

autorun.inf not found in C:\

autorun.inf not found in D:\

autorun.inf not found in E:\

File move failed. F:\autorun.inf scheduled to be moved on reboot.

autorun.exe not found in C:\

autorun.exe not found in D:\

autorun.exe not found in E:\

autorun.exe not found in F:\

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc7 folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc6 folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc5\Zune\Shell\NormalColor folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc5\Zune\Shell folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc5\Zune folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc5\Royale Noir\Shell\NormalColor folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc5\Royale Noir\Shell\Metallic folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc5\Royale Noir\Shell folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc5\Royale Noir folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc5 folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc4\x86 folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc4\x64 folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc4 folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc3.13\TuneUp Utilities 2012 v12.0.2160.13 folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003\Dc3.13 folder moved successfully.

C:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003 folder moved successfully.

C:\RECYCLER folder moved successfully.

D:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003 folder moved successfully.

D:\RECYCLER folder moved successfully.

E:\RECYCLER\S-1-5-21-1935655697-1123561945-725345543-1003 folder moved successfully.

E:\RECYCLER\S-1-5-21-1060284298-1450960922-1417001333-1003 folder moved successfully.

E:\RECYCLER folder moved successfully.

recycler not found in F:\

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Documents and Settings\User\Desktop\cmd.bat deleted successfully.

C:\Documents and Settings\User\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService

->Temp folder emptied: 66016 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: UpdatusUser.UJR-E4AABE8FC76

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: User

->Temp folder emptied: 77986437 bytes

->Temporary Internet Files folder emptied: 14175801 bytes

->Java cache emptied: 29623 bytes

->FireFox cache emptied: 215759363 bytes

->Flash cache emptied: 4234 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 369779 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 294.00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

Restore points cleared and new OTL Restore Point set!

[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: UpdatusUser

User: UpdatusUser.UJR-E4AABE8FC76

User: User

->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 01252012_225954

Files\Folders moved on Reboot...

File\Folder F:\Install.exe not found!

Folder move failed. C:\WINDOWS\System32\1033 scheduled to be moved on reboot.

File\Folder F:\autorun.inf not found!

File\Folder C:\Documents and Settings\User\Local Settings\Temp\Perflib_Perfdata_e7c.dat not found!

Registry entries deleted on Reboot...

Редактирано 25 януари 201214 г. от Em0_TyoN (преглед на промените)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 януари 201214 г.

До тук добре....!

Моля, изтеглете aswMBR и го запазете на вашия десктоп.

Кликнете с двоен клин на мишката върху файла aswMBR.exe за да го стартирате.
Изчакайте да изтегли дефинициите на avast!
От падащото меню посочете дял C:\ както е на снимката:

Изберете Scan бутона, за да започне проверката.
Когато проверката завърши, натиснете бутона save log, запазете съдържанието на лог файла на десктопа и публикувайте съдържанието му в следващия си коментар.

Моля, изтеглете последната версия на TDSSKiller - оттук и я запазете на вашия декстоп.

Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.
Сложете отметки пред Verify Driver Digital Signature и Detect TDLFS file system и натиснете ОК.
Натиснете бутона Start Scan.
Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.
Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.
Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.
Лог файл ще бъде създаден в свободната директория на дял C:\ . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

26 януари 201214 г.

