Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Поразии след conficker

Limitless
в Премахване на зловреден софтуер

Featured Replies

На тази машина по която работим:

Деинсталирайте Комбофикс така:

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

Публикувано изображение

2.Изтеглете Публикувано изображениеOTCleanIt или от тук,стартирайте и натиснете Публикувано изображение

Контролни сканирания с :

Изтеглете и разархивирайте следния файл - KidoKiller на десктопа.

Копирайте файла kk.exe в C:\

Отворете Start => Run => въведете CMD => натиснете Enter

В конзолата въведете командата:

cd c:\

Натиснете Enter

След това въведете:

kk.exe -f -n -y -l report.txt

Натиснете Enter

Ще се генерира текст файл с името report.txt в C:\

Копирайте съдържанието на лог файла в следващия си пост.

Публикувано изображение

Публикувано изображение Изтеглете Malwarebytes' Anti-Malware или от тук

* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.

* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.

* Ако има намерени обновявания, тя ще ги изтегли и инсталира.

* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.

* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.

* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.

* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.

* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог. Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Публикувано изображение Изтеглете програмата: ESET Online Scanner

  • Стартирайте esetsmartinstaller_enu.exe Публикувано изображение
  • Сложете отметка на YES, I accept the Terms of Use и изберете Start:

    Публикувано изображение

  • Скенерът ще започне да изтегля компонентите, които са му необходими:

    Публикувано изображение

  • Уверете се, че има отметки на следните редове:

    Публикувано изображение

    Накрая изберете Start

  • Скенерът ще започне да изтегля последните дефиниции.
  • След, като сканирането завърши изберете Finish.
  • Отидете в: C:\Program Files\ESET\ESET Online Scanner
  • Отворете файла log.txt , копирайте съдържанието му и го поставете в следващия си коментар.
  • Отговори 76
  • Прегледи 8,7k
  • Създадено
  • Последен отговор
  • Автор

Нека сегашната машина да наречем "V". Тя все още се сканира. Качвам DDS за следваща машина, ще я наречем "R".

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702
Run by Administrator at 9:38:28 on 2012-07-23
Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.1023.519 [GMT 3:00]
.
AV: avast! Antivirus *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesAVAST SoftwareAvastAvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:Program FilesGoogleUpdateGoogleUpdate.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSsystem32SearchIndexer.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesAdobeReader 9.0ReaderReader_sl.exe
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:Program FilesAVAST SoftwareAvastavastUI.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesWindows Desktop SearchWindowsSearch.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSsystem32SearchProtocolHost.exe
C:WINDOWSsystem32SearchFilterHost.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
C:WINDOWSsystem32svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uInternet Connection Wizard,ShellNext = ftp://192.168.0.4/
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll
uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe
mRun: [nwiz] c:program filesnvidia corporationnviewnwiz.exe /installquiet
mRun: [NvMediaCenter] RUNDLL32.EXE c:windowssystem32NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup
mRun: [Adobe Reader Speed Launcher] "c:program filesadobereader 9.0readerReader_sl.exe"
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui
StartupFolder: c:docume~1alluse~1startm~1programsstartupwindow~1.lnk - c:program fileswindows desktop searchWindowsSearch.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
TCP: Interfaces{551CCAB2-1116-4EE7-801E-45DE8C440FB6} : NameServer = 192.168.0.158
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:program fileswindows desktop searchMSNLNamespaceMgr.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-2-10 435032]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-2-10 314456]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-2-10 20568]
R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-2-10 44768]
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2011-10-28 652872]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2011-9-8 20464]
S2 ajksgdqyg;Support Security;c:windowssystem32svchost.exe -k netsvcs [2008-4-14 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:program filesgoogleupdateGoogleUpdate.exe [2010-10-20 136176]
S2 huenqcjbi;Helper Windows;c:windowssystem32svchost.exe -k netsvcs [2008-4-14 14336]
S2 nazjiypxj;Server Config;c:windowssystem32svchost.exe -k netsvcs [2008-4-14 14336]
S2 wbyfuvr;System Microsoft;c:windowssystem32svchost.exe -k netsvcs [2008-4-14 14336]
S3 cpuz135;cpuz135;??c:docume~1admini~1locals~1tempcpuz135cpuz135_x32.sys --> c:docume~1admini~1locals~1tempcpuz135cpuz135_x32.sys [?]
S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:program filesgoogleupdateGoogleUpdate.exe [2010-10-20 136176]
S3 WinRM;Windows Remote Management (WS-Management);c:windowssystem32svchost.exe -k WINRM [2008-4-14 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsmicrosoft.netframeworkv4.0.30319wpfWPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
.
==================== Find3M  ====================
.
2011-10-13 06:04:14 156691 --sha-r- c:windowssystem32axnuo.dll
.
============= FINISH:  9:40:44,29 ===============

Моля, изтеглете The Avenger и го разархивирайте на десктопа. Стартирайте avenger.exe, копирайте следния текст и го поставете в текстовото поле на програмата:

Drivers to delete:
ajksgdqyg
huenqcjbi
nazjiypxj
wbyfuvr

Уверете се, че Scan for rootkits и Automatically disable any rootkits found имат отметки.

След това изберете Execute и при въпрос от страна на програмата, кликнете върху Yes, при което компютъра ще се рестартира. След рестартта копирайте и поставете съдържанието на лог файла от програмата, намиращ се в C:avenger.txt в следващия си коментар в тази тема.

  • Автор

От компютър "R":

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform:  Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Driver "ajksgdqyg" deleted successfully.
Driver "huenqcjbi" deleted successfully.
Driver "nazjiypxj" deleted successfully.
Driver "wbyfuvr" deleted successfully.
Completed script processing.
*******************
Finished!  Terminate.

Новият DDS от компютър "R":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702
Run by rossyb at 14:40:44 on 2012-07-23
Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.1023.431 [GMT 3:00]
.
AV: avast! Antivirus *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesAVAST SoftwareAvastAvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSsystem32SearchIndexer.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32NOTEPAD.EXE
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesAdobeReader 9.0ReaderReader_sl.exe
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:WINDOWSsystem32NOTEPAD.EXE
C:Program FilesAVAST SoftwareAvastavastUI.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesWindows Desktop SearchWindowsSearch.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesInternet Exploreriexplore.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
C:WINDOWSsystem32svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uProxyServer = 192.168.0.4:3128
uProxyOverride = 192.168.0.*;127.0.0.1;192.168.10.*;<local>
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll
uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe
uRun: [MSMSGS] "c:program filesmessengermsmsgs.exe" /background
mRun: [nwiz] c:program filesnvidia corporationnviewnwiz.exe /installquiet
mRun: [NvMediaCenter] RUNDLL32.EXE c:windowssystem32NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup
mRun: [Adobe Reader Speed Launcher] "c:program filesadobereader 9.0readerReader_sl.exe"
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui
StartupFolder: c:docume~1alluse~1startm~1programsstartupwindow~1.lnk - c:program fileswindows desktop searchWindowsSearch.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: E&xport to Microsoft Excel - c:progra~1micros~2office11EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
TCP: Interfaces{551CCAB2-1116-4EE7-801E-45DE8C440FB6} : NameServer = 192.168.0.158
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:program fileswindows desktop searchMSNLNamespaceMgr.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-2-10 435032]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-2-10 314456]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-2-10 20568]
R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-2-10 44768]
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2011-10-28 652872]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2011-9-8 20464]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:program filesgoogleupdateGoogleUpdate.exe [2010-10-20 136176]
S3 cpuz135;cpuz135;??c:docume~1admini~1locals~1tempcpuz135cpuz135_x32.sys --> c:docume~1admini~1locals~1tempcpuz135cpuz135_x32.sys [?]
S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:program filesgoogleupdateGoogleUpdate.exe [2010-10-20 136176]
S3 WinRM;Windows Remote Management (WS-Management);c:windowssystem32svchost.exe -k WINRM [2008-4-14 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsmicrosoft.netframeworkv4.0.30319wpfWPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-07-12 08:14:21 -------- d-----w- c:documents and settingsrossybapplication dataSafe Software
2012-07-02 09:54:42 -------- d-----w- c:documents and settingsrossybWINDOWS
.
==================== Find3M  ====================
.
2011-10-13 06:04:14 156691 --sha-r- c:windowssystem32axnuo.dll
.
============= FINISH: 14:43:40.32 ===============
  • Автор

Компютър "R" е чист? Компютър "V" все още се сканира.

Ето от DDS от нов компютър, ще го наречем "N":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702
Run by nataln at 14:21:46 on 2012-07-23
Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.2046.1438 [GMT 3:00]
.
AV: avast! Antivirus *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesAVAST SoftwareAvastAvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesGoogleUpdateGoogleUpdate.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:WINDOWSsystem32PGPserv.exe
C:WINDOWSsystem32wdfmgr.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSExplorer.EXE
C:Program FilesJavajre6binjusched.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:Program FilesAVAST SoftwareAvastavastUI.exe
C:Program FilesMessengermsmsgs.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesPGP CorporationPGP DesktopPGPtray.exe
C:WINDOWSsystem32NOTEPAD.EXE
C:WINDOWSSystem32rundll32.exe
C:Program FilesTrueCryptTrueCrypt.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.wikimapia.org/
uProxyServer = 192.168.0.4:3128
uProxyOverride = 192.168.0.*;127.0.0.1;192.168.10.*;<local>
BHO: AcroIEHlprObj Class: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:program filesadobeacrobat 7.0activexAcroIEHelper.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll
BHO: AcroIEToolbarHelper Class: {AE7CD045-E861-484f-8273-0445EE161910} - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre6binjp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:program filesjavajre6libdeployjqsiejqs_plugin.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll
EB: Adobe PDF: {182EC0BE-5110-49C8-A062-BEB1D02A220B} - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll
uRun: [MSMSGS] "c:program filesmessengermsmsgs.exe" /background
uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe
mRun: [SunJavaUpdateSched] "c:program filesjavajre6binjusched.exe"
mRun: [NvMediaCenter] RUNDLL32.EXE c:windowssystem32NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
mRun: [KernelFaultCheck] c:windowssystem32dumprep 0 -k
mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui
StartupFolder: c:docume~1alluse~1startm~1programsstartupadobeg~1.lnk - c:program filescommon filesadobecalibrationAdobe Gamma Loader.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupmicros~1.lnk - c:program filesmicrosoft officexpoffice10OSA.EXE
StartupFolder: c:docume~1alluse~1startm~1programsstartuppgptra~1.lnk - c:windowsinstaller{65cedfcc-9449-4e14-828d-959f77411f01}Icon6560581611.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-WindowsSystem: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: Convert link target to Adobe PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
LSP: %SYSTEMROOT%system32nvappfilter.dll
LSP: c:windowssystem32PGPlsp.dll
DPF: Microsoft XML Parser for Java - file://c:windowsjavaclassesxmldso.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
TCP: Interfaces{DE35A621-3211-409A-B6C4-5137B0F2297D} : NameServer = 192.168.0.158
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:program filescommon filesmicrosoft sharedweb foldersPKMCDO.DLL
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-1-30 435032]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-1-30 314456]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-1-30 20568]
R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-1-30 44768]
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2011-9-8 655944]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2011-9-8 22344]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:windowssystem32driversnvhda32.sys [2011-11-8 119272]
S2 amiwxgoz;Config Security;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 aslaxxtxb;Boot Universal;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 btrjg;Installer Support;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 cgvpmdnnu;Support Config;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384]
S2 ebavrzxp;Universal System;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 fuzkkc;Security Universal;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 gupdate;Услуга Google Update (gupdate);c:program filesgoogleupdateGoogleUpdate.exe [2011-4-26 136176]
S2 gvqppeiz;Config Monitor;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 hndfrrltf;System Monitor;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 inrmvk;Windows System;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 jeeaqb;Update Image;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 leros;Server System;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 ltyfyzo;Boot Helper;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 nluwfj;Manager Center;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 nqhdnv;Time Windows;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 omrbts;System Windows;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 qxhhx;Task Microsoft;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 qxldkn;Security Center;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 rawutbph;Driver Shell;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 rxpywujh;Time Config;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 slmkwqm;Boot Windows;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 smlpokzkt;Boot Support;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 svawg;Windows Network;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 uchsbh;Boot Task;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 vqakcnxwe;Boot Config;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 wjbehjn;Config Helper;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 wmnda;Support Windows;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:program filesgoogleupdateGoogleUpdate.exe [2011-4-26 136176]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsmicrosoft.netframeworkv4.0.30319wpfWPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== File Associations ===============
.
ShellExec: Photoshp.exe: open=c:program filesadobephotoshop 5.5 tryoutPhotoshp.exe
.
=============== Created Last 30 ================
.
.
==================== Find3M  ====================
.
2012-07-03 10:46:44 22344 ----a-w- c:windowssystem32driversmbam.sys
1998-12-09 02:53:54 99840 ----a-w- c:program filescommon filesIRAABOUT.DLL
1998-12-09 02:53:54 70144 ----a-w- c:program filescommon filesIRAMDMTR.DLL
1998-12-09 02:53:54 48640 ----a-w- c:program filescommon filesIRALPTTR.DLL
1998-12-09 02:53:54 31744 ----a-w- c:program filescommon filesIRAWEBTR.DLL
1998-12-09 02:53:54 186368 ----a-w- c:program filescommon filesIRAREG.DLL
1998-12-09 02:53:54 17920 ----a-w- c:program filescommon filesIRASRIAL.DLL
.
============= FINISH: 14:23:59.33 ===============
  • Автор

От компютър "V" логовете:

# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=33d74bf864f6e04d9a1376de5f3fe410
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-07-23 01:34:30
# local_time=2012-07-23 04:34:30 (+0200, FLE Standard Time)
# country="Bulgaria"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=335619
# found=2
# cleaned=2
# scan_time=10611
C:Documents and SettingswizardDesktopkf141.zip Win32/PSWTool.RAS.A application (deleted - quarantined) 00000000000000000000000000000000 C
D:InstallTotal Commander 6.02Total Commander 6.02 Final + crack.zip probably a variant of Win32/Agent.HVGTUES trojan (deleted - quarantined) 00000000000000000000000000000000 C


10:03:23:675 2480 ================================================================================
10:03:23:675 2480 SystemInfo:
10:03:23:675 2480 OS Version: 5.1.2600 ServicePack: 3.0
10:03:23:675 2480 Product type: Workstation
10:03:23:675 2480 ComputerName: DATA3
10:03:23:675 2480 UserName: Administrator
10:03:23:675 2480 Windows directory: C:WINDOWS
10:03:23:675 2480 Processor architecture: Intel x86
10:03:23:675 2480 Number of processors: 1
10:03:23:675 2480 Page size: 0x1000
10:03:23:675 2480 Boot type: Normal boot
10:03:23:675 2480 ================================================================================
10:03:23:690 2480 scanning jobs ...
10:03:23:706 2480 Infected job (JobFile C:WINDOWSTasksAt1.job) was deleted
10:03:23:706 2480
10:03:23:706 2480 scanning processes ...
10:03:24:440 2480
10:03:24:440 2480 scanning threads ...
10:03:29:188 2480
10:03:29:188 2480 scanning modules in svchost.exe...
10:03:29:516 2480 scanning modules in services.exe...
10:03:29:516 2480 scanning modules in explorer.exe...
10:03:29:532 2480
10:03:29:532 2480 scanning C:WINDOWSsystem32 ...
10:05:13:865 2480 scanning C:Program FilesInternet Explorer ...
10:05:14:287 2480 scanning C:Program FilesMovie Maker ...
10:05:15:287 2480 scanning C:Program FilesWindows Media Player ...
10:05:15:740 2480 scanning C:Program FilesWindows NT ...
10:05:16:021 2480 scanning C:Documents and SettingsAdministratorApplication Data ...
10:05:34:342 2480 scanning C:DOCUME~1ADMINI~1LOCALS~1Temp ...
10:05:34:857 2480 scanning Flash drives ...
10:05:34:857 2480 scanning C: ...
10:35:25:800 2480 scanning D: ...
11:07:14:876 2480
completed
11:07:14:876 2480 Infected jobs:   1
11:07:14:876 2480 Infected files:   0
11:07:14:892 2480 Infected threads:  0
11:07:14:892 2480 Spliced functions:  0
11:07:14:892 2480 Cured files:   0
11:07:14:892 2480 Fixed registry keys:  0
11:07:14:892 2480

Malware нищо не намери.

Моля, изтеглете The Avenger и го разархивирайте на десктопа. Стартирайте avenger.exe, копирайте следния текст и го поставете в текстовото поле на програмата:

Drivers to delete:
amiwxgoz
aslaxxtxb
btrjg
cgvpmdnnu
ebavrzxp
fuzkkc
gvqppeiz
hndfrrltf
inrmvk
jeeaqb
leros
ltyfyzo
nluwfj
nqhdnv
omrbts
qxhhx
qxldkn
rawutbph
rxpywujh
slmkwqm
smlpokzkt
svawg
uchsbh
vqakcnxwe
wjbehjn
wmnda

Уверете се, че Scan for rootkits и Automatically disable any rootkits found имат отметки.

