03/22/2012 14:25 Proveriava vsichki lokalni diskove File D:\System Volume Information\_restore{41898BD8-4FD4-415E-845A-DAFC9B730F9D}\RP82\A0035641.EXE e zarazen ot Win32:Sality-gen, Iztrit File D:\System Volume Information\_restore{41898BD8-4FD4-415E-845A-DAFC9B730F9D}\RP82\A0035654.EXE e zarazen ot Win32:Sality-gen, Iztrit File D:\System Volume Information\_restore{41898BD8-4FD4-415E-845A-DAFC9B730F9D}\RP83\A0036420.EXE e zarazen ot Win32:Sality-gen, Iztrit File D:\System Volume Information\_restore{41898BD8-4FD4-415E-845A-DAFC9B730F9D}\RP83\A0036433.EXE e zarazen ot Win32:Sality-gen, Iztrit File D:\System Volume Information\_restore{41898BD8-4FD4-415E-845A-DAFC9B730F9D}\RP83\A0036842.EXE e zarazen ot Win32:Sality-gen, Iztrit File D:\System Volume Information\_restore{41898BD8-4FD4-415E-845A-DAFC9B730F9D}\RP83\A0036855.EXE e zarazen ot Win32:Sality-gen, Iztrit File D:\System Volume Information\_restore{41898BD8-4FD4-415E-845A-DAFC9B730F9D}\RP83\A0037355.EXE e zarazen ot Win32:Sality-gen, Iztrit File D:\System Volume Information\_restore{41898BD8-4FD4-415E-845A-DAFC9B730F9D}\RP83\A0037368.EXE e zarazen ot Win32:Sality-gen, Iztrit File D:\System Volume Information\_restore{41898BD8-4FD4-415E-845A-DAFC9B730F9D}\RP84\A0037717.EXE e zarazen ot Win32:Sality-gen, Iztrit File D:\System Volume Information\_restore{41898BD8-4FD4-415E-845A-DAFC9B730F9D}\RP84\A0037730.EXE e zarazen ot Win32:Sality-gen, Iztrit File D:\System Volume Information\_restore{B7B93D94-EE2F-4A14-9727-1667C0E8D184}\RP3\A0001712.EXE e zarazen ot Win32:Sality-gen, Iztrit File D:\System Volume Information\_restore{B7B93D94-EE2F-4A14-9727-1667C0E8D184}\RP3\A0001737.EXE e zarazen ot Win32:Sality-gen, Iztrit Broi provereni papki: 2436 Broi provereni failove: 55581 Broi zarazeni failove: 12

Изтрийте вашето копие на Комбофикс (като изтриете иконата от вашия десктоп)...изтеглете ново свежо копие от тук или тук и го запазете на десктопа си.Направете нова проверка по инструкцията в пост 8.