Автор

Значи aswMBR version Run date: 2012-01-26 12:28:04 ----------------------------- 12:28:04.890 12:28:04.890 12:28:04.890 12:28:05.437 Initialize success 12:29:07.156 12:31:29.031 12:31:29.031 12:31:29.062 12:31:29.062 Disk 0 MBR scan 12:31:29.062 12:31:29.062 12:31:29.062 12:31:29.078 12:31:29.093 12:31:29.109 12:31:29.187 12:31:46.671 Service scanning 12:31:47.046 12:31:47.578 Modules scanning 12:31:52.421 12:31:52.437 12:31:52.453 12:31:52.453 12:31:52.453 12:31:52.906 AVAST engine scan C:\ 13:56:59.765 13:57:21.609 13:57:21.656 Но след 13:58:45.0328 2460 13:58:45.0421 2460 13:58:45.0421 2460 13:58:45.0421 2460 SystemInfo: 13:58:45.0421 2460 13:58:45.0421 2460 13:58:45.0421 2460 13:58:45.0421 2460 13:58:45.0421 2460 UserName: User 13:58:45.0421 2460 13:58:45.0421 2460 13:58:45.0421 2460 13:58:45.0421 2460 13:58:45.0421 2460 Page size: 0x1000 13:58:45.0421 2460 13:58:45.0421 2460 13:58:47.0609 2460 13:58:47.0781 2460 13:58:52.0484 3488 13:58:52.0484 3488 Scan started 13:58:52.0484 3488 13:58:52.0484 3488 13:58:52.0953 3488 Abiosdsk - ok 13:58:52.0968 3488 abp480n5 - ok 13:58:53.0000 3488 13:58:53.0484 3488 ACPI - ok 13:58:53.0531 3488 13:58:53.0625 3488 ACPIEC - ok 13:58:53.0640 3488 adpu160m - ok 13:58:53.0671 3488 13:58:53.0781 3488 aec - ok 13:58:53.0843 3488 13:58:53.0859 3488 AFD - ok 13:58:53.0859 3488 Aha154x - ok 13:58:53.0875 3488 aic78u2 - ok 13:58:53.0890 3488 aic78xx - ok 13:58:53.0890 3488 AliIde - ok 13:58:53.0937 3488 13:58:54.0015 3488 Ambfilt - ok 13:58:54.0062 3488 amsint - ok 13:58:54.0062 3488 asc - ok 13:58:54.0078 3488 asc3350p - ok 13:58:54.0078 3488 asc3550 - ok 13:58:54.0109 3488 13:58:54.0218 3488 AsyncMac - ok 13:58:54.0234 3488 13:58:54.0343 3488 atapi - ok 13:58:54.0390 3488 13:58:54.0406 3488 AtcL001 - ok 13:58:54.0421 3488 Atdisk - ok 13:58:54.0453 3488 13:58:54.0562 3488 Atmarpc - ok 13:58:54.0578 3488 13:58:54.0687 3488 audstub - ok 13:58:54.0734 3488 13:58:54.0859 3488 Beep - ok 13:58:54.0875 3488 13:58:55.0000 3488 cbidf2k - ok 13:58:55.0015 3488 cd20xrnt - ok 13:58:55.0015 3488 13:58:55.0125 3488 Cdaudio - ok 13:58:55.0156 3488 13:58:55.0265 3488 Cdfs - ok 13:58:55.0312 3488 13:58:55.0406 3488 Cdrom - ok 13:58:55.0421 3488 Changer - ok 13:58:55.0421 3488 CmdIde - ok 13:58:55.0437 3488 Cpqarray - ok 13:58:55.0437 3488 dac2w2k - ok 13:58:55.0437 3488 dac960nt - ok 13:58:55.0500 3488 13:58:55.0593 3488 Disk - ok 13:58:55.0656 3488 13:58:55.0765 3488 dmboot - ok 13:58:55.0796 3488 13:58:55.0921 3488 dmio - ok 13:58:55.0968 3488 13:58:56.0078 3488 dmload - ok 13:58:56.0109 3488 13:58:56.0218 3488 DMusic - ok 13:58:56.0281 3488 dpti2o - ok 13:58:56.0312 3488 13:58:56.0421 3488 drmkaud - ok 13:58:56.0515 3488 13:58:56.0578 3488 dtsoftbus01 - ok 13:58:56.0625 3488 13:58:56.0718 3488 Fastfat - ok 13:58:56.0765 3488 13:58:56.0859 3488 Fdc - ok 13:58:56.0875 3488 13:58:56.0984 3488 Fips - ok 13:58:57.0000 3488 13:58:57.0109 3488 Flpydisk - ok 13:58:57.0171 3488 13:58:57.0265 3488 FltMgr - ok 13:58:57.0281 3488 13:58:57.0375 3488 Fs_Rec - ok 13:58:57.0390 3488 13:58:57.0500 3488 Ftdisk - ok 13:58:57.0531 3488 13:58:57.0625 3488 Gpc - ok 13:58:57.0671 3488 13:58:57.0781 3488 HDAudBus - ok 13:58:57.0796 3488 13:58:57.0890 3488 HidUsb - ok 13:58:57.0906 3488 hpn - ok 13:58:57.0937 3488 13:58:57.0953 3488 HTTP - ok 13:58:58.0000 3488 i2omgmt - ok 13:58:58.0000 3488 i2omp - ok 13:58:58.0046 3488 13:58:58.0140 3488 i8042prt - ok 13:58:58.0171 3488 13:58:58.0281 3488 Imapi - ok 13:58:58.0328 3488 ini910u - ok 13:58:58.0453 3488 13:58:58.0687 3488 13:58:58.0718 3488 IntelIde - ok 13:58:58.0750 3488 13:58:58.0843 3488 intelppm - ok 13:58:58.0859 3488 13:58:58.0953 3488 Ip6Fw - ok 13:58:58.0984 3488 13:58:59.0093 3488 13:58:59.0140 3488 13:58:59.0234 3488 