След това изберете Execute и при въпрос от страна на програмата, кликнете върху Yes, при което компютъра ще се рестартира. След рестартта копирайте и поставете съдържанието на лог файла от програмата, намиращ се в C:\avenger.txt в следващия си коментар в тази тема.

  • Автор

Здравей, това е за компютър "N" нали? Утре ще кача лога от него, защото трябва да тръгвам от офиса. Какво е състоянието на "V" и "R", изчистени ли са? :rolleyes: Поздрави и до утре!

  • Автор

Ето резултатите от "N":

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform:  Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Driver "amiwxgoz" deleted successfully.
Driver "aslaxxtxb" deleted successfully.
Driver "btrjg" deleted successfully.
Driver "cgvpmdnnu" deleted successfully.
Driver "ebavrzxp" deleted successfully.
Driver "fuzkkc" deleted successfully.
Driver "gvqppeiz" deleted successfully.
Driver "hndfrrltf" deleted successfully.
Driver "inrmvk" deleted successfully.
Driver "jeeaqb" deleted successfully.
Driver "leros" deleted successfully.
Driver "ltyfyzo" deleted successfully.
Driver "nluwfj" deleted successfully.
Driver "nqhdnv" deleted successfully.
Driver "omrbts" deleted successfully.
Driver "qxhhx" deleted successfully.
Driver "qxldkn" deleted successfully.
Driver "rawutbph" deleted successfully.
Driver "rxpywujh" deleted successfully.
Driver "slmkwqm" deleted successfully.
Driver "smlpokzkt" deleted successfully.
Driver "svawg" deleted successfully.
Driver "uchsbh" deleted successfully.
Driver "vqakcnxwe" deleted successfully.
Driver "wjbehjn" deleted successfully.
Driver "wmnda" deleted successfully.
Completed script processing.
*******************
Finished!  Terminate.

NEW DDS "N":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702
Run by Nataln at 15:31:46 on 2012-07-24
Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.2046.1487 [GMT 3:00]
.
AV: avast! Antivirus *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesAVAST SoftwareAvastAvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesGoogleUpdateGoogleUpdate.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:WINDOWSsystem32PGPserv.exe
C:WINDOWSsystem32wdfmgr.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSExplorer.EXE
C:Program FilesJavajre6binjusched.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:Program FilesAVAST SoftwareAvastavastUI.exe
C:Program FilesMessengermsmsgs.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesPGP CorporationPGP DesktopPGPtray.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.wikimapia.org/
uProxyServer = 192.168.0.4:3128
uProxyOverride = 192.168.0.*;127.0.0.1;192.168.10.*;<local>
BHO: AcroIEHlprObj Class: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:program filesadobeacrobat 7.0activexAcroIEHelper.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll
BHO: AcroIEToolbarHelper Class: {AE7CD045-E861-484f-8273-0445EE161910} - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre6binjp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:program filesjavajre6libdeployjqsiejqs_plugin.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll
EB: Adobe PDF: {182EC0BE-5110-49C8-A062-BEB1D02A220B} - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll
uRun: [MSMSGS] "c:program filesmessengermsmsgs.exe" /background
uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe
mRun: [SunJavaUpdateSched] "c:program filesjavajre6binjusched.exe"
mRun: [NvMediaCenter] RUNDLL32.EXE c:windowssystem32NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
mRun: [KernelFaultCheck] c:windowssystem32dumprep 0 -k
mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui
StartupFolder: c:docume~1alluse~1startm~1programsstartupadobeg~1.lnk - c:program filescommon filesadobecalibrationAdobe Gamma Loader.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupmicros~1.lnk - c:program filesmicrosoft officexpoffice10OSA.EXE
StartupFolder: c:docume~1alluse~1startm~1programsstartuppgptra~1.lnk - c:windowsinstaller{65cedfcc-9449-4e14-828d-959f77411f01}Icon6560581611.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:255
mPolicies-WindowsSystem: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: Convert link target to Adobe PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
LSP: %SYSTEMROOT%system32nvappfilter.dll
LSP: c:windowssystem32PGPlsp.dll
DPF: Microsoft XML Parser for Java - file://c:windowsjavaclassesxmldso.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
TCP: Interfaces{DE35A621-3211-409A-B6C4-5137B0F2297D} : NameServer = 192.168.0.158
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:program filescommon filesmicrosoft sharedweb foldersPKMCDO.DLL
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-1-30 435032]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-1-30 314456]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-1-30 20568]
R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-1-30 44768]
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2011-9-8 655944]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2011-9-8 22344]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:windowssystem32driversnvhda32.sys [2011-11-8 119272]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Услуга Google Update (gupdate);c:program filesgoogleupdateGoogleUpdate.exe [2011-4-26 136176]
S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:program filesgoogleupdateGoogleUpdate.exe [2011-4-26 136176]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsmicrosoft.netframeworkv4.0.30319wpfWPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== File Associations ===============
.
ShellExec: Photoshp.exe: open=c:program filesadobephotoshop 5.5 tryoutPhotoshp.exe
.
=============== Created Last 30 ================
.
2012-07-24 12:29:32 337408 ------w- c:windowssystem32SET1E.tmp
2012-07-24 12:29:04 333952 -c----w- c:windowssystem32dllcachesrv.sys
2012-07-24 12:28:50 337408 -c----w- c:windowssystem32dllcachenetapi32.dll
2012-07-24 12:27:42 -------- d--h--w- c:windows$hf_mig$
2012-07-24 12:27:39 455296 -c----w- c:windowssystem32dllcachemrxsmb.sys
.
==================== Find3M  ====================
.
2012-07-03 10:46:44 22344 ----a-w- c:windowssystem32driversmbam.sys
1998-12-09 02:53:54 99840 ----a-w- c:program filescommon filesIRAABOUT.DLL
1998-12-09 02:53:54 70144 ----a-w- c:program filescommon filesIRAMDMTR.DLL
1998-12-09 02:53:54 48640 ----a-w- c:program filescommon filesIRALPTTR.DLL
1998-12-09 02:53:54 31744 ----a-w- c:program filescommon filesIRAWEBTR.DLL
1998-12-09 02:53:54 186368 ----a-w- c:program filescommon filesIRAREG.DLL
1998-12-09 02:53:54 17920 ----a-w- c:program filescommon filesIRASRIAL.DLL
.
============= FINISH: 15:34:01.53 ===============

Ето и новия в дневника, ще го именоваме "Map":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 6.0.2900.2180
Run by Administrator at 15:45:17 on 2012-07-24
Microsoft Windows XP Professional  5.1.2600.2.1251.359.1033.18.254.99 [GMT 3:00]
.
.
============== Running Processes ================
.
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32inetsrvinetinfo.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:WINDOWSSystem32alg.exe
C:navnavdrvme.exe
C:WINDOWSExplorer.EXE
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32taskmgr.exe
C:WINDOWSsystem32rdpclip.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uProxyServer = 192.168.0.4:3128
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:program filesaskbardisbarbinaskBar.dll
TB: Ask Toolbar: {3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:program filesaskbardisbarbinaskBar.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:program filesaskbardisbarbinaskBar.dll
uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
TCP: Interfaces{CCFED2F2-2885-44E7-BD4B-DC50F51A565C} : NameServer = 192.168.0.158
.
================= FIREFOX ===================
.
FF - ProfilePath - c:documents and settingsadministratorapplication datamozillafirefoxprofileshfalhagm.default
FF - plugin: c:program filesk-lite codec packrealbrowserpluginsnppl3260.dll
FF - plugin: c:program filesk-lite codec packrealbrowserpluginsnprpjplug.dll
.
============= SERVICES / DRIVERS ===============
.
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2012-1-30 652360]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2012-1-30 20464]
R3 MBAMSwissArmy;MBAMSwissArmy;c:windowssystem32driversmbamswissarmy.sys [2012-6-26 40776]
S2 ASKUpgrade;ASKUpgrade;c:program filesaskbardisbarbinASKUpgrade.exe [2009-8-9 234888]
S2 qgfchvryj;Shell Windows;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
.
=============== Created Last 30 ================
.
2012-06-26 05:53:48 40776 ----a-w- c:windowssystem32driversmbamswissarmy.sys
.
==================== Find3M  ====================
.
2012-06-18 09:23:00 492146 ------r- C:dds.exe
.
============= FINISH: 15:46:07,04 ===============

Моля, изтеглете The Avenger и го разархивирайте на десктопа. Стартирайте avenger.exe, копирайте следния текст и го поставете в текстовото поле на програмата:

Drivers to delete:
qgfchvryj

Уверете се, че Scan for rootkits и Automatically disable any rootkits found имат отметки.

След това изберете Execute и при въпрос от страна на програмата, кликнете върху Yes, при което компютъра ще се рестартира. След рестартта копирайте и поставете съдържанието на лог файла от програмата, намиращ се в C:avenger.txt в следващия си коментар в тази тема.

  • Автор

Ето резултатите от машина "Map":

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform:  Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Driver "qgfchvryj" deleted successfully.
Completed script processing.
*******************
Finished!  Terminate.


DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 6.0.2900.2180
Run by Administrator at 15:00:56 on 2012-07-25
Microsoft Windows XP Professional  5.1.2600.2.1251.359.1033.18.254.43 [GMT 3:00]
.
.
============== Running Processes ================
.
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32inetsrvinetinfo.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSsystem32rdpclip.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32NOTEPAD.EXE
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uProxyServer = 192.168.0.4:3128
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:program filesaskbardisbarbinaskBar.dll
TB: Ask Toolbar: {3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:program filesaskbardisbarbinaskBar.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:program filesaskbardisbarbinaskBar.dll
uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
TCP: Interfaces{CCFED2F2-2885-44E7-BD4B-DC50F51A565C} : NameServer = 192.168.0.158
.
================= FIREFOX ===================
.
FF - ProfilePath - c:documents and settingsadministratorapplication datamozillafirefoxprofileshfalhagm.default
FF - plugin: c:program filesk-lite codec packrealbrowserpluginsnppl3260.dll
FF - plugin: c:program filesk-lite codec packrealbrowserpluginsnprpjplug.dll
.
============= SERVICES / DRIVERS ===============
.
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2012-1-30 652360]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2012-1-30 20464]
S2 ASKUpgrade;ASKUpgrade;c:program filesaskbardisbarbinASKUpgrade.exe [2009-8-9 234888]
S3 MBAMSwissArmy;MBAMSwissArmy;c:windowssystem32driversmbamswissarmy.sys [2012-6-26 40776]
.
=============== Created Last 30 ================
.
2012-06-26 05:53:48 40776 ----a-w- c:windowssystem32driversmbamswissarmy.sys
.
==================== Find3M  ====================
.
2012-06-18 09:23:00 492146 ------r- C:dds.exe
.
============= FINISH: 15:01:54,49 ===============

Ето още 1 новo попълнения към дневника.

Този ще го наречем "SQL":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 6.0.2900.2180
Run by admin at 16:43:39 on 2012-07-25
Microsoft Windows XP Professional  5.1.2600.2.1251.359.1033.18.2047.1643 [GMT 3:00]
.
.
============== Running Processes ================
.
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe
C:WINDOWSsystem32inetsrvinetinfo.exe
C:Program FilesMicrosoft SQL ServerMSSQL.1MSSQLBinnsqlservr.exe
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesMicrosoft SQL Server90Sharedsqlbrowser.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSExplorer.EXE
C:WINDOWSRTHDCPL.EXE
C:WINDOWSsystem32JMRaidTool.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uRun: [CTFMON.EXE] c:windowssystem32ctfmon.exe
uRun: [MSMSGS] "c:program filesmessengermsmsgs.exe" /background
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [SkyTel] SkyTel.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [GBB36X Configure] c:windowssystem32JMRaidTool.exe boot
mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
mRun: [Synchronization Manager] c:windowssystem32mobsync.exe /logon
dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1157449934607
DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} - hxxps://192.168.3.223:8098/tsweb/msrdp.cab
TCP: Interfaces{97EB1926-E0E5-4C47-A042-7490D14BFB3F} : NameServer = 212.50.10.50
.
============= SERVICES / DRIVERS ===============
.
.
=============== Created Last 30 ================
.
2012-07-25 06:45:24 103424 ----a-w- c:windowssystem32StartProcess_nat.dll
2012-07-24 13:41:52 -------- d-----w- c:documents and settingsadminlocal settingsapplication dataDatamap Europe Ltd
.
==================== Find3M  ====================
.
2005-02-12 01:08:02 73728 ----a-r- c:program filesIISreporter.exe
.
============= FINISH: 16:44:12,32 ===============

Ако може да ми кажете, какво е текущото състояние на "V","R","N","Map"?

Също DDS не тръгва на сървърни версии (имаме машини със Windows Server 2000/2003)?

Поздрави!

Ако може да ми кажете, какво е текущото състояние на "V","R","N","Map"?

Поздрави!

По предоставените дневници са чисти....с условието че съм видял контролни сканирания само за една машина..!

  • Автор

По предоставените дневници са чисти....с условието че съм видял контролни сканирания само за една машина..!

От всичките изброени в горния пост, логовете на Malware са чисти, няма нито един намерен вирус (всяка сутрин дори се сканират с Malware). Някакъв аналог на DDS за сървърни версии, можете ли да предложите?

  • Автор

Ето още 4 попълнения към дневника:

Тази ще я кръстим "A":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 6.0.2900.5512
Run by Administrator at 17:31:19 on 2012-07-25
Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.511.150 [GMT 3:00]
.
AV: avast! Antivirus *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:Program FilesAVAST SoftwareAvastAvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesNVIDIA CorporationNVIDIA Update Coredaemonu.exe
C:Program FilesNVIDIA CorporationNvMixerNVMixerTray.exe
C:Program FilesAdobeReader 9.0ReaderReader_sl.exe
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:Program FilesAVAST SoftwareAvastavastUI.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSsystem32ctfmon.exe
C:Program FilesPlustekOpticSlim M12DigiScan.exe
C:WINDOWSsystem32wuauclt.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
C:WINDOWSsystem32svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll
uRun: [CTFMON.EXE] c:windowssystem32ctfmon.exe
mRun: [NVMixerTray] "c:program filesnvidia corporationnvmixerNVMixerTray.exe"
mRun: [Adobe Reader Speed Launcher] "c:program filesadobereader 9.0readerReader_sl.exe"
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui
mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:windowssystem32NvMcTray.dll,NvTaskbarInit
dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE
StartupFolder: c:docume~1alluse~1startm~1programsstartupdigiscan.lnk - c:program filesplustekopticslim m12DigiScan.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupmicros~1.lnk - c:program filesmicrosoft officeofficeOSA9.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
TCP: Interfaces{30951EA7-69C4-400E-889F-6965B097AEB6} : NameServer = 192.168.0.158
.
================= FIREFOX ===================
.
FF - ProfilePath -
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-3-16 435032]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-3-16 314456]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-3-16 20568]
R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-3-16 44768]
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2012-3-12 652360]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:program filesnvidia corporationnvidia update coredaemonu.exe [2012-3-12 2348352]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2012-3-12 20464]
S3 cpuz135;cpuz135;??c:docume~1anilocals~1tempcpuz135cpuz135_x32.sys --> c:docume~1anilocals~1tempcpuz135cpuz135_x32.sys [?]
.
=============== Created Last 30 ================
.
2012-07-25 14:29:38 -------- d-----w- c:documents and settingsadministratorapplication dataMalwarebytes
.
==================== Find3M  ====================
.
.
============= FINISH: 17:33:01,45 ===============

На тази името да е "Z":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 6.0.2900.2180
Run by Administrator at 17:35:01 on 2012-07-25
Microsoft Windows XP Professional  5.1.2600.2.1251.359.1033.18.511.95 [GMT 3:00]
.
AV: avast! Antivirus *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:WINDOWSsystem32Ati2evxx.exe
C:Program FilesAVAST SoftwareAvastAvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32inetsrvinetinfo.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe
C:WINDOWSsystem32wuauclt.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSsystem32nvraidservice.exe
C:WINDOWSsystem32RunDll32.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:Program FilesAVAST SoftwareAvastavastUI.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesPlustekOpticSlim M12DigiScan.exe
C:WINDOWSsystem32wbemunsecapp.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k WudfServiceGroup
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
C:WINDOWSsystem32svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uProxyServer = 192.168.0.4:3128
uProxyOverride = <local>
BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:program filescommon filesadobeacrobatactivexAcroIEHelper.dll
BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -
uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe
mRun: [NVRaidService] c:windowssystem32nvraidservice.exe
mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
mRun: [ATICCC] "c:program filesati technologiesati.acecli.exe" runtime -Delay
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui
dRunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32
dRunOnce: [tscuninstall] c:windowssystem32tscupgrd.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupdigiscan.lnk - c:program filesplustekopticslim m12DigiScan.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupmicros~1.lnk - c:program filesmicrosoft officeoffice10OSA.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: E&xport to Microsoft Excel - c:progra~1micros~2office10EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
TCP: Interfaces{B6CCB035-6019-4EE7-8235-16071F7A65CD} : NameServer = 192.168.0.158
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:program filescommon filesmicrosoft sharedweb foldersPKMCDO.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32wpdshserviceobj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-2-10 435032]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-2-10 314456]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-2-10 20568]
R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-2-10 44768]
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2011-11-8 366640]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2011-11-8 22712]
S2 kzwiuqdim;Helper Shell;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:windowssystem32driversnmwcdnsu.sys [2011-7-11 137600]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:windowssystem32driversnmwcdnsuc.sys [2011-7-11 8576]
.
=============== Created Last 30 ================
.
.
==================== Find3M  ====================
.
.
============= FINISH: 17:37:03,04 ===============