ComboFix 12-03-22.01 - JUFI 03.2012 г. 16:46:15.2.1 - x86 Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.447.227 [GMT 1:00] Running from: c:\documents and settings\JUFI\My Documents\Downloads\ComboFix.exe AV: avast! antivirus 4.8.1282 [VPS 081112-0] *Disabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: ActiveArmor Firewall *Disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D} . . ((((((((((((((((((((((((( Files Created from 2012-02-22 to 2012-03-22 ))))))))))))))))))))))))))))))) . . . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-03-20 19:13 . 2006-07-12 05:19 1519616 ----a-w- c:\windows\system32\nwiz.exe . . ((((((((((((((((((((((((((((( SnapShot@2012-03-20_20.17.53 ))))))))))))))))))))))))))))))))))))))))) . + 2012-03-22 14:57 . 2012-03-22 14:57 16384 c:\windows\temp\Perflib_Perfdata_5b8.dat + 2012-03-22 14:53 . 2004-11-18 09:42 22752 c:\windows\system32\spupdsvc.exe + 2012-03-22 14:54 . 2006-07-21 08:14 86016 c:\windows\system32\ReinstallBackups\0001\DriverFiles\SOUNDMAN.EXE + 2012-03-22 14:54 . 2004-08-04 12:00 23552 c:\windows\system32\ReinstallBackups\0001\DriverFiles\i386\wdmaud.drv + 2012-03-22 14:54 . 2004-08-03 22:08 48640 c:\windows\system32\ReinstallBackups\0001\DriverFiles\i386\stream.sys + 2012-03-22 14:54 . 2004-08-03 22:08 60288 c:\windows\system32\ReinstallBackups\0001\DriverFiles\i386\drmk.sys + 2012-03-22 14:54 . 2005-05-03 10:43 69632 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ALCMTR.EXE + 2004-08-04 12:00 . 2012-03-22 14:54 39992 c:\windows\system32\perfc009.dat - 2004-08-04 12:00 . 2012-03-20 17:29 39992 c:\windows\system32\perfc009.dat + 2005-01-07 16:07 . 2005-01-07 16:07 61952 c:\windows\system32\HdAShCut.exe + 2005-01-07 16:07 . 2005-01-07 16:07 25088 c:\windows\system32\HdAProp.dll - 2004-08-03 23:08 . 2004-08-04 12:00 48640 c:\windows\system32\drivers\stream.sys + 2004-08-03 23:08 . 2004-08-03 22:08 48640 c:\windows\system32\drivers\stream.sys - 2012-03-20 18:58 . 2004-08-03 23:08 60288 c:\windows\system32\drivers\drmk.sys + 2012-03-20 18:58 . 2004-08-03 22:08 60288 c:\windows\system32\drivers\drmk.sys + 2012-03-22 13:24 . 2008-11-12 16:52 50656 c:\windows\system32\drivers\aswTdi.sys + 2012-03-22 13:24 . 2008-11-12 16:52 23152 c:\windows\system32\drivers\aswRdr.sys + 2012-03-22 13:24 . 2008-11-12 16:54 94032 c:\windows\system32\drivers\aswmon2.sys + 2012-03-22 13:24 . 2008-11-12 16:54 93296 c:\windows\system32\drivers\aswmon.sys + 2012-03-22 13:24 . 2008-11-12 16:53 20560 c:\windows\system32\drivers\aswFsBlk.sys + 2007-05-14 21:41 . 2007-05-14 21:41 14336 c:\windows\system32\drivers\Amusbprt.sys + 2007-05-14 21:40 . 2007-05-14 21:40 14336 c:\windows\system32\drivers\Amps2prt.sys + 2012-03-22 13:24 . 2008-11-12 16:51 26944 c:\windows\system32\drivers\aavmker4.sys + 2004-08-03 23:08 . 2004-08-03 22:08 48640 c:\windows\system32\dllcache\stream.sys + 2012-03-20 18:58 . 2004-08-03 22:08 60288 c:\windows\system32\dllcache\drmk.sys + 2012-03-22 14:54 . 2006-08-01 07:02 49152 c:\windows\system32\ChCfg.exe + 2012-03-22 13:24 . 2008-11-12 16:51 97480 c:\windows\system32\AvastSS.scr + 2007-05-15 09:31 . 2007-05-15 09:31 36864 c:\windows\system32\Amhooker.dll + 2012-03-22 14:53 . 2006-07-21 08:14 86016 c:\windows\SOUNDMAN.EXE + 2012-03-22 14:53 . 2005-05-03 10:43 69632 c:\windows\ALCMTR.EXE + 2012-03-22 14:54 . 2004-08-03 23:56 4096 c:\windows\system32\ReinstallBackups\0001\DriverFiles\i386\ksuser.dll + 2012-03-20 18:58 . 2004-08-03 23:56 4096 c:\windows\system32\ksuser.dll - 2012-03-20 18:58 . 2004-08-04 00:56 4096 c:\windows\system32\ksuser.dll + 2005-01-07 16:07 . 2005-01-07 16:07 5120 c:\windows\system32\HdAudRes.dll + 2007-05-14 21:38 . 2007-05-14 21:38 9216 c:\windows\system32\drivers\Amfilter.sys + 2012-03-20 18:58 . 2004-08-03 23:56 4096 c:\windows\system32\dllcache\ksuser.dll + 2012-03-22 14:53 . 2006-07-21 23:40 143360 c:\windows\system32\RTCOM\RTLCPAPI.dll + 2012-03-22 14:53 . 2006-07-21 08:18 270336 c:\windows\system32\RTCOM\RTCOMDLL.dll + 2012-03-22 14:54 . 2006-03-09 09:45 364544 c:\windows\system32\ReinstallBackups\0001\DriverFiles\RtlUpd.exe + 2012-03-22 14:54 . 2006-07-21 23:40 143360 c:\windows\system32\ReinstallBackups\0001\DriverFiles\RTLCPAPI.dll + 2012-03-22 14:54 . 2006-07-21 08:18 270336 c:\windows\system32\ReinstallBackups\0001\DriverFiles\RTCOMDLL.dll + 2012-03-22 14:54 . 2004-03-16 09:58 136960 c:\windows\system32\ReinstallBackups\0001\DriverFiles\i386\portcls.sys + 2012-03-22 14:54 . 2004-08-03 22:15 140928 c:\windows\system32\ReinstallBackups\0001\DriverFiles\i386\ks.sys - 2004-08-04 12:00 . 