IpInIp - ok 13:58:59.0250 3488 13:58:59.0343 3488 IpNat - ok 13:58:59.0359 3488 13:58:59.0453 3488 IPSec - ok 13:58:59.0531 3488 13:58:59.0625 3488 IRENUM - ok 13:58:59.0640 3488 13:58:59.0750 3488 isapnp - ok 13:58:59.0765 3488 13:58:59.0859 3488 Kbdclass - ok 13:58:59.0906 3488 13:59:00.0015 3488 kbdhid - ok 13:59:00.0031 3488 13:59:00.0125 3488 kmixer - ok 13:59:00.0171 3488 13:59:00.0187 3488 KSecDD - ok 13:59:00.0234 3488 13:59:00.0250 3488 13:59:00.0296 3488 13:59:00.0296 3488 Lbd - ok 13:59:00.0312 3488 lbrtfdc - ok 13:59:00.0343 3488 13:59:00.0453 3488 mnmdd - ok 13:59:00.0500 3488 13:59:00.0593 3488 Modem - ok 13:59:00.0671 3488 13:59:00.0734 3488 Monfilt - ok 13:59:00.0796 3488 13:59:00.0906 3488 Mouclass - ok 13:59:00.0921 3488 13:59:01.0015 3488 MountMgr - ok 13:59:01.0062 3488 mraid35x - ok 13:59:01.0078 3488 13:59:01.0187 3488 MRxDAV - ok 13:59:01.0234 3488 13:59:01.0265 3488 MRxSmb - ok 13:59:01.0328 3488 13:59:01.0437 3488 Msfs - ok 13:59:01.0453 3488 13:59:01.0546 3488 MSKSSRV - ok 13:59:01.0562 3488 13:59:01.0671 3488 MSPCLOCK - ok 13:59:01.0718 3488 13:59:01.0812 3488 MSPQM - ok 13:59:01.0843 3488 13:59:01.0937 3488 mssmbios - ok 13:59:01.0968 3488 13:59:01.0984 3488 Mup - ok 13:59:02.0046 3488 13:59:02.0171 3488 NDIS - ok 13:59:02.0187 3488 13:59:02.0203 3488 NdisTapi - ok 13:59:02.0265 3488 13:59:02.0359 3488 Ndisuio - ok 13:59:02.0375 3488 13:59:02.0484 3488 NdisWan - ok 13:59:02.0515 3488 13:59:02.0531 3488 NDProxy - ok 13:59:02.0593 3488 13:59:02.0687 3488 NetBIOS - ok 13:59:02.0703 3488 13:59:02.0812 3488 NetBT - ok 13:59:02.0828 3488 13:59:02.0921 3488 Npfs - ok 13:59:02.0984 3488 13:59:03.0093 3488 Ntfs - ok 13:59:03.0125 3488 13:59:03.0234 3488 Null - ok 13:59:03.0515 3488 13:59:03.0984 3488 nv - ok 13:59:04.0046 3488 13:59:04.0171 3488 NwlnkFlt - ok 13:59:04.0171 3488 13:59:04.0296 3488 NwlnkFwd - ok 13:59:04.0328 3488 13:59:04.0421 3488 NwlnkIpx - ok 13:59:04.0468 3488 13:59:04.0578 3488 NwlnkNb - ok 13:59:04.0593 3488 13:59:04.0718 3488 NwlnkSpx - ok 13:59:04.0734 3488 13:59:04.0828 3488 NWRDR - ok 13:59:04.0906 3488 13:59:05.0000 3488 Parport - ok 13:59:05.0015 3488 13:59:05.0109 3488 PartMgr - ok 13:59:05.0140 3488 13:59:05.0250 3488 ParVdm - ok 13:59:05.0296 3488 13:59:05.0406 3488 PCI - ok 13:59:05.0406 3488 PCIDump - ok 13:59:05.0421 3488 13:59:05.0531 3488 PCIIde - ok 13:59:05.0562 3488 13:59:05.0656 3488 Pcmcia - ok 13:59:05.0671 3488 13:59:05.0687 3488 PCTDMDefrag - ok 13:59:05.0703 3488 13:59:05.0718 3488 PCTDSMon - ok 13:59:05.0750 3488 PDCOMP - ok 13:59:05.0750 3488 PDFRAME - ok 13:59:05.0765 3488 PDRELI - ok 13:59:05.0781 3488 PDRFRAME - ok 13:59:05.0781 3488 perc2 - ok 13:59:05.0796 3488 perc2hib - ok 13:59:05.0843 3488 13:59:05.0937 3488 PptpMiniport - ok 13:59:05.0953 3488 13:59:06.0062 3488 PSched - ok 13:59:06.0062 3488 13:59:06.0187 3488 Ptilink - ok 13:59:06.0218 3488 13:59:06.0218 3488 PxHelp20 - ok 13:59:06.0250 3488 ql1080 - ok 13:59:06.0250 3488 Ql10wnt - ok 13:59:06.0250 3488 ql12160 - ok 13:59:06.0265 3488 ql1240 - ok 13:59:06.0265 3488 ql1280 - ok 13:59:06.0281 3488 13:59:06.0390 3488 RasAcd - ok 13:59:06.0421 3488 13:59:06.0515 3488 Rasl2tp - ok 13:59:06.0546 3488 13:59:06.0656 3488 RasPppoe - ok 13:59:06.0656 3488 13:59:06.0765 3488 Raspti - ok 13:59:06.0796 3488 13:59:06.0906 3488 Rdbss - ok 13:59:06.0937 3488 13:59:07.0046 3488 RDPCDD - ok 13:59:07.0093 3488 13:59:07.0187 3488 rdpdr - ok 13:59:07.0218 3488 13:59:07.0234 3488 RDPWD - ok 13:59:07.0281 3488 13:59:07.0375 3488 redbook - ok 13:59:07.0390 3488 13:59:07.0406 3488 Revoflt - ok 13:59:07.0421 3488 13:59:07.0437 3488 RsFx0102 - ok 13:59:07.0515 3488 13:59:07.0562 3488 RTL8023xp - ok 13:59:07.0609 3488 13:59:07.0703 3488 rtl8139 - ok 13:59:07.0718 3488 