Тази да е "S":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 6.0.2900.5512
Run by Administrator at 17:37:43 on 2012-07-25
Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.1015.619 [GMT 3:00]
.
AV: avast! Antivirus *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:Program FilesAVAST SoftwareAvastAvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSExplorer.EXE
C:Program FilesCommon FilesJavaJava Updatejusched.exe
C:WINDOWSsystem32igfxtray.exe
C:WINDOWSsystem32hkcmd.exe
C:WINDOWSsystem32igfxpers.exe
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:Program FilesAVAST SoftwareAvastavastUI.exe
C:Program FilesAdobeReader 9.0ReaderReader_sl.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre6binjp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:program filesjavajre6libdeployjqsiejqs_plugin.dll
uRun: [CTFMON.EXE] c:windowssystem32ctfmon.exe
uRun: [MSMSGS] "c:program filesmessengermsmsgs.exe" /background
mRun: [SunJavaUpdateSched] "c:program filescommon filesjavajava updatejusched.exe"
mRun: [igfxtray] c:windowssystem32igfxtray.exe
mRun: [igfxhkcmd] c:windowssystem32hkcmd.exe
mRun: [igfxpers] c:windowssystem32igfxpers.exe
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui
mRun: [Adobe Reader Speed Launcher] "c:program filesadobereader 9.0readerReader_sl.exe"
dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE
StartupFolder: c:docume~1alluse~1startm~1programsstartupmicros~1.lnk - c:program filesmicrosoft officeoffice10OSA.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: E&xport to Microsoft Excel - c:progra~1micros~2office10EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
TCP: Interfaces{37762515-D896-478C-8290-3A78DCDB1EF8} : NameServer = 192.168.0.158
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:program filescommon filesmicrosoft sharedweb foldersPKMCDO.DLL
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-2-10 435032]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-2-10 314456]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-2-10 20568]
R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-2-10 44768]
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2011-10-28 366152]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2011-10-28 22712]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384]
S2 vbeee;Windows Support;c:windowssystem32svchost.exe -k netsvcs [2008-4-14 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsmicrosoft.netframeworkv4.0.30319wpfWPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== File Associations ===============
.
ShellExec: FRONTPG.EXE: edit=c:progra~1micros~2office10FRONTPG.EXE
.
=============== Created Last 30 ================
.
.
==================== Find3M  ====================
.
2012-05-29 09:59:04 103424 ----a-w- c:windowssystem32dmeGraph_nat.dll
.
============= FINISH: 17:41:04,73 ===============

Този ще е "E":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 6.0.2900.5512
Run by Administrator at 17:27:50 on 2012-07-25
Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.1022.597 [GMT 3:00]
.
AV: avast! Antivirus *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:Program FilesAVAST SoftwareAvastAvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesMalwarebytes' Anti-Malware1mbamservice.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32nvraidservice.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSsystem32RunDLL32.exe
C:Program FilesAVAST SoftwareAvastavastUI.exe
C:Program FilesMalwarebytes' Anti-Malware1mbamgui.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32wbemunsecapp.exe
C:WINDOWSsystem32wuauclt.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
C:WINDOWSsystem32svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
BHO: AcroIEHlprObj Class: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:program filesadobeacrobat 6.0readeractivexAcroIEHelper.dll
BHO: AcroIEToolbarHelper Class: {AE7CD045-E861-484f-8273-0445EE161910} - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll
EB: Adobe PDF: {182EC0BE-5110-49C8-A062-BEB1D02A220B} - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll
uRun: [CTFMON.EXE] c:windowssystem32ctfmon.exe
mRun: [NVRaidService] c:windowssystem32nvraidservice.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malware1mbamgui.exe" /starttray
dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE
StartupFolder: c:docume~1alluse~1startm~1programsstartupaction~1.lnk - c:program filesscanneruAM32.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-WindowsSystem: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: Convert link target to Adobe PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:program filesadobeacrobat 7.0acrobatAcroIEFavClient.dll/AcroIEAppend.html
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
TCP: Interfaces{C2F5780D-1534-43CE-BCBF-4F67F45F77C6} : NameServer = 192.168.0.158
.
================= FIREFOX ===================
.
FF - ProfilePath -
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-1-30 435032]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-1-30 314456]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-1-30 20568]
R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-1-30 44768]
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malware1mbamservice.exe [2012-2-13 366640]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2012-2-13 22712]
S0 jowscrr;jowscrr;c:windowssystem32driverstshm.sys --> c:windowssystem32driverstshm.sys [?]
S2 anrwi;Image Center;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 dorebzb;Support Manager;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 dzsyyw;Windows Image;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 fomjjzs;Support Config;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 ikxkx;Server Universal;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 ipszuq;Universal Support;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 kdyhhlazh;Monitor Support;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 lzwms;Helper Monitor;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 mfffg;efprn;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 ntpkdtf;Windows Config;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 pcafhhcv;Manager Config;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 qdhzinvs;Time Network;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 qmesibuq;Driver Universal;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 qvgktrd;Security Windows;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 qwtfalt;Server Update;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 sdalrb;Microsoft Config;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 sqrigdv;Center Universal;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 twthyo;Security Task;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 uevykawpq;Center Manager;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 uflssq;Shell Server;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 utlnimj;Server Monitor;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 vekkfi;Windows Time;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 wbceyl;Monitor Server;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 xeufkhini;Monitor Universal;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 zlkhse;Task Installer;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S2 zzjplrm;Task Installer;c:windowssystem32svchost.exe -k netsvcs [2006-2-28 14336]
S3 Asushwio;Asushwio;c:windowssystem32driversASUSHWIO.SYS [2006-10-25 5824]
S3 MBAMSwissArmy;MBAMSwissArmy;c:windowssystem32driversmbamswissarmy.sys [2012-2-13 41272]
.
=============== Created Last 30 ================
.
.
==================== Find3M  ====================
.
2012-07-13 11:14:42 3350 --sha-w- c:windowssystem32KGyGaAvL.sys
.
=================== ROOTKIT  ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: NVIDIA__ rev. -> Harddisk1DR1 -> Device00000073
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe >>UNKNOWN [0x86FCAB78]<<
_asm { MOV EAX, 0x86fcaa98; XCHG [ESP], EAX; PUSH EAX; PUSH 0x86fa9c94; RET ; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL;  }
1 ntkrnlpa!IofCallDriver[0x804EE120] -> DeviceHarddisk1DR1[0x86E54AB8]
DriverDisk[0x86E52E18] -> IRP_MJ_CREATE -> 0x86FCAB78
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a;  }
detected disk devices:
detected hooks:
DriverDisk -> 0x86fcab78
user & kernel MBR OK
Warning: possible MBR rootkit infection !
.
============= FINISH: 17:28:34,25 ===============

Ако може, при мерките които трябва да се вземат, да казвате името и съответната мярка, да не стане.... :)

Поздрави!

"А" - чист

"Z" -

Моля, изтеглете The Avenger и го разархивирайте на десктопа. Стартирайте avenger.exe, копирайте следния текст и го поставете в текстовото поле на програмата:

Drivers to delete:
kzwiuqdim

Уверете се, че Scan for rootkits и Automatically disable any rootkits found имат отметки.

След това изберете Execute и при въпрос от страна на програмата, кликнете върху Yes, при което компютъра ще се рестартира. След рестартта копирайте и поставете съдържанието на лог файла от програмата, намиращ се в C:avenger.txt в следващия си коментар в тази тема.

"S" -

Drivers to delete:
vbeee

"E" - тук ще имаме малко повече работа

Моля, изтеглете The Avenger и го разархивирайте на десктопа. Стартирайте avenger.exe, копирайте следния текст и го поставете в текстовото поле на програмата:

Files to delete:
c:windowssystem32driverstshm.sys

Drivers to delete:
jowscrr
anrwi
dorebzb
dzsyyw
fomjjzs
ikxkx
ipszuq
kdyhhlazh
lzwms
mfffg
ntpkdtf
pcafhhcv
qdhzinvs
qmesibuq
qvgktrd
qwtfalt
sdalrb
sqrigdv
twthyo
uevykawpq
uflssq
utlnimj
vekkfi
wbceyl
xeufkhini
zlkhse
zzjplrm

Уверете се, че Scan for rootkits и Automatically disable any rootkits found имат отметки.

След това изберете Execute и при въпрос от страна на програмата, кликнете върху Yes, при което компютъра ще се рестартира. След рестартта копирайте и поставете съдържанието на лог файла от програмата, намиращ се в C:avenger.txt в следващия си коментар в тази тема.

+

за машина "Е"

Публикувано изображение Моля, изтеглете последната версия на TDSSKiller - оттук и я запазете на вашия декстоп.

  • Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.

    Публикувано изображение

  • Сложете отметки пред Verify Driver Digital Signature и Detect TDLFS file system и натиснете ОК.

    Публикувано изображение

  • Натиснете бутона Start Scan.

    Публикувано изображение

  • Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.

    Публикувано изображение

  • Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.

    Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

    Публикувано изображение

    Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.

  • Лог файл ще бъде създаден в свободната директория на дял C: . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

Публикувано изображение Изтеглете Gmer или от тук.

* Временно спрете Интернета си,всички работещи програми,както и антивирусната си програма.

* Стартирате програмата.

* След завършването на автомаичната експрес-проверка,махнете отметките от следните позиции:

- Sections

- IAT/EAT

- Show all

* От всички локални дискове маркирайте само системния дял (обикновенно това е C: )

Публикувано изображение

* Изчакайте програмата да завърши сканирането,след което натиснете бутона Save и запишете (save as) резултатите на десктопа с име Gmer.log.

* Включете Интернета си и прикачете Gmer.log в следващия си коментар.

Забележка:

* Ако бъде открит Rootkit, ще последва въпрос дали желаете пълно сканиране на системата. Изберете NO.

* Не предприемайте никакви действия върху редовете маркирани с "<--- ROOТKIT" ,защото това може да доведе до грешки.

* В десния панел на програмата ще видите какво е ще се провери от програмата, не променяйте нищо. Убедете се, че на Show All няма отметка.

Внимание:

Ако имате проблем с използването на GMER по по-горе описания начин,моля изпълнете сканирането,като маркирате следните позиции:

Публикувано изображение

  • Автор

Извинявай, за забавянето от днес, имах мнооооого работа :/

Качвам лога от машина "Z":

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Driver "kzwiuqdim" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.

И новият DDS от "Z":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 6.0.2900.5512
Run by Administrator at 17:25:34 on 2012-07-26
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.511.83 [GMT 3:00]
.
AV: avast! Antivirus *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:WINDOWSsystem32Ati2evxx.exe
C:Program FilesAVAST SoftwareAvastAvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32inetsrvinetinfo.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe
C:WINDOWSsystem32wuauclt.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSSystem32alg.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSsystem32nvraidservice.exe
C:WINDOWSsystem32RunDll32.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:WINDOWSsystem32wbemunsecapp.exe
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:Program FilesAVAST SoftwareAvastavastUI.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesPlustekOpticSlim M12DigiScan.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k WudfServiceGroup
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
C:WINDOWSsystem32svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uProxyServer = 192.168.0.4:3128
uProxyOverride = <local>
BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:program filescommon filesadobeacrobatactivexAcroIEHelper.dll
BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -
uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe
mRun: [NVRaidService] c:windowssystem32nvraidservice.exe
mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
mRun: [ATICCC] "c:program filesati technologiesati.acecli.exe" runtime -Delay
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui
dRunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32
dRunOnce: [tscuninstall] c:windowssystem32tscupgrd.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupdigiscan.lnk - c:program filesplustekopticslim m12DigiScan.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupmicros~1.lnk - c:program filesmicrosoft officeoffice10OSA.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-WindowsSystem: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: E&xport to Microsoft Excel - c:progra~1micros~2office10EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
TCP: Interfaces{B6CCB035-6019-4EE7-8235-16071F7A65CD} : NameServer = 192.168.0.158
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:program filescommon filesmicrosoft sharedweb foldersPKMCDO.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32wpdshserviceobj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-2-10 435032]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-2-10 314456]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-2-10 20568]
R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-2-10 44768]
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2011-11-8 366640]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2011-11-8 22712]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:windowssystem32driversnmwcdnsu.sys [2011-7-11 137600]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:windowssystem32driversnmwcdnsuc.sys [2011-7-11 8576]
.
=============== Created Last 30 ================
.
2012-07-26 14:11:23 79872 -c----w- c:windowssystem32dllcachemsxml6r.dll
2012-07-26 14:11:23 1306624 -c----w- c:windowssystem32dllcachemsxml6.dll
2012-07-26 14:11:00 9728 ------w- c:windowssystem32comsdupd.exe
2012-07-26 14:11:00 46592 ------w- c:windowssystem32driversirbus.sys
2012-07-26 14:07:11 -------- d-----w- c:windowsServicePackFiles
2012-07-26 14:06:46 294912 ------w- c:program fileswindows media playerdlimport.exe
2012-07-26 14:06:40 294912 -c----w- c:windowssystem32dllcachedlimport.exe
2012-07-26 14:03:38 19569 ----a-w- c:windows003336_.tmp
.
==================== Find3M ====================
.
.
============= FINISH: 17:27:43,04 ===============

Утре ще кача резултатите от интересния "E" и "S". На миналата страница бях качил DDS от машина "SQL", нищо не казахте за нея ? Също някаква аналогия на DDS за Windows Server, можете ли да предложите?

Поздрави!

Редактирано от Limitless (преглед на промените)

  • Автор

Резултатите от "S":

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Driver "vbeee" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.


DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 6.0.2900.5512
Run by Administrator at 9:54:05 on 2012-07-27
Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.1015.626 [GMT 3:00]
.
AV: avast! Antivirus *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:Program FilesAVAST SoftwareAvastAvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:WINDOWSExplorer.EXE
C:Program FilesCommon FilesJavaJava Updatejusched.exe
C:WINDOWSsystem32igfxtray.exe
C:WINDOWSsystem32hkcmd.exe
C:WINDOWSsystem32igfxpers.exe
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:Program FilesAVAST SoftwareAvastavastUI.exe
C:Program FilesAdobeReader 9.0ReaderReader_sl.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uProxyServer = 192.168.0.4:3128
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre6binjp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:program filesjavajre6libdeployjqsiejqs_plugin.dll
uRun: [CTFMON.EXE] c:windowssystem32ctfmon.exe
uRun: [MSMSGS] "c:program filesmessengermsmsgs.exe" /background
mRun: [SunJavaUpdateSched] "c:program filescommon filesjavajava updatejusched.exe"
mRun: [igfxtray] c:windowssystem32igfxtray.exe
mRun: [igfxhkcmd] c:windowssystem32hkcmd.exe
mRun: [igfxpers] c:windowssystem32igfxpers.exe
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui
mRun: [Adobe Reader Speed Launcher] "c:program filesadobereader 9.0readerReader_sl.exe"
dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE
StartupFolder: c:docume~1alluse~1startm~1programsstartupmicros~1.lnk - c:program filesmicrosoft officeoffice10OSA.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: E&xport to Microsoft Excel - c:progra~1micros~2office10EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
TCP: Interfaces{37762515-D896-478C-8290-3A78DCDB1EF8} : NameServer = 192.168.0.158
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:program filescommon filesmicrosoft sharedweb foldersPKMCDO.DLL
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-2-10 435032]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-2-10 314456]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-2-10 20568]
R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-2-10 44768]
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2011-10-28 366152]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2011-10-28 22712]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsmicrosoft.netframeworkv4.0.30319wpfWPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== File Associations ===============
.
ShellExec: FRONTPG.EXE: edit=c:progra~1micros~2office10FRONTPG.EXE
.
=============== Created Last 30 ================
.
2012-07-27 06:46:24 -------- d-----w- c:documents and settingsadministratorapplication dataMalwarebytes
.
==================== Find3M ====================
.
2012-05-29 09:59:04 103424 ----a-w- c:windowssystem32dmeGraph_nat.dll
.
============= FINISH: 10:00:49,56 ===============

Ето ново попълнение в дневника, да го наречем "H":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702
Run by christoa at 10:10:38 on 2012-07-27
Microsoft Windows XP Professional 5.1.2600.3.1251. 359.1033.18.1918.759 [GMT 3:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
============== Running Processes ================
.
C:windowssystem32Ati2evxx.exe
C:Program FilesMicrosoft Security ClientMsMpEng.exe
C:windowssystem32spoolsv.exe
C:Program FilesHPHPLaserJetServiceHPLaserJetService.exe
C:windowssystem32HPSIsvc.exe
C:Program FilesJavajre6binjqs.exe
C:Program FilesMicrosoft SQL Server90Sharedsqlwriter.exe
C:windowsSystem32alg.exe
C:windowsExplorer.EXE
C:Program FilesOpenVPNbinopenvpn-gui.exe
C:windowssystem32rundll32.exe
C:windowstsnpstd3.exe
C:windowsvsnpstd3.exe
C:windowsRTHDCPL.EXE
C:Program FilesATI TechnologiesATI.ACECLI.EXE
C:Program FilesApoint2KApoint.exe
C:windowsAGRSMMSG.exe
C:Program FilesSamsungKiesKiesTrayAgent.exe
C:Program FilesMicrosoft Security Clientmsseces.exe
C:Program FilesApoint2KApntex.exe
C:program filesrealrealplayerupdaterealsched.exe
C:Program FilesCommon FilesJavaJava Updatejusched.exe
C:windowssystem32ctfmon.exe
C:Program FilesSamsungKiesExternalFirmwareUpdateKiesPDLR.exe
C:Program FilesNokiaNokia SuiteNokiaSuite.exe
C:Program FilesNokiaNokia PC Suite 7PCSuite.exe
C:Program FilesNokiaNokia PC Suite 7PcSync2.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesPC Connectivity SolutionServiceLayer.exe
C:Program FilesSkypePhoneSkype.exe
C:Program FilesCommon FilesNokiaMPAPIMPAPI3s.exe
C:Program FilesScanerOpticSlimSTouch.exe
C:Program FilesPC Connectivity SolutionTransportsNclUSBSrv.exe
C:Program FilesPC Connectivity SolutionTransportsNclRSSrv.exe
C:Program FilesPC Connectivity SolutionTransportsNclMSBTSrv.exe
C:windowsMicrosoft.NETFrameworkv4.0.30319WPFWPFFontCache_v0400.exe
C:windowsSystem32wudfhost.exe
C:windowsExplorer.EXE
C:PROGRA~1MICROS~2Office10OUTLOOK.EXE
C:Documents and SettingsChristoALocal SettingsApplication DataGoogleChromeApplicationchrome.exe
C:Documents and SettingsChristoALocal SettingsApplication DataGoogleChromeApplicationchrome.exe
C:Documents and SettingsChristoALocal SettingsApplication DataGoogleChromeApplicationchrome.exe
C:Documents and SettingsChristoALocal SettingsApplication DataGoogleChromeApplicationchrome.exe
C:Documents and SettingsChristoALocal SettingsApplication DataGoogleChromeApplicationchrome.exe
C:Program FilesMicrosoft OfficeOffice10WINWORD.EXE
C:WINDOWSsystem32notepad.exe
C:Program FilesMicrosoft OfficeOffice10EXCEL.EXE
C:Program FilesCoreFTPcoreftp.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:windowsSystem32svchost.exe -k netsvcs
C:windowssystem32svchost.exe -k WudfServiceGroup
C:windowssystem32svchost.exe -k NetworkService
C:windowssystem32svchost.exe -k LocalService
C:windowssystem32svchost.exe -k LocalService
C:windowssystem32svchost.exe -k bthsvcs
C:windowssystem32svchost.exe -k imgsvc
C:windowsSystem32svchost.exe -k HTTPFilter
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.bg/
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uProxyServer = 192.168.0.4:3128
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie
dURLSearchHooks: {A3BC75A2-1F87-4686-AA43-5347D756017C} - <orphaned>
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:documents and settingsall usersapplication datarealrealplayerbrowserrecordpluginierpbrowserrecordplugin.dll
BHO: BitComet Helper: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - c:program filesbitcomettoolsBitCometBHO_1.4.12.6.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:program filesjavajre6binssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre6binjp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:program filesjavajre6libdeployjqsiejqs_plugin.dll
uRun: [Google Update] "c:documents and settingschristoalocal settingsapplication datagoogleupdateGoogleUpdate.exe" /c
uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe
uRun: [StartCCC] c:program filesati technologiesati.acecore-staticCLIStart.exe
uRun: [c:program filesnetmeternetmeter.exe] c:program filesnetmeterNetMeter.exe
uRun: [KiesHelper] c:program filessamsungkiesKiesHelper.exe /s
uRun: [KiesPDLR] c:program filessamsungkiesexternalfirmwareupdateKiesPDLR.exe
uRun: [chromium] c:documents and settingschristoalocal settingsapplication datagooglechromeapplicationchrome.exe --no-startup-window
uRun: [NokiaSuite.exe] c:program filesnokianokia suiteNokiaSuite.exe -tray
uRun: [PC Suite Tray] "c:program filesnokianokia pc suite 7PCSuite.exe" -onlytray
uRun: [Nokia.PCSync] "c:program filesnokianokia pc suite 7PcSync2.exe" /NoDialog
uRun: [Skype] "c:program filesskypephoneSkype.exe" /minimized /regrun
uRunOnce: [FlashPlayerUpdate] c:windowssystem32macromedflashFlashUtil11e_ActiveX.exe -update activex
mRun: [openvpn-gui] c:program filesopenvpnbinopenvpn-gui.exe
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [tsnpstd3] c:windowstsnpstd3.exe
mRun: [Synchronization Manager] c:windowssystem32mobsync.exe /logon
mRun: [snpstd3] c:windowsvsnpstd3.exe
mRun: [SkyTel] SkyTel.EXE
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [NeroFilterCheck] c:windowssystem32NeroCheck.exe
mRun: [ATICCC] "c:program filesati technologiesati.aceCLIStart.exe"
mRun: [Apoint] c:program filesapoint2kApoint.exe
mRun: [Alcmtr] ALCMTR.EXE
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [HPUsageTrackingLEDM] "c:program fileshphp ut ledmbinhppusg.exe" "c:program fileshphp ut ledm"
mRun: [KiesTrayAgent] c:program filessamsungkiesKiesTrayAgent.exe
mRun: [Adobe Reader Speed Launcher] "c:program filesadobereader 9.0readerReader_sl.exe"
mRun: [Adobe ARM] "c:program filescommon filesadobearm1.0AdobeARM.exe"
mRun: [MSC] "c:program filesmicrosoft security clientmsseces.exe" -hide -runkey
mRun: [TkBellExe] "c:program filesrealrealplayerupdaterealsched.exe" -osboot
mRun: [SunJavaUpdateSched] "c:program filescommon filesjavajava updatejusched.exe"
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OQBBAFYARgBSAEUARQAtAFYAMgBRAEcAUgAtAFMAWAAwAEsARwAtAEcAMABOAFYAQQAtAEIAQQBCADYAOAAtAEQARgBUAFQAUAA"&"inst=NwA3AC0ANAAzADUAMAAxADgAMAAzADMALQBUADEANgAtAFUAOAA1ACsAMQAtAEsAVgAzACsANwAtAEIAQQArADEALQBCAEEAUgA5AEcAKwAxAC0AVABCADkAKwAyAC0ARgBMACsAOQAtAFgATwAzADYAKwAxAA"&"prod=90"&"ver=9.0.872
dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE
dRun: [DWQueuedReporting] "c:progra~1common~1micros~1dwdwtrig20.exe" -t
StartupFolder: c:docume~1alluse~1startm~1programsstartupmicros~1.lnk - c:program filesmicrosoft officeoffice10OSA.EXE
StartupFolder: c:docume~1alluse~1startm~1programsstartupsmartt~1.lnk - c:program filesscaneropticslimSTouch.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: &D&ownload &with BitComet - c:program filesbitcometBitComet.exe/AddLink.htm
IE: &D&ownload all with BitComet - c:program filesbitcometBitComet.exe/AddAllLink.htm
IE: &Search - <no file>
IE: E&xport to Microsoft Excel - c:progra~1micros~2office10EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - c:program filesbitcomettoolsBitCometBHO_1.4.12.6.dll/206
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1C1BF636-D768-4AE1-A1EA-BF948F3AF9AF} - hxxp://www.sectron.com/tcp_3/nvMediaControl.Dll
DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - hxxp://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {4FEE6316-7B6F-4A6C-BD4E-4157C59A9E9D} - hxxp://static.s2g.gate5.de/ovi_maps/OviMaps_2.3.37.6.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {76A2A0AB-38B7-46DB-8E47-F10CDE4D7920} - hxxp://www.resmap.com/ecwplugins/NCS.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} - hxxps://efaktura.bg/inc/capicom.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
TCP: Interfaces{132E0423-6A1A-4EFA-A235-7BB636BCAA7F} : NameServer = 192.168.0.4
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dll
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32WPDShServiceObj.dll
mASetup: ccc-core-static - msiexec /fums {E616A801-DF44-76CA-4CD7-F84E3D77B01A} /qb
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:windowssystem32driversMpFilter.sys [2010-3-25 171064]
R1 MpKsl8dd55661;MpKsl8dd55661;c:documents and settingsall usersapplication datamicrosoftmicrosoft antimalwaredefinition updates{8353cf29-5602-47d2-94cb-52ff4cee87a2}MpKsl8dd55661.sys [2012-7-27 29904]
R2 HP LaserJet Service;HP LaserJet Service;c:program fileshphplaserjetserviceHPLaserJetService.exe [2009-6-24 136704]
R2 HPSIService;HP SI Service;c:windowssystem32HPSIsvc.exe [2011-1-19 99896]
R3 tap0801;TAP-Win32 Adapter V8;c:windowssystem32driverstap0801.sys [2006-10-1 26624]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsmicrosoft.netframeworkv4.0.30319wpfWPFFontCache_v0400.exe [2010-3-18 753504]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384]
S2 gupdate1c9d632b9c73a2;Google Update Service (gupdate1c9d632b9c73a2);c:program filesgoogleupdateGoogleUpdate.exe [2009-5-16 133104]
S2 SkypeUpdate;Skype Updater;c:program filesskypeupdaterUpdater.exe [2012-7-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32macromedflashFlashPlayerUpdateService.exe [2012-4-17 253088]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:windowssystem32driversssudbus.sys [2011-12-25 78136]
S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:program filesgoogleupdateGoogleUpdate.exe [2009-5-16 133104]
S3 mvusbews;USB EWS Device;c:windowssystem32driversmvusbews.sys [2011-1-19 17408]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:windowssystem32driversssudmdm.sys [2011-12-25 181432]
.
=============== File Associations ===============
.
FileExt: .txt: txtfile=d:downloadmepp-1.0.53.295-win32-enmapedit.exe "%1" [default=Open with MapEdit++ - 'Open' doesn't exist]
ShellExec: BitComet.exe: open="c:program filesbitcometBitComet.exe"
.
=============== Created Last 30 ================
.
2012-07-27 06:06:13 56200 ----a-w- c:documents and settingsall usersapplication datamicrosoftmicrosoft antimalwaredefinition updates{8353cf29-5602-47d2-94cb-52ff4cee87a2}offreg.dll
2012-07-27 06:06:12 29904 ----a-w- c:documents and settingsall usersapplication datamicrosoftmicrosoft antimalwaredefinition updates{8353cf29-5602-47d2-94cb-52ff4cee87a2}MpKsl8dd55661.sys
2012-07-27 05:57:27 6891424 ----a-w- c:documents and settingsall usersapplication datamicrosoftmicrosoft antimalwaredefinition updates{8353cf29-5602-47d2-94cb-52ff4cee87a2}mpengine.dll
2012-07-26 10:39:09 -------- d-----w- c:documents and settingschristoaapplication dataWAV To MP3
2012-07-26 10:39:05 -------- d-----w- c:program filesRelevantKnowledge
2012-07-26 10:37:55 -------- d-----w- c:program filesWAV To MP3
2012-07-26 10:11:48 -------- d-----r- c:program filesSkype
2012-07-25 16:30:21 -------- d-----w- c:program filescommon filesPCSuite
2012-07-25 16:28:41 19072 ----a-w- c:windowssystem32driverspccsmcfd.sys
2012-07-25 16:28:30 -------- d-----w- c:program filesPC Connectivity Solution
2012-07-25 16:02:29 8192 ----a-w- c:windowssystem32driversusbser_lowerfltj.sys
2012-07-25 16:02:27 8192 ----a-w- c:windowssystem32driversusbser_lowerflt.sys
2012-07-25 16:02:26 23168 ----a-w- c:windowssystem32driversccdcmbo.sys
2012-07-25 16:02:25 18176 ----a-w- c:windowssystem32driversccdcmb.sys
2012-07-25 15:58:38 6891424 ------w- c:documents and settingsall usersapplication datamicrosoftmicrosoft antimalwaredefinition updatesbackupmpengine.dll
.
==================== Find3M ====================
.
2012-06-18 13:47:23 73728 ----a-w- c:windowssystem32javacpl.cpl
2012-06-18 13:47:22 476936 ----a-w- c:windowssystem32npdeployJava1.dll
2012-06-18 13:47:21 472840 ----a-w- c:windowssystem32deployJava1.dll
2012-06-18 12:23:05 492146 ------r- C:dds.exe
2012-06-13 13:19:59 1866112 ----a-w- c:windowssystem32win32k.sys
2012-06-05 15:50:25 1372672 ----a-w- c:windowssystem32msxml6.dll
2012-06-05 15:50:25 1172480 ----a-w- c:windowssystem32msxml3.dll
2012-06-04 04:32:08 152576 ----a-w- c:windowssystem32schannel.dll
2012-06-02 12:19:44 22040 ----a-w- c:windowssystem32wucltui.dll.mui
2012-06-02 12:19:38 219160 ----a-w- c:windowssystem32wuaucpl.cpl
2012-06-02 12:19:38 15384 ----a-w- c:windowssystem32wuaucpl.cpl.mui
2012-06-02 12:19:34 15384 ----a-w- c:windowssystem32wuapi.dll.mui
2012-06-02 12:19:30 17944 ----a-w- c:windowssystem32wuaueng.dll.mui
2012-06-02 12:18:58 275696 ----a-w- c:windowssystem32mucltui.dll
2012-06-02 12:18:58 214256 ----a-w- c:windowssystem32muweb.dll
2012-06-02 12:18:58 17136 ----a-w- c:windowssystem32mucltui.dll.mui
2012-05-31 13:22:09 599040 ----a-w- c:windowssystem32crypt32.dll
2012-05-16 15:08:26 916992 ----a-w- c:windowssystem32wininet.dll
2012-05-16 14:50:43 499712 ----a-w- c:windowssystem32msvcp71.dll
2012-05-16 14:50:43 348160 ----a-w- c:windowssystem32msvcr71.dll
2012-05-11 14:42:33 43520 ----a-w- c:windowssystem32licmgr10.dll
2012-05-11 14:42:33 1469440 ------w- c:windowssystem32inetcpl.cpl
2012-05-11 11:38:02 385024 ----a-w- c:windowssystem32html.iec
2012-05-04 13:16:13 2148352 ----a-w- c:windowssystem32ntoskrnl.exe
2012-05-04 12:32:19 2026496 ----a-w- c:windowssystem32ntkrnlpa.exe
2012-05-02 13:46:36 139656 ----a-w- c:windowssystem32driversrdpwd.sys
.
============= FINISH: 10:13:15.57 ===============

Ето още един към дневника, да го кръстим "U":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 6.0.2900.2180
Run by ChavdarL at 11:04:13 on 2012-07-27
Microsoft Windows XP Professional  5.1.2600.2.1251.359.1033.18.255.36 [GMT 3:00]
.
AV: avast! Antivirus *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:Program FilesAVAST SoftwareAvastAvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:Program FilesSoftexwinrouteWinRServ.exe
C:Program FilesSoftexwinrouteWinRoute.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSExplorer.EXE
C:Program FilesAVAST SoftwareAvastavastUI.exe
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesOpenOffice.org 3programsoffice.exe
C:Program FilesMicrosoft OfficeOffice1033msoffice.exe
C:Program FilesOpenOffice.org 3programsoffice.bin
C:Program FilesMalwarebytes' Anti-Malwarembam.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
C:WINDOWSsystem32svchost.exe -k LocalService
C:WINDOWSsystem32svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.bg/
uInternet Connection Wizard,ShellNext = "c:program filesoutlook expressmsimn.exe"
uProxyServer = 192.168.0.4:3128
uProxyOverride = 85.91.148.*;192.168.3.*;192.168.10.*;212.95.173.*;212.39.71.*;78.128.62.110.*;95.43.213.133.*;84.54.180.185.*;195.34.97.7
.
.
BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:program filescommon filesadobeacrobatactivexAcroIEHelper.dll
uRun: [CTFMON.EXE] c:windowssystem32ctfmon.exe
uRun: [MSMSGS] "c:program filesmessengermsmsgs.exe" /background
uRun: [Google Update] "c:documents and settingschavdarllocal settingsapplication datagoogleupdateGoogleUpdate.exe" /c
mRun: [Synchronization Manager] c:windowssystem32mobsync.exe /logon
mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE
StartupFolder: c:docume~1chavdarlstartm~1programsstartupopenof~1.lnk - c:program filesopenoffice.org 3programquickstart.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupadober~1.lnk - c:program filesadobereader 8.0readerreader_sl.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupadober~2.lnk - c:program filesadobereader 8.0readerAdobeCollabSync.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupmicros~1.lnk - c:program filesmicrosoft officeofficeOSA9.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
TCP: Interfaces{B446E605-1408-4FEC-8030-631F01CE7457} : NameServer = 192.168.0.158
.
============= SERVICES / DRIVERS ===============
.
R0 WinRoute;WinRoute;SystemRootSystemRootsystem32driverswinroute.sys --> SystemRootSystemRootsystem32driverswinroute.sys [?]
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-2-6 435032]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-2-6 314456]
R1 NmPar;MosChip PCI Parallel Port;c:windowssystem32driversNmPar.sys [2008-4-7 76416]
R1 nmserial;MosChip PCI Serial Port;c:windowssystem32driversNmSerial.sys [2008-4-7 60032]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-2-6 20568]
R2 avast! Antivirus;avast! Antivirus;c:program filesavast softwareavastAvastSvc.exe [2012-2-6 44768]
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2012-2-6 366640]
R2 WinRServ;Softex WinRoute Service;c:program filessoftexwinrouteWinRServ.exe [2008-4-7 63920]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2012-2-6 22712]
S2 hwwikttf;Network Shell;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 prmwihd;mtcdlxg;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
.
=============== Created Last 30 ================
.
.
==================== Find3M  ====================
.
.
============= FINISH: 11:09:41.52 ===============

Редактирано от Limitless (преглед на промените)

  • Автор

Заветния резултат от "E":

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform:  Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!