2012-03-20 17:29 311604 c:\windows\system32\perfh009.dat + 2004-08-04 12:00 . 2012-03-22 14:54 311604 c:\windows\system32\perfh009.dat + 2012-03-22 13:24 . 2003-02-21 03:42 348160 c:\windows\system32\MSVCR71.dll + 2012-03-22 13:24 . 2003-03-18 19:14 499712 c:\windows\system32\MSVCP71.dll + 2012-03-20 18:58 . 2004-03-16 09:58 136960 c:\windows\system32\drivers\portcls.sys + 2004-08-03 23:15 . 2004-08-03 22:15 140928 c:\windows\system32\drivers\ks.sys - 2004-08-03 23:15 . 2004-08-04 12:00 140928 c:\windows\system32\drivers\ks.sys + 2005-01-07 16:07 . 2005-01-07 16:07 145920 c:\windows\system32\drivers\Hdaudio.sys + 2005-01-07 16:07 . 2005-01-07 16:07 138752 c:\windows\system32\drivers\Hdaudbus.sys + 2012-03-22 13:24 . 2008-11-12 16:53 110160 c:\windows\system32\drivers\aswSP.sys + 2012-03-20 18:58 . 2004-03-16 09:58 136960 c:\windows\system32\dllcache\portcls.sys + 2004-08-03 23:15 . 2004-08-03 22:15 140928 c:\windows\system32\dllcache\ks.sys + 2012-03-22 14:53 . 2006-03-09 09:45 364544 c:\windows\RtlUpd.exe + 2012-03-22 14:53 . 2005-04-16 14:20 487424 c:\windows\RtlExUpd.dll + 2004-03-16 09:58 . 2004-03-16 09:58 136960 c:\windows\Driver Cache\i386\portcls.sys + 2012-03-22 14:54 . 2006-05-16 10:04 2879488 c:\windows\system32\ReinstallBackups\0001\DriverFiles\SkyTel.exe + 2012-03-22 14:54 . 2006-05-04 08:35 9709568 c:\windows\system32\ReinstallBackups\0001\DriverFiles\RTLCPL.EXE + 2012-03-22 14:54 . 2006-08-01 11:07 4356608 c:\windows\system32\ReinstallBackups\0001\DriverFiles\RtkHDAud.sys + 2012-03-22 14:54 . 2006-06-28 06:00 2158592 c:\windows\system32\ReinstallBackups\0001\DriverFiles\MicCal.exe + 2012-03-22 14:54 . 2006-05-04 08:26 2808832 c:\windows\system32\ReinstallBackups\0001\DriverFiles\ALCWZRD.EXE + 2012-03-22 13:24 . 2003-03-18 20:20 1060864 c:\windows\system32\MFC71.dll + 2012-03-22 14:53 . 2006-08-01 11:07 4356608 c:\windows\system32\drivers\RtkHDAud.sys + 2012-03-22 13:24 . 2008-11-12 16:57 1235696 c:\windows\system32\aswBoot.exe + 2012-03-22 14:53 . 2006-05-16 10:04 2879488 c:\windows\SkyTel.exe + 2012-03-22 14:53 . 2006-05-04 08:35 9709568 c:\windows\RTLCPL.EXE + 2012-03-22 14:53 . 2006-06-28 06:00 2158592 c:\windows\MicCal.exe + 2012-03-22 14:53 . 2006-05-04 08:26 2808832 c:\windows\ALCWZRD.EXE + 2012-03-22 14:54 . 2006-08-01 11:10 16049664 c:\windows\system32\ReinstallBackups\0001\DriverFiles\RTHDCPL.EXE + 2012-03-22 14:53 . 2006-08-01 11:10 16049664 c:\windows\RTHDCPL.EXE . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2012-03-20 396152] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-12 7626752] "nwiz"="nwiz.exe" [2012-03-20 1519616] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-12 86016] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-12 81000] "WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-05-15 204800] "SkyTel"="SkyTel.EXE" [2006-05-16 2879488] "RTHDCPL"="RTHDCPL.EXE" [2006-08-01 16049664] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"= "d:\\Games\\jufi\\utorrent.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Documents and Settings\\JUFI\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe"= "c:\\WINDOWS\\system32\\nwiz.exe"= "c:\\Documents and Settings\\JUFI\\Local Settings\\Application Data\\Google\\Update\\1.3.21.99\\GoogleCrashHandler.exe"= "c:\\Documents and Settings\\JUFI\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= . R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [22.3.2012 г. 14:24 110160] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [22.3.2012 г. 14:24 20560] . Contents of the 'Scheduled Tasks' folder . 2012-03-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-682003330-308236825-839522115-1003Core.job - c:\documents and settings\JUFI\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-03-20 19:09] . 2012-03-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-682003330-308236825-839522115-1003UA.job - c:\documents and settings\JUFI\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-03-20 19:09] . . ------- Supplementary Scan ------- . TCP: Interfaces\{E43473C1-F1FC-4DAB-B62C-EDBD6EDECE05}: NameServer = 212.25.58.2 212.25.58.229 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-03-22 16:49 Windows 5.1.2600 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . Completion time: 2012-03-22 16:51:03 ComboFix-quarantined-files.txt 2012-03-22 15:51 ComboFix2.txt 2012-03-20 20:19 . Pre-Run: 7 687 528 448 bytes free Post-Run: 7 684 579 328 bytes free . - - End Of File - - 13E432E865E3F4BAF4CB33C6D0D15175