13:59:07.0734 3488 sbaphd - ok 13:59:07.0781 3488 13:59:07.0781 3488 sbapifs - ok 13:59:07.0812 3488 13:59:07.0906 3488 Secdrv - ok 13:59:07.0921 3488 13:59:08.0031 3488 serenum - ok 13:59:08.0062 3488 13:59:08.0171 3488 Serial - ok 13:59:08.0203 3488 13:59:08.0296 3488 Sfloppy - ok 13:59:08.0343 3488 Simbad - ok 13:59:08.0359 3488 Sparrow - ok 13:59:08.0359 3488 13:59:08.0468 3488 splitter - ok 13:59:08.0500 3488 13:59:08.0500 3488 13:59:08.0500 3488 13:59:08.0500 3488 13:59:08.0531 3488 13:59:08.0625 3488 sr - ok 13:59:08.0687 3488 13:59:08.0734 3488 Srv - ok 13:59:08.0796 3488 13:59:08.0906 3488 swenum - ok 13:59:08.0906 3488 13:59:09.0015 3488 swmidi - ok 13:59:09.0062 3488 symc810 - ok 13:59:09.0078 3488 symc8xx - ok 13:59:09.0078 3488 sym_hi - ok 13:59:09.0093 3488 sym_u3 - ok 13:59:09.0125 3488 13:59:09.0234 3488 sysaudio - ok 13:59:09.0265 3488 13:59:09.0281 3488 Tcpip - ok 13:59:09.0359 3488 13:59:09.0453 3488 TDPIPE - ok 13:59:09.0484 3488 13:59:09.0562 3488 TDTCP - ok 13:59:09.0593 3488 13:59:09.0687 3488 TermDD - ok 13:59:09.0718 3488 TosIde - ok 13:59:09.0750 3488 13:59:09.0843 3488 Udfs - ok 13:59:09.0859 3488 ultra - ok 13:59:09.0906 3488 13:59:10.0015 3488 Update - ok 13:59:10.0062 3488 13:59:10.0171 3488 usbccgp - ok 13:59:10.0203 3488 13:59:10.0296 3488 usbehci - ok 13:59:10.0343 3488 13:59:10.0437 3488 usbhub - ok 13:59:10.0453 3488 13:59:10.0546 3488 USBSTOR - ok 13:59:10.0593 3488 13:59:10.0687 3488 usbuhci - ok 13:59:10.0718 3488 13:59:10.0812 3488 VgaSave - ok 13:59:10.0812 3488 ViaIde - ok 13:59:10.0828 3488 13:59:10.0937 3488 VolSnap - ok 13:59:11.0000 3488 13:59:11.0093 3488 Wanarp - ok 13:59:11.0125 3488 WDICA - ok 13:59:11.0140 3488 13:59:11.0250 3488 wdmaud - ok 13:59:11.0328 3488 13:59:11.0562 3488 13:59:11.0562 3488 13:59:11.0562 3488 13:59:11.0562 3488 13:59:11.0562 3488 13:59:11.0578 3488 13:59:11.0578 3488 13:59:11.0578 3488 13:59:11.0578 3488 Scan finished 13:59:11.0578 3488 13:59:11.0703 3656 13:59:11.0703 3656 13:59:23.0312 3656 13:59:23.0312 3656 13:59:25.0937 2844 направих сканиране с тези програми ето резултатите. 0.9.9.1509 Copyright© 2011 AVAST Software OS Version: Windows 5.1.2600 Service Pack 3 Number of processors: 2 586 0xF0D ComputerName: UJR-E4AABE8FC76 UserName: User AVAST engine defs: 12012601 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-9 Disk 0 Vendor: ExcelStor_Technology_J9250S GM2OA52A Size: 238475MB BusType: 3 Disk 0 MBR read successfully Disk 0 Windows XP default MBR code Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 119999 MB offset 19 Disk 0 Partition - 00 05 Extended 118473 MB offset 245758464 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 102850 MB offset 245758483 Disk 0 Partition - 00 05 Extended 15623 MB offset 456396416 Disk 0 scanning sectors +488393024 Disk 0 scanning C:\WINDOWS\system32\drivers Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32 Disk 0 trace - called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sptd.sys pciide.sys PCIIDEX.SYS 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a509ab8] 3 CLASSPNP.SYS[b80e8fd7] -> nt!IofCallDriver -> \Device\00000069[0x8a557030] 5 ACPI.sys[b7e69620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP4T0L0-9[0x8a593030] Scan finished successfully Disk 0 MBR has been saved successfully to "C:\Documents and Settings\User\Desktop\MBR.dat" The log file has been saved successfully to "C:\Documents and Settings\User\Desktop\aswMBR.txt" като сканирах с TDSSKiller тя откри този драйвър sptd.sys до колкото знам този елемент е важен за работата на операционната система дали има опасност да ми се затрие windowsa след премахването на този драйвър. TDSS rootkit removing tool 2.7.7.0 Jan 24 2012 16:44:27 ============================================================ Current date / time: 2012/01/26 13:58:45.0421 OS Version: 5.1.2600 ServicePack: 3.0 Product type: Workstation ComputerName: UJR-E4AABE8FC76 Windows directory: C:\WINDOWS System windows directory: C:\WINDOWS Processor architecture: Intel x86 Number of processors: 2 Boot type: Normal boot ============================================================ Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x1C042, SectorsPerTrack: 0x13, TracksPerCylinder: 0xE0, Type 'K0', Flags 0x00000054 Initialize success ============================================================ Mode: Manual; SigCheck; TDLFS; ============================================================ ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys Ambfilt (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys AtcL001 (f43673d97b9df66999c3dfa6e538ef5b) C:\WINDOWS\system32\DRIVERS\l151x86.sys Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys dtsoftbus01 (c8eb60a182bee9afd6b394c0145a1732) C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys IntcAzAudAddService (c89535b2d7b42fe402ac4b20d9908249) C:\WINDOWS\system32\drivers\RtkHDAud.sys IntcAzAudAddService - ok intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys IpFilterDriver - ok IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys Lavasoft Kernexplorer (6c4a3804510ad8e0f0c07b5be3d44ddb) C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys Lavasoft Kernexplorer - ok Lbd (336abe8721cbc3110f1c6426da633417) C:\WINDOWS\system32\DRIVERS\Lbd.sys mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys Monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys nv (4b54dcd6adee535df80f07c59ddd8f14) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys NwlnkIpx (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys NWRDR (36b9b950e3d2e100970a48d8bad86740) C:\WINDOWS\system32\DRIVERS\nwrdr.sys Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys PCTDMDefrag (03c45d2a632226bf52eadccbf3181a31) C:\WINDOWS\system32\drivers\PCTDMDefrag.sys PCTDSMon (863469f15364c65dc71e58df7bdbc192) C:\WINDOWS\system32\drivers\PCTDSMon.sys PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\DRIVERS\PxHelp20.sys RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys Revoflt (8b5b8a11306190c6963d3473f052d3c8) C:\WINDOWS\system32\DRIVERS\revoflt.sys RsFx0102 (fedd2710b75be3ecf078adace790c423) C:\WINDOWS\system32\DRIVERS\RsFx0102.sys RTL8023xp (3529828ec571fb2f64f6b142f9109993) C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS sbaphd (65a36563c0207824c8240662043c5304) C:\WINDOWS\system32\drivers\sbaphd.sys sbapifs (3d6ba67c758735918e323d4d6f64449a) C:\WINDOWS\system32\drivers\sbapifs.sys Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys sptd (8ea0fd60a5b047e0c734d51aace531c9) C:\WINDOWS\System32\Drivers\sptd.sys Suspicious file (NoAccess): C:\WINDOWS\System32\Drivers\sptd.sys. md5: 8ea0fd60a5b047e0c734d51aace531c9 sptd ( LockedFile.Multi.Generic ) - warning sptd - detected LockedFile.Multi.Generic (1) sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0 \Device\Harddisk0\DR0 - ok Boot (0x1200) (9779b556308ad78f0965de7070c76546) \Device\Harddisk0\DR0\Partition0 \Device\Harddisk0\DR0\Partition0 - ok Boot (0x1200) (7c8c0c76de494a8deda887d1a9a518a4) \Device\Harddisk0\DR0\Partition1 \Device\Harddisk0\DR0\Partition1 - ok Boot (0x1200) (58cc05d8812bf05ecd403bce643defbc) \Device\Harddisk0\DR0\Partition2 \Device\Harddisk0\DR0\Partition2 - ok ============================================================ ============================================================ Detected object count: 1 Actual detected object count: 1 sptd ( LockedFile.Multi.Generic ) - skipped by user sptd ( LockedFile.Multi.Generic ) - User select action: Skip Deinitialize success