Error:  file "c:windowssystem32driverstshm.sys" not found!
Deletion of file "c:windowssystem32driverstshm.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist
Driver "jowscrr" deleted successfully.
Driver "anrwi" deleted successfully.
Driver "dorebzb" deleted successfully.
Driver "dzsyyw" deleted successfully.
Driver "fomjjzs" deleted successfully.
Driver "ikxkx" deleted successfully.
Driver "ipszuq" deleted successfully.
Driver "kdyhhlazh" deleted successfully.
Driver "lzwms" deleted successfully.
Driver "mfffg" deleted successfully.
Driver "ntpkdtf" deleted successfully.
Driver "pcafhhcv" deleted successfully.
Driver "qdhzinvs" deleted successfully.
Driver "qmesibuq" deleted successfully.
Driver "qvgktrd" deleted successfully.
Driver "qwtfalt" deleted successfully.
Driver "sdalrb" deleted successfully.
Driver "sqrigdv" deleted successfully.
Driver "twthyo" deleted successfully.
Driver "uevykawpq" deleted successfully.
Driver "uflssq" deleted successfully.
Driver "utlnimj" deleted successfully.
Driver "vekkfi" deleted successfully.
Driver "wbceyl" deleted successfully.
Driver "xeufkhini" deleted successfully.
Driver "zlkhse" deleted successfully.
Driver "zzjplrm" deleted successfully.
Completed script processing.
*******************
Finished!  Terminate.