Деинсталирайте Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

2.Изтеглете OTCleanIt или от тук,стартирайте и натиснете

Изтеглете и инсталирайте Windows XP Service Pack 3 RTM Build 5512

Следват контролни сканирания и приключваме..!

Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Изтеглете програмата: ESET Online Scanner

• Стартирайте esetsmartinstaller_enu.exe
• Сложете отметка на YES, I accept the Terms of Use и изберете Start:

  

• Скенерът ще започне да изтегля компонентите, които са му необходими:

  

• Уверете се, че има отметки на следните редове:

  

  Накрая изберете Start

• Скенерът ще започне да изтегля последните дефиниции.
• След, като сканирането завърши изберете Finish.
• Отидете в: C:\Program Files\ESET\ESET Online Scanner
• Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.

Malwarebytes Anti-Malware 1.60.1.1000 www.malwarebytes.org Database version: v2012.03.21.05 Windows XP Service Pack 3 x86 NTFS Internet Explorer 6.0.2900.5512 JUFI :: JUFI-551C83B596 [administrator] 22.3.2012 г. 18:58:22 mbam-log-2012-03-22 (18-58-22).txt Scan type: Full scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 216827 Time elapsed: 21 minute(s), 33 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Documents and Settings\JUFI\My Documents\Downloads\avast! Professional Edition 4.8.1282\Keygen.exe (Backdoor.IRCBot) -> Quarantined and deleted successfully. (end)

ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=4a4799a6ed3f4c43888b6996690999fb # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2012-03-22 07:15:37 # local_time=2012-03-22 08:15:37 (+0100, Central European Standard Time) # country="Bulgaria" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=769 16775141 100 98 3903 268729245 3751 0 # compatibility_mode=8192 67108863 100 0 3768 3768 0 0 # scanned=54928 # found=13 # cleaned=13 # scan_time=2846 D:\Backup C\Games\Inject.exe probably a variant of Win32/Agent.JUULLQJ trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Backup C\Games\my music\SuperOkey.zip probably a variant of Win32/SuperOkey.A application (deleted - quarantined) 00000000000000000000000000000000 C D:\Games\jufi\skypelauncher1.5-setup.exe Win32/Toolbar.Zugo application (deleted - quarantined) 00000000000000000000000000000000 C D:\Games\jufi\SoftonicDownloader_for_daemon-tools.exe a variant of Win32/SoftonicDownloader.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Games\jufi\SoftonicDownloader_for_winrar.exe a variant of Win32/SoftonicDownloader.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Games\jufi\winamp5601_full_emusic-7plus_all.exe Win32/OpenCandy application (deleted - quarantined) 00000000000000000000000000000000 C D:\Games\jufi\bass\zaki\[cheat-project.com] Steam Hack v8.0 2009-04-13.rar probably a variant of Win32/Agent.DSWPBWU trojan (deleted - quarantined) 00000000000000000000000000000000 C D:\Games\jufi\programs\McLoud iaj pishki.dll a variant of Win32/GameHack.Q application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Games\jufi\programs\McLoud iaj pishki.exe probably a variant of Win32/DllInject.E application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Games\jufi\programs\Nero Burning Rom 6.3.1.20 + KeyGen by kazichene.rar a variant of Win32/Keygen.CY application (deleted - quarantined) 00000000000000000000000000000000 C D:\Games\jufi\programs\W3XCustomKick11800.exe probably a variant of Win32/PSW.OnLineGames.MGWHUDC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\Games\jufi\programs\Nero Burning Rom 6.3.1.20 + KeyGen by kazichene\Nero Burning Rom 6.3.1.20\Keygen Nero Burning Rom 6.3.1.20.exe a variant of Win32/Keygen.CY application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C D:\hip hop\nero 7 ultra edition enhanced v7 5 9 0a eng keygen(2).exe a variant of Win32/Keygen.DA application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Деинсталирайте ESET Online Scanner...!

Деинсталирай/изтрий всички програмки, фиксове и логове които използвахме в темата (които са останали селд горните процедури).Препоръчвам да си оставите Malwarebytes' Anti-Malware и перодически да сканирате с нея.Все пак не забравяйте че това не е антивирусна програма.

Какво е състоянието на "пациента"..?Има ли нещо което да ви притеснява..?

Эа сега не,благодаря ти много

Радвам се..!Безопасен интернет ви пожелавам..!Лек ден..!