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 януари 201214 г.

Драйвера sptd е на програмата Daemon Tools...!Никаде в двете сканирания не съм посочил Delete,че да се изтрие....!По важното е че не се виждат активни зарази..!

Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Изтеглете програмата: ESET Online Scanner

Стартирайте esetsmartinstaller_enu.exe
Сложете отметка на YES, I accept the Terms of Use и изберете Start:
Скенерът ще започне да изтегля компонентите, които са му необходими:
Уверете се, че има отметки на следните редове:

Накрая изберете Start
Скенерът ще започне да изтегля последните дефиниции.
След, като сканирането завърши изберете Finish.
Отидете в: C:\Program Files\ESET\ESET Online Scanner
Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

26 януари 201214 г.

Автор

Драйвера sptd е на програмата Daemon Tools...!Никаде в двете сканирания не съм посочил Delete,че да се изтрие....!По важното е че не се виждат активни зарази..!

Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Изтеглете програмата: ESET Online Scanner

Стартирайте esetsmartinstaller_enu.exe

Сложете отметка на YES, I accept the Terms of Use и изберете Start:

Скенерът ще започне да изтегля компонентите, които са му необходими:

Уверете се, че има отметки на следните редове:

Накрая изберете Start

Скенерът ще започне да изтегля последните дефиниции.

След, като сканирането завърши изберете Finish.

Отидете в: C:\Program Files\ESET\ESET Online Scanner

Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

Ето резултата от Malwarebytes Anti-Malware тя не откри нищо

Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org

Версия на базата от данни: v2012.01.26.03

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

User :: UJR-E4AABE8FC76 [администратор]

1/26/2012 2:30:01 PM

mbam-log-2012-01-26 (14-30-01).txt

Тип сканиране: Пълно сканиране

Изключени опции за сканиране: P2P

Сканирани обекти: 247240

Изминало време: 38 минута(и), 41 секунда(и)

Открити процеси в паметта: 0