12:31:25.0593 3856 TDSS rootkit removing tool 2.7.48.0 Jul 24 2012 13:16:32
12:31:27.0593 3856 ============================================================
12:31:27.0593 3856 Current date / time: 2012/07/27 12:31:27.0593
12:31:27.0593 3856 SystemInfo:
12:31:27.0593 3856
12:31:27.0593 3856 OS Version: 5.1.2600 ServicePack: 3.0
12:31:27.0593 3856 Product type: Workstation
12:31:27.0593 3856 ComputerName: MAP11
12:31:27.0593 3856 UserName: Administrator
12:31:27.0593 3856 Windows directory: C:WINDOWS
12:31:27.0593 3856 System windows directory: C:WINDOWS
12:31:27.0593 3856 Processor architecture: Intel x86
12:31:27.0593 3856 Number of processors: 1
12:31:27.0593 3856 Page size: 0x1000
12:31:27.0593 3856 Boot type: Normal boot
12:31:27.0593 3856 ============================================================
12:31:28.0703 3856 Drive DeviceHarddisk0DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
12:31:28.0703 3856 Drive DeviceHarddisk1DR1 - Size: 0x7471640000 (465.77 Gb), SectorSize: 0x200, Cylinders: 0xED82, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
12:31:28.0718 3856 ============================================================
12:31:28.0718 3856 DeviceHarddisk0DR0:
12:31:28.0718 3856 MBR partitions:
12:31:28.0718 3856 DeviceHarddisk0DR0Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1D1C4542
12:31:28.0718 3856 DeviceHarddisk1DR1:
12:31:28.0718 3856 MBR partitions:
12:31:28.0718 3856 DeviceHarddisk1DR1Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x7801F1A
12:31:28.0718 3856 DeviceHarddisk1DR1Partition1: MBR, Type 0x7, StartLBA 0x7801F59, BlocksNum 0x32B86BA9
12:31:28.0718 3856 ============================================================
12:31:28.0843 3856 D: <-> DeviceHarddisk1DR1Partition1
12:31:28.0890 3856 C: <-> DeviceHarddisk1DR1Partition0
12:31:28.0921 3856 E: <-> DeviceHarddisk0DR0Partition0
12:31:28.0921 3856 ============================================================
12:31:28.0921 3856 Initialize success
12:31:28.0921 3856 ============================================================
12:32:40.0875 3980 ============================================================
12:32:40.0875 3980 Scan started
12:32:40.0875 3980 Mode: Manual; SigCheck; TDLFS;
12:32:40.0875 3980 ============================================================
12:32:41.0437 3980 Aavmker4	    (b6de0336f9f4b687b4ff57939f7b657a) C:WINDOWSsystem32driversAavmker4.sys
12:32:41.0703 3980 Aavmker4 - ok
12:32:41.0703 3980 Abiosdsk - ok
12:32:41.0718 3980 abp480n5 - ok
12:32:41.0781 3980 ACPI		    (8fd99680a539792a30e97944fdaecf17) C:WINDOWSsystem32DRIVERSACPI.sys
12:32:42.0687 3980 ACPI - ok
12:32:42.0718 3980 ACPIEC		  (9859c0f6936e723e4892d7141b1327d5) C:WINDOWSsystem32driversACPIEC.sys
12:32:42.0890 3980 ACPIEC - ok
12:32:42.0953 3980 Adobe LM Service (c1eb9968ec89fba5f3a264e2e57923ab) C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
12:32:42.0984 3980 Adobe LM Service ( UnsignedFile.Multi.Generic ) - warning
12:32:42.0984 3980 Adobe LM Service - detected UnsignedFile.Multi.Generic (1)
12:32:42.0984 3980 adpu160m - ok
12:32:43.0031 3980 AFD			 (322d0e36693d6e24a2398bee62a268cd) C:WINDOWSSystem32driversafd.sys
12:32:43.0187 3980 AFD - ok
12:32:43.0187 3980 Aha154x - ok
12:32:43.0203 3980 aic78u2 - ok
12:32:43.0218 3980 aic78xx - ok
12:32:43.0234 3980 Alerter		 (a9a3daa780ca6c9671a19d52456705b4) C:WINDOWSsystem32alrsvc.dll
12:32:43.0359 3980 Alerter - ok
12:32:43.0390 3980 ALG			 (8c515081584a38aa007909cd02020b3d) C:WINDOWSSystem32alg.exe
12:32:43.0515 3980 ALG - ok
12:32:43.0531 3980 AliIde - ok
12:32:43.0531 3980 amsint - ok
12:32:43.0593 3980 AppMgmt		 (d8849f77c0b66226335a59d26cb4edc6) C:WINDOWSSystem32appmgmts.dll
12:32:43.0750 3980 AppMgmt - ok
12:32:43.0765 3980 asc - ok
12:32:43.0765 3980 asc3350p - ok
12:32:43.0781 3980 asc3550 - ok
12:32:43.0859 3980 aspnet_state    (d33c507942299753868204cc7642fa27) C:WINDOWSMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe
12:32:43.0875 3980 aspnet_state - ok
12:32:43.0890 3980 Asushwio	    (de91d0d73c3e61e6826d98fac2fac729) C:WINDOWSsystem32driversAsushwio.sys
12:32:43.0906 3980 Asushwio ( UnsignedFile.Multi.Generic ) - warning
12:32:43.0906 3980 Asushwio - detected UnsignedFile.Multi.Generic (1)
12:32:43.0953 3980 aswFsBlk	    (054df24c92b55427e0757cfff160e4f2) C:WINDOWSsystem32driversaswFsBlk.sys
12:32:43.0953 3980 aswFsBlk - ok
12:32:44.0000 3980 aswMon2		 (ef0e9ad83380724bd6fbbb51d2d0f5b8) C:WINDOWSsystem32driversaswMon2.sys
12:32:44.0000 3980 aswMon2 - ok
12:32:44.0031 3980 aswRdr		  (352d5a48ebab35a7693b048679304831) C:WINDOWSsystem32driversaswRdr.sys
12:32:44.0031 3980 aswRdr - ok
12:32:44.0078 3980 aswSnx		  (8d34d2b24297e27d93e847319abfdec4) C:WINDOWSsystem32driversaswSnx.sys
12:32:44.0171 3980 aswSnx - ok
12:32:44.0234 3980 aswSP		   (010012597333da1f46c3243f33f8409e) C:WINDOWSsystem32driversaswSP.sys
12:32:44.0250 3980 aswSP - ok
12:32:44.0281 3980 aswTdi		  (f9f84364416658e9786235904d448d37) C:WINDOWSsystem32driversaswTdi.sys
12:32:44.0281 3980 aswTdi - ok
12:32:44.0312 3980 AsyncMac	    (b153affac761e7f5fcfa822b9c4e97bc) C:WINDOWSsystem32DRIVERSasyncmac.sys
12:32:44.0453 3980 AsyncMac - ok
12:32:44.0484 3980 atapi		   (9f3a2f5aa6875c72bf062c712cfa2674) C:WINDOWSsystem32DRIVERSatapi.sys
12:32:44.0609 3980 atapi - ok
12:32:44.0625 3980 Atdisk - ok
12:32:44.0640 3980 Atmarpc		 (9916c1225104ba14794209cfa8012159) C:WINDOWSsystem32DRIVERSatmarpc.sys
12:32:44.0781 3980 Atmarpc - ok
12:32:44.0796 3980 ATMsrvc		 (523ca82a8810f4354e6425406afbc130) C:WINDOWSSystem32ATMsrvc.exe
12:32:44.0812 3980 ATMsrvc ( UnsignedFile.Multi.Generic ) - warning
12:32:44.0812 3980 ATMsrvc - detected UnsignedFile.Multi.Generic (1)
12:32:44.0859 3980 AudioSrv	    (def7a7882bec100fe0b2ce2549188f9d) C:WINDOWSSystem32audiosrv.dll
12:32:44.0984 3980 AudioSrv - ok
12:32:45.0015 3980 audstub		 (d9f724aa26c010a217c97606b160ed68) C:WINDOWSsystem32DRIVERSaudstub.sys
12:32:45.0171 3980 audstub - ok
12:32:45.0250 3980 avast! Antivirus (996e6d052438e8d8dfd501f31560b2e0) C:Program FilesAVAST SoftwareAvastAvastSvc.exe
12:32:45.0265 3980 avast! Antivirus - ok
12:32:45.0281 3980 Beep		    (da1f27d85e0d1525f6621372e7b685e9) C:WINDOWSsystem32driversBeep.sys
12:32:45.0437 3980 Beep - ok
12:32:45.0500 3980 BITS		    (574738f61fca2935f5265dc4e5691314) C:WINDOWSsystem32qmgr.dll
12:32:45.0750 3980 BITS - ok
12:32:45.0781 3980 Browser		 (a06ce3399d16db864f55faeb1f1927a9) C:WINDOWSSystem32browser.dll
12:32:45.0906 3980 Browser - ok
12:32:45.0921 3980 cbidf2k		 (90a673fc8e12a79afbed2576f6a7aaf9) C:WINDOWSsystem32driverscbidf2k.sys
12:32:46.0093 3980 cbidf2k - ok
12:32:46.0109 3980 cd20xrnt - ok
12:32:46.0125 3980 Cdaudio		 (c1b486a7658353d33a10cc15211a873b) C:WINDOWSsystem32driversCdaudio.sys
12:32:46.0328 3980 Cdaudio - ok
12:32:46.0359 3980 Cdfs		    (c885b02847f5d2fd45a24e219ed93b32) C:WINDOWSsystem32driversCdfs.sys
12:32:46.0468 3980 Cdfs - ok
12:32:46.0500 3980 Cdrom		   (1f4260cc5b42272d71f79e570a27a4fe) C:WINDOWSsystem32DRIVERScdrom.sys
12:32:46.0625 3980 Cdrom - ok
12:32:46.0640 3980 Changer - ok
12:32:46.0656 3980 CiSvc		   (1cfe720eb8d93a7158a4ebc3ab178bde) C:WINDOWSsystem32cisvc.exe
12:32:46.0796 3980 CiSvc - ok
12:32:46.0828 3980 ClipSrv		 (34cbe729f38138217f9c80212a2a0c82) C:WINDOWSsystem32clipsrv.exe
12:32:46.0984 3980 ClipSrv - ok
12:32:47.0062 3980 clr_optimization_v2.0.50727_32 (3c4d595e7f9b747325aef28b4adcaae5) C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe
12:32:47.0109 3980 clr_optimization_v2.0.50727_32 - ok
12:32:47.0109 3980 CmdIde - ok
12:32:47.0125 3980 COMSysApp - ok
12:32:47.0140 3980 Cpqarray - ok
12:32:47.0187 3980 CryptSvc	    (3d4e199942e29207970e04315d02ad3b) C:WINDOWSSystem32cryptsvc.dll
12:32:47.0328 3980 CryptSvc - ok
12:32:47.0328 3980 dac2w2k - ok
12:32:47.0343 3980 dac960nt - ok
12:32:47.0390 3980 DcomLaunch	  (2589fe6015a316c0f5d5112b4da7b509) C:WINDOWSsystem32rpcss.dll
12:32:47.0609 3980 DcomLaunch - ok
12:32:47.0656 3980 Dhcp		    (5e38d7684a49cacfb752b046357e0589) C:WINDOWSSystem32dhcpcsvc.dll
12:32:47.0812 3980 Dhcp - ok
12:32:47.0828 3980 Disk		    (044452051f3e02e7963599fc8f4f3e25) C:WINDOWSsystem32DRIVERSdisk.sys
12:32:47.0968 3980 Disk - ok
12:32:47.0984 3980 dmadmin - ok
12:32:48.0046 3980 dmboot		  (d992fe1274bde0f84ad826acae022a41) C:WINDOWSsystem32driversdmboot.sys
12:32:48.0312 3980 dmboot - ok
12:32:48.0359 3980 dmio		    (7c824cf7bbde77d95c08005717a95f6f) C:WINDOWSsystem32driversdmio.sys
12:32:48.0500 3980 dmio - ok
12:32:48.0531 3980 dmload		  (e9317282a63ca4d188c0df5e09c6ac5f) C:WINDOWSsystem32driversdmload.sys
12:32:48.0703 3980 dmload - ok
12:32:48.0734 3980 dmserver	    (57edec2e5f59f0335e92f35184bc8631) C:WINDOWSSystem32dmserver.dll
12:32:48.0859 3980 dmserver - ok
12:32:48.0890 3980 Dnscache	    (474b4dc3983173e4b4c9740b0dac98a6) C:WINDOWSSystem32dnsrslvr.dll
12:32:49.0031 3980 Dnscache - ok
12:32:49.0093 3980 Dot3svc		 (0f0f6e687e5e15579ef4da8dd6945814) C:WINDOWSSystem32dot3svc.dll
12:32:49.0265 3980 Dot3svc - ok
12:32:49.0281 3980 dpti2o - ok
12:32:49.0328 3980 dtscsi		  (6461e57bb51a848aae26f52427b7cf9e) C:WINDOWSSystem32Driversdtscsi.sys
12:32:49.0328 3980 Suspicious file (NoAccess): C:WINDOWSSystem32Driversdtscsi.sys. md5: 6461e57bb51a848aae26f52427b7cf9e
12:32:49.0328 3980 dtscsi ( LockedFile.Multi.Generic ) - warning
12:32:49.0328 3980 dtscsi - detected LockedFile.Multi.Generic (1)
12:32:49.0359 3980 EapHost		 (2187855a7703adef0cef9ee4285182cc) C:WINDOWSSystem32eapsvc.dll
12:32:49.0484 3980 EapHost - ok
12:32:49.0515 3980 ERSvc		   (bc93b4a066477954555966d77fec9ecb) C:WINDOWSSystem32ersvc.dll
12:32:49.0640 3980 ERSvc - ok
12:32:49.0671 3980 Eventlog	    (0e776ed5f7cc9f94299e70461b7b8185) C:WINDOWSsystem32services.exe
12:32:49.0812 3980 Eventlog - ok
12:32:49.0875 3980 EventSystem	 (19a799805b24990867b00c120d300c3a) C:WINDOWSsystem32es.dll
12:32:50.0031 3980 EventSystem - ok
12:32:50.0078 3980 Fastfat		 (38d332a6d56af32635675f132548343e) C:WINDOWSsystem32driversFastfat.sys
12:32:50.0218 3980 Fastfat - ok
12:32:50.0265 3980 FastUserSwitchingCompatibility (1926899bf9ffe2602b63074971700412) C:WINDOWSSystem32shsvcs.dll
12:32:50.0406 3980 FastUserSwitchingCompatibility - ok
12:32:50.0437 3980 Fdc			 (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:WINDOWSsystem32DRIVERSfdc.sys
12:32:50.0562 3980 Fdc - ok
12:32:50.0578 3980 Fips		    (d45926117eb9fa946a6af572fbe1caa3) C:WINDOWSsystem32driversFips.sys
12:32:50.0718 3980 Fips - ok
12:32:50.0796 3980 FLEXnet Licensing Service (d778107d7c2a19d7e7a884a9f0d79581) C:Program FilesCommon FilesMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
12:32:50.0968 3980 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning
12:32:50.0968 3980 FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1)
12:32:51.0000 3980 Flpydisk	    (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:WINDOWSsystem32DRIVERSflpydisk.sys
12:32:51.0140 3980 Flpydisk - ok
12:32:51.0187 3980 FltMgr		  (b2cf4b0786f8212cb92ed2b50c6db6b0) C:WINDOWSsystem32driversfltmgr.sys
12:32:51.0312 3980 FltMgr - ok
12:32:51.0343 3980 Fs_Rec		  (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:WINDOWSsystem32driversFs_Rec.sys
12:32:51.0500 3980 Fs_Rec - ok
12:32:51.0546 3980 Ftdisk		  (6ac26732762483366c3969c9e4d2259d) C:WINDOWSsystem32DRIVERSftdisk.sys
12:32:51.0718 3980 Ftdisk - ok
12:32:51.0750 3980 Gpc			 (0a02c63c8b144bd8c86b103dee7c86a2) C:WINDOWSsystem32DRIVERSmsgpc.sys
12:32:51.0859 3980 Gpc - ok
12:32:51.0906 3980 HDAudBus	    (573c7d0a32852b48f3058cfd8026f511) C:WINDOWSsystem32DRIVERSHDAudBus.sys
12:32:52.0031 3980 HDAudBus - ok
12:32:52.0109 3980 helpsvc		 (4fcca060dfe0c51a09dd5c3843888bcd) C:WINDOWSPCHealthHelpCtrBinariespchsvc.dll
12:32:52.0234 3980 helpsvc - ok
12:32:52.0250 3980 HidServ - ok
12:32:52.0281 3980 HidUsb		  (ccf82c5ec8a7326c3066de870c06daf1) C:WINDOWSsystem32DRIVERShidusb.sys
12:32:52.0406 3980 HidUsb - ok
12:32:52.0437 3980 hkmsvc		  (8878bd685e490239777bfe51320b88e9) C:WINDOWSSystem32kmsvc.dll
12:32:52.0578 3980 hkmsvc - ok
12:32:52.0593 3980 hpn - ok
12:32:52.0640 3980 HTTP		    (f6aacf5bce2893e0c1754afeb672e5c9) C:WINDOWSsystem32DriversHTTP.sys
12:32:52.0765 3980 HTTP - ok
12:32:52.0796 3980 HTTPFilter	  (6100a808600f44d999cebdef8841c7a3) C:WINDOWSSystem32w3ssl.dll
12:32:52.0953 3980 HTTPFilter - ok
12:32:52.0953 3980 i2omgmt - ok
12:32:52.0968 3980 i2omp - ok
12:32:53.0000 3980 i8042prt	    (4a0b06aa8943c1e332520f7440c0aa30) C:WINDOWSsystem32DRIVERSi8042prt.sys
12:32:53.0140 3980 i8042prt - ok
12:32:53.0171 3980 Imapi		   (083a052659f5310dd8b6a6cb05edcf8e) C:WINDOWSsystem32DRIVERSimapi.sys
12:32:53.0312 3980 Imapi - ok
12:32:53.0375 3980 ImapiService    (30deaf54a9755bb8546168cfe8a6b5e1) C:WINDOWSsystem32imapi.exe
12:32:53.0500 3980 ImapiService - ok
12:32:53.0515 3980 ini910u - ok
12:32:53.0515 3980 IntelIde - ok
12:32:53.0546 3980 Ip6Fw		   (3bb22519a194418d5fec05d800a19ad0) C:WINDOWSsystem32driversip6fw.sys
12:32:53.0671 3980 Ip6Fw - ok
12:32:53.0703 3980 IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:WINDOWSsystem32DRIVERSipfltdrv.sys
12:32:53.0859 3980 IpFilterDriver - ok
12:32:53.0875 3980 IpInIp		  (b87ab476dcf76e72010632b5550955f5) C:WINDOWSsystem32DRIVERSipinip.sys
12:32:54.0000 3980 IpInIp - ok
12:32:54.0031 3980 IpNat		   (cc748ea12c6effde940ee98098bf96bb) C:WINDOWSsystem32DRIVERSipnat.sys
12:32:54.0187 3980 IpNat - ok
12:32:54.0218 3980 IPSec		   (23c74d75e36e7158768dd63d92789a91) C:WINDOWSsystem32DRIVERSipsec.sys
12:32:54.0343 3980 IPSec - ok
12:32:54.0359 3980 IRENUM		  (c93c9ff7b04d772627a3646d89f7bf89) C:WINDOWSsystem32DRIVERSirenum.sys
12:32:54.0484 3980 IRENUM - ok
12:32:54.0515 3980 isapnp		  (05a299ec56e52649b1cf2fc52d20f2d7) C:WINDOWSsystem32DRIVERSisapnp.sys
12:32:54.0640 3980 isapnp - ok
12:32:54.0656 3980 Kbdclass	    (463c1ec80cd17420a542b7f36a36f128) C:WINDOWSsystem32DRIVERSkbdclass.sys
12:32:54.0781 3980 Kbdclass - ok
12:32:54.0812 3980 KSecDD		  (1705745d900dabf2d89f90ebaddc7517) C:WINDOWSsystem32driversKSecDD.sys
12:32:54.0953 3980 KSecDD - ok
12:32:54.0984 3980 lanmanserver    (f385f4b02c535bffe1d70cab80838123) C:WINDOWSSystem32srvsvc.dll
12:32:55.0140 3980 lanmanserver - ok
12:32:55.0187 3980 lanmanworkstation (1b67b632786fef1c1bbaef46c2f3f2e6) C:WINDOWSSystem32wkssvc.dll
12:32:55.0328 3980 lanmanworkstation - ok
12:32:55.0343 3980 lbrtfdc - ok
12:32:55.0359 3980 LmHosts		 (a7db739ae99a796d91580147e919cc59) C:WINDOWSSystem32lmhsvc.dll
12:32:55.0484 3980 LmHosts - ok
12:32:55.0531 3980 MBAMProtector   (eca00eed9ab95489007b0ef84c7149de) C:WINDOWSsystem32driversmbam.sys
12:32:55.0531 3980 MBAMProtector - ok
12:32:55.0625 3980 MBAMService	 (37036c07983ef1024b2ff3c28aae5700) C:Program FilesMalwarebytes' Anti-Malware1mbamservice.exe
12:32:55.0703 3980 MBAMService - ok
12:32:55.0734 3980 MBAMSwissArmy   (b18225739ed9caa83ba2df966e9f43e8) C:WINDOWSsystem32driversmbamswissarmy.sys
12:32:55.0750 3980 MBAMSwissArmy - ok
12:32:55.0765 3980 Messenger	   (986b1ff5814366d71e0ac5755c88f2d3) C:WINDOWSSystem32msgsvc.dll
12:32:55.0890 3980 Messenger - ok
12:32:55.0921 3980 mnmdd		   (4ae068242760a1fb6e1a44bf4e16afa6) C:WINDOWSsystem32driversmnmdd.sys
12:32:56.0078 3980 mnmdd - ok
12:32:56.0093 3980 mnmsrvc		 (d18f1f0c101d06a1c1adf26eed16fcdd) C:WINDOWSsystem32mnmsrvc.exe
12:32:56.0234 3980 mnmsrvc - ok
12:32:56.0250 3980 Modem		   (dfcbad3cec1c5f964962ae10e0bcc8e1) C:WINDOWSsystem32driversModem.sys
12:32:56.0375 3980 Modem - ok
12:32:56.0390 3980 Mouclass	    (35c9e97194c8cfb8430125f8dbc34d04) C:WINDOWSsystem32DRIVERSmouclass.sys
12:32:56.0515 3980 Mouclass - ok
12:32:56.0546 3980 mouhid		  (b1c303e17fb9d46e87a98e4ba6769685) C:WINDOWSsystem32DRIVERSmouhid.sys
12:32:56.0703 3980 mouhid - ok
12:32:56.0734 3980 MountMgr	    (a80b9a0bad1b73637dbcbba7df72d3fd) C:WINDOWSsystem32driversMountMgr.sys
12:32:56.0859 3980 MountMgr - ok
12:32:56.0875 3980 mraid35x - ok
12:32:56.0906 3980 MRxDAV		  (11d42bb6206f33fbb3ba0288d3ef81bd) C:WINDOWSsystem32DRIVERSmrxdav.sys
12:32:57.0046 3980 MRxDAV - ok
12:32:57.0093 3980 MRxSmb		  (68755f0ff16070178b54674fe5b847b0) C:WINDOWSsystem32DRIVERSmrxsmb.sys
12:32:57.0343 3980 MRxSmb - ok
12:32:57.0375 3980 MSDTC		   (a137f1470499a205abbb9aafb3b6f2b1) C:WINDOWSsystem32msdtc.exe
12:32:57.0500 3980 MSDTC - ok
12:32:57.0515 3980 Msfs		    (c941ea2454ba8350021d774daf0f1027) C:WINDOWSsystem32driversMsfs.sys
12:32:57.0640 3980 Msfs - ok
12:32:57.0640 3980 MSIServer - ok
12:32:57.0671 3980 mssmbios	    (af5f4f3f14a8ea2c26de30f7a1e17136) C:WINDOWSsystem32DRIVERSmssmbios.sys
12:32:57.0796 3980 mssmbios - ok
12:32:57.0828 3980 MTsensor	    (d48659bb24c48345d926ecb45c1ebdf5) C:WINDOWSsystem32DRIVERSASACPI.sys
12:32:57.0859 3980 MTsensor - ok
12:32:57.0890 3980 Mup			 (2f625d11385b1a94360bfc70aaefdee1) C:WINDOWSsystem32driversMup.sys
12:32:58.0015 3980 Mup - ok
12:32:58.0062 3980 napagent	    (0102140028fad045756796e1c685d695) C:WINDOWSSystem32qagentrt.dll
12:32:58.0218 3980 napagent - ok
12:32:58.0265 3980 NDIS		    (1df7f42665c94b825322fae71721130d) C:WINDOWSsystem32driversNDIS.sys
12:32:58.0390 3980 NDIS - ok
12:32:58.0406 3980 NdisTapi	    (1ab3d00c991ab086e69db84b6c0ed78f) C:WINDOWSsystem32DRIVERSndistapi.sys
12:32:58.0546 3980 NdisTapi - ok
12:32:58.0562 3980 Ndisuio		 (f927a4434c5028758a842943ef1a3849) C:WINDOWSsystem32DRIVERSndisuio.sys
12:32:58.0687 3980 Ndisuio - ok
12:32:58.0718 3980 NdisWan		 (edc1531a49c80614b2cfda43ca8659ab) C:WINDOWSsystem32DRIVERSndiswan.sys
12:32:58.0843 3980 NdisWan - ok
12:32:58.0859 3980 NDProxy		 (6215023940cfd3702b46abc304e1d45a) C:WINDOWSsystem32driversNDProxy.sys
12:32:58.0984 3980 NDProxy - ok
12:32:59.0015 3980 NetBIOS		 (5d81cf9a2f1a3a756b66cf684911cdf0) C:WINDOWSsystem32DRIVERSnetbios.sys
12:32:59.0140 3980 NetBIOS - ok
12:32:59.0171 3980 NetBT		   (74b2b2f5bea5e9a3dc021d685551bd3d) C:WINDOWSsystem32DRIVERSnetbt.sys
12:32:59.0312 3980 NetBT - ok
12:32:59.0359 3980 NetDDE		  (b857ba82860d7ff85ae29b095645563b) C:WINDOWSsystem32netdde.exe
12:32:59.0500 3980 NetDDE - ok
12:32:59.0515 3980 NetDDEdsdm	  (b857ba82860d7ff85ae29b095645563b) C:WINDOWSsystem32netdde.exe
12:32:59.0640 3980 NetDDEdsdm - ok
12:32:59.0656 3980 Netlogon	    (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe
12:32:59.0781 3980 Netlogon - ok
12:32:59.0828 3980 Netman		  (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:WINDOWSSystem32netman.dll
12:32:59.0968 3980 Netman - ok
12:33:00.0015 3980 Nla			 (b4138e99236f0f57d4cf49bae98a0746) C:WINDOWSSystem32mswsock.dll
12:33:00.0140 3980 Nla - ok
12:33:00.0171 3980 Npfs		    (3182d64ae053d6fb034f44b6def8034a) C:WINDOWSsystem32driversNpfs.sys
12:33:00.0296 3980 Npfs - ok
12:33:00.0343 3980 Ntfs		    (78a08dd6a8d65e697c18e1db01c5cdca) C:WINDOWSsystem32driversNtfs.sys
12:33:00.0546 3980 Ntfs - ok
12:33:00.0546 3980 NtLmSsp		 (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe
12:33:00.0687 3980 NtLmSsp - ok
12:33:00.0734 3980 NtmsSvc		 (156f64a3345bd23c600655fb4d10bc08) C:WINDOWSsystem32ntmssvc.dll
12:33:00.0937 3980 NtmsSvc - ok
12:33:00.0968 3980 Null		    (73c1e1f395918bc2c6dd67af7591a3ad) C:WINDOWSsystem32driversNull.sys
12:33:01.0125 3980 Null - ok
12:33:01.0296 3980 nv			  (f597c79c46f6001d81a5d96f4d1975d9) C:WINDOWSsystem32DRIVERSnv4_mini.sys
12:33:02.0312 3980 nv ( UnsignedFile.Multi.Generic ) - warning
12:33:02.0312 3980 nv - detected UnsignedFile.Multi.Generic (1)
12:33:02.0437 3980 nvatabus	    (c03e15101f6d9e82cd9b0e7d715f5de3) C:WINDOWSsystem32driversnvatabus.sys
12:33:02.0484 3980 nvatabus - ok
12:33:02.0500 3980 NVENETFD	    (cc34564bca235ebad8b308d871efa2df) C:WINDOWSsystem32DRIVERSNVENETFD.sys
12:33:02.0515 3980 NVENETFD - ok
12:33:02.0546 3980 nvnetbus	    (46fdb8d07dd4fc81093b0acb243a525d) C:WINDOWSsystem32DRIVERSnvnetbus.sys
12:33:02.0562 3980 nvnetbus - ok
12:33:02.0593 3980 nvraid		  (b65ce56c36f573113ff2f6d0f07b7563) C:WINDOWSsystem32driversnvraid.sys
12:33:02.0609 3980 nvraid - ok
12:33:02.0640 3980 NVSvc		   (3f533748f3718891dbf94257870bd394) C:WINDOWSsystem32nvsvc32.exe
12:33:02.0671 3980 NVSvc ( UnsignedFile.Multi.Generic ) - warning
12:33:02.0671 3980 NVSvc - detected UnsignedFile.Multi.Generic (1)
12:33:02.0703 3980 NwlnkFlt	    (b305f3fad35083837ef46a0bbce2fc57) C:WINDOWSsystem32DRIVERSnwlnkflt.sys
12:33:02.0875 3980 NwlnkFlt - ok
12:33:02.0890 3980 NwlnkFwd	    (c99b3415198d1aab7227f2c88fd664b9) C:WINDOWSsystem32DRIVERSnwlnkfwd.sys
12:33:03.0062 3980 NwlnkFwd - ok
12:33:03.0140 3980 ose			 (7a56cf3e3f12e8af599963b16f50fb6a) C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE
12:33:03.0187 3980 ose - ok
12:33:03.0234 3980 Parport		 (5575faf8f97ce5e713d108c2a58d7c7c) C:WINDOWSsystem32DRIVERSparport.sys
12:33:03.0375 3980 Parport - ok
12:33:03.0390 3980 PartMgr		 (beb3ba25197665d82ec7065b724171c6) C:WINDOWSsystem32driversPartMgr.sys
12:33:03.0515 3980 PartMgr - ok
12:33:03.0531 3980 ParVdm		  (70e98b3fd8e963a6a46a2e6247e0bea1) C:WINDOWSsystem32driversParVdm.sys
12:33:03.0687 3980 ParVdm - ok
12:33:03.0703 3980 PCI			 (a219903ccf74233761d92bef471a07b1) C:WINDOWSsystem32DRIVERSpci.sys
12:33:03.0828 3980 PCI - ok
12:33:03.0828 3980 PCIDump - ok
12:33:03.0859 3980 PCIIde		  (ccf5f451bb1a5a2a522a76e670000ff0) C:WINDOWSsystem32DRIVERSpciide.sys
12:33:04.0015 3980 PCIIde - ok
12:33:04.0062 3980 Pcmcia		  (9e89ef60e9ee05e3f2eef2da7397f1c1) C:WINDOWSsystem32driversPcmcia.sys
12:33:04.0187 3980 Pcmcia - ok
12:33:04.0203 3980 PDCOMP - ok
12:33:04.0203 3980 PDFRAME - ok
12:33:04.0218 3980 PDRELI - ok
12:33:04.0218 3980 PDRFRAME - ok
12:33:04.0234 3980 perc2 - ok
12:33:04.0250 3980 perc2hib - ok
12:33:04.0296 3980 PlugPlay	    (0e776ed5f7cc9f94299e70461b7b8185) C:WINDOWSsystem32services.exe
12:33:04.0421 3980 PlugPlay - ok
12:33:04.0437 3980 PolicyAgent	 (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe
12:33:04.0562 3980 PolicyAgent - ok
12:33:04.0578 3980 PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:WINDOWSsystem32DRIVERSraspptp.sys
12:33:04.0703 3980 PptpMiniport - ok
12:33:04.0734 3980 Processor	   (a32bebaf723557681bfc6bd93e98bd26) C:WINDOWSsystem32DRIVERSprocessr.sys
12:33:04.0859 3980 Processor - ok
12:33:04.0875 3980 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe
12:33:04.0984 3980 ProtectedStorage - ok
12:33:05.0015 3980 PSched		  (09298ec810b07e5d582cb3a3f9255424) C:WINDOWSsystem32DRIVERSpsched.sys
12:33:05.0140 3980 PSched - ok
12:33:05.0187 3980 Ptilink		 (80d317bd1c3dbc5d4fe7b1678c60cadd) C:WINDOWSsystem32DRIVERSptilink.sys
12:33:05.0359 3980 Ptilink - ok
12:33:05.0359 3980 ql1080 - ok
12:33:05.0375 3980 Ql10wnt - ok
12:33:05.0390 3980 ql12160 - ok
12:33:05.0390 3980 ql1240 - ok
12:33:05.0406 3980 ql1280 - ok
12:33:05.0406 3980 RasAcd		  (fe0d99d6f31e4fad8159f690d68ded9c) C:WINDOWSsystem32DRIVERSrasacd.sys
12:33:05.0562 3980 RasAcd - ok
12:33:05.0609 3980 RasAuto		 (ad188be7bdf94e8df4ca0a55c00a5073) C:WINDOWSSystem32rasauto.dll
12:33:05.0750 3980 RasAuto - ok
12:33:05.0781 3980 Rasl2tp		 (11b4a627bc9614b885c4969bfa5ff8a6) C:WINDOWSsystem32DRIVERSrasl2tp.sys
12:33:05.0906 3980 Rasl2tp - ok
12:33:05.0968 3980 RasMan		  (76a9a3cbeadd68cc57cda5e1d7448235) C:WINDOWSSystem32rasmans.dll
12:33:06.0109 3980 RasMan - ok
12:33:06.0125 3980 RasPppoe	    (5bc962f2654137c9909c3d4603587dee) C:WINDOWSsystem32DRIVERSraspppoe.sys
12:33:06.0250 3980 RasPppoe - ok
12:33:06.0265 3980 Raspti		  (fdbb1d60066fcfbb7452fd8f9829b242) C:WINDOWSsystem32DRIVERSraspti.sys
12:33:06.0437 3980 Raspti - ok
12:33:06.0484 3980 Rdbss		   (7ad224ad1a1437fe28d89cf22b17780a) C:WINDOWSsystem32DRIVERSrdbss.sys
12:33:06.0640 3980 Rdbss - ok
12:33:06.0640 3980 RDPCDD		  (4912d5b403614ce99c28420f75353332) C:WINDOWSsystem32DRIVERSRDPCDD.sys
12:33:06.0796 3980 RDPCDD - ok
12:33:06.0828 3980 rdpdr		   (15cabd0f7c00c47c70124907916af3f1) C:WINDOWSsystem32DRIVERSrdpdr.sys
12:33:06.0968 3980 rdpdr - ok
12:33:07.0015 3980 RDPWD		   (6728e45b66f93c08f11de2e316fc70dd) C:WINDOWSsystem32driversRDPWD.sys
12:33:07.0156 3980 RDPWD - ok
12:33:07.0234 3980 RDSessMgr	   (3c37bf86641bda977c3bf8a840f3b7fa) C:WINDOWSsystem32sessmgr.exe
12:33:07.0375 3980 RDSessMgr - ok
12:33:07.0406 3980 redbook		 (f828dd7e1419b6653894a8f97a0094c5) C:WINDOWSsystem32DRIVERSredbook.sys
12:33:07.0531 3980 redbook - ok
12:33:07.0562 3980 RemoteAccess    (7e699ff5f59b5d9de5390e3c34c67cf5) C:WINDOWSSystem32mprdim.dll
12:33:07.0703 3980 RemoteAccess - ok
12:33:07.0718 3980 RemoteRegistry  (5b19b557b0c188210a56a6b699d90b8f) C:WINDOWSsystem32regsvc.dll
12:33:07.0859 3980 RemoteRegistry - ok
12:33:07.0890 3980 RpcLocator	  (aaed593f84afa419bbae8572af87cf6a) C:WINDOWSsystem32locator.exe
12:33:08.0015 3980 RpcLocator - ok
12:33:08.0062 3980 RpcSs		   (2589fe6015a316c0f5d5112b4da7b509) C:WINDOWSsystem32rpcss.dll
12:33:08.0265 3980 RpcSs - ok
12:33:08.0328 3980 RSVP		    (471b3f9741d762abe75e9deea4787e47) C:WINDOWSsystem32rsvp.exe
12:33:08.0515 3980 RSVP - ok
12:33:08.0531 3980 SamSs		   (bf2466b3e18e970d8a976fb95fc1ca85) C:WINDOWSsystem32lsass.exe
12:33:08.0656 3980 SamSs - ok
12:33:08.0687 3980 SCardSvr	    (86d007e7a654b9a71d1d7d856b104353) C:WINDOWSSystem32SCardSvr.exe
12:33:08.0843 3980 SCardSvr - ok
12:33:08.0890 3980 Schedule	    (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:WINDOWSsystem32schedsvc.dll
12:33:09.0031 3980 Schedule - ok
12:33:09.0046 3980 Secdrv		  (90a3935d05b494a5a39d37e71f09a677) C:WINDOWSsystem32DRIVERSsecdrv.sys
12:33:09.0187 3980 Secdrv - ok
12:33:09.0234 3980 seclogon	    (cbe612e2bb6a10e3563336191eda1250) C:WINDOWSSystem32seclogon.dll
12:33:09.0359 3980 seclogon - ok
12:33:09.0375 3980 SENS		    (7fdd5d0684eca8c1f68b4d99d124dcd0) C:WINDOWSsystem32sens.dll
12:33:09.0515 3980 SENS - ok
12:33:09.0531 3980 serenum		 (0f29512ccd6bead730039fb4bd2c85ce) C:WINDOWSsystem32DRIVERSserenum.sys
12:33:09.0671 3980 serenum - ok
12:33:09.0687 3980 Serial		  (cca207a8896d4c6a0c9ce29a4ae411a7) C:WINDOWSsystem32DRIVERSserial.sys
12:33:09.0796 3980 Serial - ok
12:33:09.0812 3980 Sfloppy		 (8e6b8c671615d126fdc553d1e2de5562) C:WINDOWSsystem32driversSfloppy.sys
12:33:09.0937 3980 Sfloppy - ok
12:33:09.0984 3980 SharedAccess    (83f41d0d89645d7235c051ab1d9523ac) C:WINDOWSSystem32ipnathlp.dll
12:33:10.0187 3980 SharedAccess - ok
12:33:10.0234 3980 ShellHWDetection (1926899bf9ffe2602b63074971700412) C:WINDOWSSystem32shsvcs.dll
12:33:10.0375 3980 ShellHWDetection - ok
12:33:10.0375 3980 Simbad - ok
12:33:10.0375 3980 Sparrow - ok
12:33:10.0406 3980 Spooler		 (d8e14a61acc1d4a6cd0d38aebac7fa3b) C:WINDOWSsystem32spoolsv.exe
12:33:10.0546 3980 Spooler - ok
12:33:10.0609 3980 sptd		    (e5597e0575a07824933454ae199d4bb9) C:WINDOWSsystem32Driverssptd.sys
12:33:10.0625 3980 Suspicious file (NoAccess): C:WINDOWSsystem32Driverssptd.sys. md5: e5597e0575a07824933454ae199d4bb9
12:33:10.0625 3980 sptd ( LockedFile.Multi.Generic ) - warning
12:33:10.0625 3980 sptd - detected LockedFile.Multi.Generic (1)
12:33:10.0656 3980 sr			  (76bb022c2fb6902fd5bdd4f78fc13a5d) C:WINDOWSsystem32DRIVERSsr.sys
12:33:10.0781 3980 sr - ok
12:33:10.0828 3980 srservice	   (3805df0ac4296a34ba4bf93b346cc378) C:WINDOWSsystem32srsvc.dll
12:33:10.0984 3980 srservice - ok
12:33:11.0015 3980 Srv			 (5252605079810904e31c332e241cd59b) C:WINDOWSsystem32DRIVERSsrv.sys
12:33:11.0218 3980 Srv - ok
12:33:11.0265 3980 SSDPSRV		 (0a5679b3714edab99e357057ee88fca6) C:WINDOWSSystem32ssdpsrv.dll
12:33:11.0390 3980 SSDPSRV - ok
12:33:11.0437 3980 stisvc		  (8bad69cbac032d4bbacfce0306174c30) C:WINDOWSsystem32wiaservc.dll
12:33:11.0640 3980 stisvc - ok
12:33:11.0671 3980 swenum		  (3941d127aef12e93addf6fe6ee027e0f) C:WINDOWSsystem32DRIVERSswenum.sys
12:33:11.0781 3980 swenum - ok
12:33:11.0796 3980 SwPrv - ok
12:33:11.0796 3980 symc810 - ok
12:33:11.0812 3980 symc8xx - ok
12:33:11.0828 3980 sym_hi - ok
12:33:11.0828 3980 sym_u3 - ok
12:33:11.0890 3980 SysmonLog	   (c7abbc59b43274b1109df6b24d617051) C:WINDOWSsystem32smlogsvc.exe
12:33:12.0062 3980 SysmonLog - ok
12:33:12.0093 3980 TapiSrv		 (3cb78c17bb664637787c9a1c98f79c38) C:WINDOWSSystem32tapisrv.dll
12:33:12.0250 3980 TapiSrv - ok
12:33:12.0296 3980 Tcpip		   (93ea8d04ec73a85db02eb8805988f733) C:WINDOWSsystem32DRIVERStcpip.sys
12:33:12.0500 3980 Tcpip - ok
12:33:12.0515 3980 TDPIPE		  (6471a66807f5e104e4885f5b67349397) C:WINDOWSsystem32driversTDPIPE.sys
12:33:12.0640 3980 TDPIPE - ok
12:33:12.0656 3980 TDTCP		   (c56b6d0402371cf3700eb322ef3aaf61) C:WINDOWSsystem32driversTDTCP.sys
12:33:12.0781 3980 TDTCP - ok
12:33:12.0812 3980 TermDD		  (88155247177638048422893737429d9e) C:WINDOWSsystem32DRIVERStermdd.sys
12:33:12.0937 3980 TermDD - ok
12:33:12.0984 3980 TermService	 (ff3477c03be7201c294c35f684b3479f) C:WINDOWSSystem32termsrv.dll
12:33:13.0140 3980 TermService - ok
12:33:13.0187 3980 Themes		  (1926899bf9ffe2602b63074971700412) C:WINDOWSSystem32shsvcs.dll
12:33:13.0312 3980 Themes - ok
12:33:13.0343 3980 TlntSvr		 (db7205804759ff62c34e3efd8a4cc76a) C:WINDOWSsystem32tlntsvr.exe
12:33:13.0484 3980 TlntSvr - ok
12:33:13.0500 3980 TosIde - ok
12:33:13.0531 3980 TrkWks		  (55bca12f7f523d35ca3cb833c725f54e) C:WINDOWSsystem32trkwks.dll
12:33:13.0671 3980 TrkWks - ok
12:33:13.0718 3980 Udfs		    (5787b80c2e3c5e2f56c2a233d91fa2c9) C:WINDOWSsystem32driversUdfs.sys
12:33:13.0859 3980 Udfs - ok
12:33:13.0875 3980 ultra - ok
12:33:13.0921 3980 Update		  (402ddc88356b1bac0ee3dd1580c76a31) C:WINDOWSsystem32DRIVERSupdate.sys
12:33:14.0109 3980 Update - ok
12:33:14.0140 3980 upnphost	    (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:WINDOWSSystem32upnphost.dll
12:33:14.0296 3980 upnphost - ok
12:33:14.0312 3980 UPS			 (05365fb38fca1e98f7a566aaaf5d1815) C:WINDOWSSystem32ups.exe
12:33:14.0437 3980 UPS - ok
12:33:14.0468 3980 usbehci		 (65dcf09d0e37d4c6b11b5b0b76d470a7) C:WINDOWSsystem32DRIVERSusbehci.sys
12:33:14.0593 3980 usbehci - ok
12:33:14.0625 3980 usbhub		  (1ab3cdde553b6e064d2e754efe20285c) C:WINDOWSsystem32DRIVERSusbhub.sys
12:33:14.0750 3980 usbhub - ok
12:33:14.0765 3980 usbohci		 (0daecce65366ea32b162f85f07c6753b) C:WINDOWSsystem32DRIVERSusbohci.sys
12:33:14.0890 3980 usbohci - ok
12:33:14.0921 3980 usbprint	    (a717c8721046828520c9edf31288fc00) C:WINDOWSsystem32DRIVERSusbprint.sys
12:33:15.0046 3980 usbprint - ok
12:33:15.0062 3980 usbscan		 (a0b8cf9deb1184fbdd20784a58fa75d4) C:WINDOWSsystem32DRIVERSusbscan.sys
12:33:15.0187 3980 usbscan - ok
12:33:15.0218 3980 USBSTOR		 (a32426d9b14a089eaa1d922e0c5801a9) C:WINDOWSsystem32DRIVERSUSBSTOR.SYS
12:33:15.0343 3980 USBSTOR - ok
12:33:15.0359 3980 VgaSave		 (0d3a8fafceacd8b7625cd549757a7df1) C:WINDOWSSystem32driversvga.sys
12:33:15.0468 3980 VgaSave - ok
12:33:15.0484 3980 ViaIde - ok
12:33:15.0515 3980 VolSnap		 (4c8fcb5cc53aab716d810740fe59d025) C:WINDOWSsystem32driversVolSnap.sys
12:33:15.0640 3980 VolSnap - ok
12:33:15.0671 3980 VSS			 (7a9db3a67c333bf0bd42e42b8596854b) C:WINDOWSSystem32vssvc.exe
12:33:15.0828 3980 VSS - ok
12:33:15.0875 3980 W32Time		 (54af4b1d5459500ef0937f6d33b1914f) C:WINDOWSsystem32w32time.dll
12:33:16.0031 3980 W32Time - ok
12:33:16.0046 3980 Wanarp		  (e20b95baedb550f32dd489265c1da1f6) C:WINDOWSsystem32DRIVERSwanarp.sys
12:33:16.0203 3980 Wanarp - ok
12:33:16.0218 3980 WDICA - ok
12:33:16.0265 3980 WebClient	   (77a354e28153ad2d5e120a5a8687bc06) C:WINDOWSSystem32webclnt.dll
12:33:16.0390 3980 WebClient - ok
12:33:16.0468 3980 winmgmt		 (2d0e4ed081963804ccc196a0929275b5) C:WINDOWSsystem32wbemWMIsvc.dll
12:33:16.0609 3980 winmgmt - ok
12:33:16.0656 3980 WmdmPmSN	    (c7e39ea41233e9f5b86c8da3a9f1e4a8) C:WINDOWSsystem32mspmsnsv.dll
12:33:16.0781 3980 WmdmPmSN - ok
12:33:16.0843 3980 Wmi			 (bab489a5fe26f2d0c910cf7af7e4cf92) C:WINDOWSSystem32advapi32.dll
12:33:17.0062 3980 Wmi - ok
12:33:17.0093 3980 WmiApSrv	    (e0673f1106e62a68d2257e376079f821) C:WINDOWSsystem32wbemwmiapsrv.exe
12:33:17.0234 3980 WmiApSrv - ok
12:33:17.0281 3980 wscsvc		  (7c278e6408d1dce642230c0585a854d5) C:WINDOWSsystem32wscsvc.dll
12:33:17.0421 3980 wscsvc - ok
12:33:17.0453 3980 wuauserv	    (35321fb577cdc98ce3eb3a3eb9e4610a) C:WINDOWSsystem32wuauserv.dll
12:33:17.0593 3980 wuauserv - ok
12:33:17.0640 3980 WZCSVC		  (81dc3f549f44b1c1fff022dec9ecf30b) C:WINDOWSSystem32wzcsvc.dll
12:33:17.0828 3980 WZCSVC - ok
12:33:17.0890 3980 xmlprov		 (295d21f14c335b53cb8154e5b1f892b9) C:WINDOWSSystem32xmlprov.dll
12:33:18.0046 3980 xmlprov - ok
12:33:18.0062 3980 MBR (0x1B8)	 (8f558eb6672622401da993e1e865c861) DeviceHarddisk0DR0
12:33:18.0156 3980 DeviceHarddisk0DR0 - ok
12:33:18.0187 3980 MBR (0x1B8)	 (8f558eb6672622401da993e1e865c861) DeviceHarddisk1DR1
12:33:18.0734 3980 DeviceHarddisk1DR1 - ok
12:33:18.0750 3980 Boot (0x1200)   (21582d31b3906cae6306769519f4d2cc) DeviceHarddisk0DR0Partition0
12:33:18.0750 3980 DeviceHarddisk0DR0Partition0 - ok
12:33:18.0750 3980 Boot (0x1200)   (18054e037868321564097dcdc678666d) DeviceHarddisk1DR1Partition0
12:33:18.0765 3980 DeviceHarddisk1DR1Partition0 - ok
12:33:18.0781 3980 Boot (0x1200)   (70c7b61e8258b726e0d3087d1588ccc3) DeviceHarddisk1DR1Partition1
12:33:18.0781 3980 DeviceHarddisk1DR1Partition1 - ok
12:33:18.0781 3980 ============================================================
12:33:18.0781 3980 Scan finished
12:33:18.0781 3980 ============================================================
12:33:18.0937 3972 Detected object count: 8
12:33:18.0937 3972 Actual detected object count: 8
12:34:52.0203 3972 Adobe LM Service ( UnsignedFile.Multi.Generic ) - skipped by user
12:34:52.0203 3972 Adobe LM Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:34:52.0234 3972 Asushwio ( UnsignedFile.Multi.Generic ) - skipped by user
12:34:52.0234 3972 Asushwio ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:34:52.0234 3972 ATMsrvc ( UnsignedFile.Multi.Generic ) - skipped by user
12:34:52.0234 3972 ATMsrvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:34:52.0250 3972 dtscsi ( LockedFile.Multi.Generic ) - skipped by user
12:34:52.0250 3972 dtscsi ( LockedFile.Multi.Generic ) - User select action: Skip
12:34:52.0250 3972 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
12:34:52.0250 3972 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:34:52.0250 3972 nv ( UnsignedFile.Multi.Generic ) - skipped by user
12:34:52.0250 3972 nv ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:34:52.0250 3972 NVSvc ( UnsignedFile.Multi.Generic ) - skipped by user
12:34:52.0250 3972 NVSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:34:52.0250 3972 sptd ( LockedFile.Multi.Generic ) - skipped by user
12:34:52.0250 3972 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
12:34:59.0828 3800 Deinitialize success

Лога от последната програма за "E", ще го кача самия файл, защото е твърде дълго съдържанието му.

http://dox.bg/files/dw?a=3ae83f59b5

Тук е качен въпросния лог.

Поздрави!

"H" - чист

"U" -

Моля, изтеглете The Avenger и го разархивирайте на десктопа. Стартирайте avenger.exe, копирайте следния текст и го поставете в текстовото поле на програмата:

Drivers to delete:
hwwikttf
prmwihd
mtcdlxg

Уверете се, че Scan for rootkits и Automatically disable any rootkits found имат отметки.

След това изберете Execute и при въпрос от страна на програмата, кликнете върху Yes, при което компютъра ще се рестартира. След рестартта копирайте и поставете съдържанието на лог файла от програмата, намиращ се в C:avenger.txt в следващия си коментар в тази тема.

  • Автор

Ето, още един в дневника, да го кръстим "C":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 6.0.2900.5512
Run by chavod at 15:48:58 on 2012-07-30
Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.2012.1416 [GMT 3:00]
.
FW: AVG Firewall *Disabled*
.
============== Running Processes ================
.
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSystem32SCardSvr.exe
C:Program FilesAVGAVG2012avgwdsvc.exe
C:Program FilesGigabyteEasySaverESSVR.EXE
C:Program FilesJavajre6binjqs.exe
C:WINDOWSsystem32KaraokeSer.exe
C:Program FilesAVGAVG2012avgnsx.exe
C:Program FilesAVGAVG2012avgemcx.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:Program FilesNeroUpdateNASvc.exe
??C:Program FilesAVGAVG2012avgrsx.exe
C:WINDOWSsystem32userinit.exe
??C:Program FilesAVGAVG2012avgcsrvx.exe
C:Program FilesSplashtopSplashtop ConnectBackService.exe
C:Program FilesSplashtopSplashtop Connect Firefox Software UpdaterWCUService.exe
C:Program FilesAVGAVG2012AVGIDSAgent.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSExplorer.EXE
C:Program FilesVIAVIAudioiHDADeckHDeck.exe
C:WINDOWSsystem32igfxtray.exe
C:WINDOWSsystem32hkcmd.exe
C:WINDOWSsystem32igfxpers.exe
C:Program FilesAVGAVG2012avgtray.exe
C:Program FilesCommon FilesJavaJava Updatejusched.exe
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:Program FilesSplashtopSplashtop ConnectZyngaGamesAgent.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:Program FilesAdobeReader 10.0ReaderReader_sl.exe
C:Program Filescharismathicssmart security interface 4.7CSPregtool.exe
C:WINDOWSsystem32wbemunsecapp.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.bg/ig?hl=bg&amp;source=iglk
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
mDefault_Search_URL = hxxp://www.google.com/ie
uProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll
BHO: AVG Do Not Track: {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - c:program filesavgavg2012avgdtiex.dll
BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:program filesavgavg2012avgssie.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:program filesjavajre6binssv.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogle toolbarGoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:program filesgooglegoogletoolbarnotifier5.7.7227.1100swg.dll
BHO: Nero Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:program filesask.comGenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesjavajre6binjp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:program filesjavajre6libdeployjqsiejqs_plugin.dll
TB: Nero Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:program filesask.comGenericAskToolbar.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:program filesgooglegoogle toolbarGoogleToolbar_32.dll
TB: Nero Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:program filesask.comGenericAskToolbar.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogle toolbarGoogleToolbar_32.dll
uRun: [CTFMON.EXE] c:windowssystem32ctfmon.exe
uRun: [QuickTime Task] "c:program filesquicktimeQTTask.exe" -atboottime
uRun: [MSMSGS] "c:program filesmessengermsmsgs.exe" /background
uRun: [Google Update] "c:documents and settingschavodlocal settingsapplication datagoogleupdateGoogleUpdate.exe" /c
uRun: [swg] "c:program filesgooglegoogletoolbarnotifierGoogleToolbarNotifier.exe"
mRun: [HDAudDeck] c:program filesviaviaudioihdadeckHDeck.exe 1
mRun: [IgfxTray] c:windowssystem32igfxtray.exe
mRun: [HotKeysCmds] c:windowssystem32hkcmd.exe
mRun: [Persistence] c:windowssystem32igfxpers.exe
mRun: [AVG_TRAY] "c:program filesavgavg2012avgtray.exe"
mRun: [SunJavaUpdateSched] "c:program filescommon filesjavajava updatejusched.exe"
mRun: [Adobe ARM] "c:program filescommon filesadobearm1.0AdobeARM.exe"
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
mRun: [KernelFaultCheck] c:windowssystem32dumprep 0 -k
mRun: [APSDaemon] "c:program filescommon filesappleapple application supportAPSDaemon.exe"
mRun: [ZyngaGamesAgent] "c:program filessplashtopsplashtop connectZyngaGamesAgent.exe"
mRun: [QuickTime Task] "c:program filesquicktimeQTTask.exe" -atboottime
dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE
StartupFolder: c:docume~1alluse~1startm~1programsstartupmicros~1.lnk - c:program filesmicrosoft officeofficeOSA9.EXE
StartupFolder: c:docume~1alluse~1startm~1programsstartupsmarts~1.lnk - c:program filescharismathicssmart security interface 4.7CSPregtool.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:255
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - c:program filesavgavg2012avgdtiex.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} - hxxps://online.bulbank.bg/capicom.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 192.168.0.4
TCP: Interfaces{4936512D-994F-422F-9418-31C0A6964681} : DHCPNameServer = 192.168.0.4
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:program filesavgavg2012avgpp.dll
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHX;AVGIDSHX;c:windowssystem32driversavgidshx.sys [2012-4-19 24896]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:windowssystem32driversavgrkx86.sys [2011-7-11 31952]
R1 AppleCharger;AppleCharger;c:windowssystem32driversAppleCharger.sys [2011-9-9 18544]
R1 Avgldx86;AVG AVI Loader Driver;c:windowssystem32driversavgldx86.sys [2011-7-11 235216]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:windowssystem32driversavgmfx86.sys [2011-8-8 41040]
R1 Avgtdix;AVG TDI Driver;c:windowssystem32driversavgtdix.sys [2011-7-11 301248]
R2 AVGIDSAgent;AVGIDSAgent;c:program filesavgavg2012avgidsagent.exe [2012-7-4 5160568]
R2 avgwd;AVG WatchDog;c:program filesavgavg2012avgwdsvc.exe [2012-2-14 193288]
R2 ES lite Service;ES lite Service for program management.;c:program filesgigabyteeasysaveressvr.exe [2011-9-9 68136]
R2 KaraokeService;VIA Karaoke digital mixer Service;c:windowssystem32KaraokeSer.exe [2011-9-9 88688]
R2 MBAMService;MBAMService;c:program filesmalwarebytes' anti-malwarembamservice.exe [2011-10-20 655944]
R2 NAUpdate;@c:program filesneroupdatenasvc.exe,-200;c:program filesneroupdateNASvc.exe [2011-7-22 690472]
R2 SCBackService;Splashtop Connect Service;c:program filessplashtopsplashtop connectBackService.exe [2010-11-15 477000]
R2 WCUService_STC_FF;Splashtop Connect Firefox Software Updater Service;c:program filessplashtopsplashtop connect firefox software updaterWCUService.exe [2011-3-24 493384]
R3 AVGIDSDriver;AVGIDSDriver;c:windowssystem32driversavgidsdriverx.sys [2011-12-23 139856]
R3 AVGIDSFilter;AVGIDSFilter;c:windowssystem32driversavgidsfilterx.sys [2011-12-23 24144]
R3 AVGIDSShim;AVGIDSShim;c:windowssystem32driversavgidsshimx.sys [2011-12-23 17232]
R3 L1c;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:windowssystem32driversl1c51x86.sys [2011-9-9 61552]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2011-10-20 22344]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:windowssystem32driversviahduaa.sys [2011-9-9 2804720]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384]
S2 gupdate;?????? ?? Google ???????????? (gupdate);c:program filesgoogleupdateGoogleUpdate.exe [2011-9-9 136176]
S3 A38CCID;CCID USB Smart Card Reader;c:windowssystem32driversa38ccid.sys [2011-9-16 37888]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32macromedflashFlashPlayerUpdateService.exe [2012-4-6 250056]
S3 AppleChargerSrv;AppleChargerSrv;system32AppleChargerSrv.exe --> system32AppleChargerSrv.exe [?]
S3 gupdatem;?????? ?? Google ???????????? (gupdatem);c:program filesgoogleupdateGoogleUpdate.exe [2011-9-9 136176]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsmicrosoft.netframeworkv4.0.30319wpfWPFFontCache_v0400.exe [2010-3-18 753504]
S3 xaicik;xaicik;??c:windowssystem3203.tmp --> c:windowssystem3203.tmp [?]
.
=============== Created Last 30 ================
.
2012-07-30 12:44:49 135168 ----a-w- C:zip.exe
2012-07-30 12:23:53 -------- d--h--w- c:windows$hf_mig$
2012-07-30 12:23:52 455296 -c----w- c:windowssystem32dllcachemrxsmb.sys
.
==================== Find3M  ====================
.
2012-07-30 12:47:53 17488 ----a-w- c:windowsgdrv.sys
2012-07-30 09:41:12 70344 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl
2012-07-30 09:41:12 426184 ----a-w- c:windowssystem32FlashPlayerApp.exe
2012-07-03 10:46:44 22344 ----a-w- c:windowssystem32driversmbam.sys
.
============= FINISH: 15:49:13.26 ===============

Какво е състоянието на "E"? На предишната страница, бях постнал DDS за машина "SQL", тя как е :rolleyes:

Поздрави!

  • Автор

Резултатът от "U":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 6.0.2900.5512
Run by ChavdarL at 11:34:57 on 2012-07-31
Microsoft Windows XP Professional  5.1.2600.3.1251.359.1033.18.255.38 [GMT 3:00]
.
AV: avast! Antivirus *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:Program FilesAVAST SoftwareAvastAvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:Program FilesSoftexwinrouteWinRServ.exe
C:Program FilesSoftexwinrouteWinRoute.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSsystem32wscntfy.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32NOTEPAD.EXE
C:Program FilesAVAST SoftwareAvastavastUI.exe
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesMicrosoft OfficeOffice1033msoffice.exe
C:Program FilesOpenOffice.org 3programsoffice.exe
C:Program FilesOpenOffice.org 3programsoffice.bin
C:Program FilesInternet Exploreriexplore.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
C:WINDOWSsystem32svchost.exe -k LocalService
C:WINDOWSsystem32svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.bg/
uInternet Connection Wizard,ShellNext = "c:program filesoutlook expressmsimn.exe"
uProxyServer = 192.168.0.4:3128
uProxyOverride = 85.91.148.*;192.168.3.*;192.168.10.*;212.95.173.*;212.39.71.*;78.128.62.110.*;95.43.213.133.*;84.54.180.185.*;195.34.97.7
.
.
BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:program filescommon filesadobeacrobatactivexAcroIEHelper.dll
uRun: [CTFMON.EXE] c:windowssystem32ctfmon.exe
uRun: [MSMSGS] "c:program filesmessengermsmsgs.exe" /background
uRun: [Google Update] "c:documents and settingschavdarllocal settingsapplication datagoogleupdateGoogleUpdate.exe" /c
mRun: [Synchronization Manager] c:windowssystem32mobsync.exe /logon
mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE
StartupFolder: c:docume~1chavdarlstartm~1programsstartupopenof~1.lnk - c:program filesopenoffice.org 3programquickstart.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupadober~1.lnk - c:program filesadobereader 8.0readerreader_sl.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupadober~2.lnk - c:program filesadobereader 8.0readerAdobeCollabSync.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupmicros~1.lnk - c:program filesmicrosoft officeofficeOSA9.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:255
mPolicies-WindowsSystem: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
TCP: Interfaces{B446E605-1408-4FEC-8030-631F01CE7457} : NameServer = 192.168.0.158
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-2-6 435032]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-2-6 314456]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-2-6 20568]
.
=============== Created Last 30 ================
.
2012-07-27 09:36:19 79872 -c----w- c:windowssystem32dllcachemsxml6r.dll
2012-07-27 09:36:19 1372672 -c----w- c:windowssystem32dllcachemsxml6.dll
2012-07-27 09:34:59 76800 ------w- c:windowssystem32qutil.dll
2012-07-27 09:27:54 294912 ------w- c:program fileswindows media playerdlimport.exe
2012-07-27 09:27:43 294912 -c----w- c:windowssystem32dllcachedlimport.exe
2012-07-27 09:20:02 19569 ----a-w- c:windows003088_.tmp
2012-07-27 09:19:29 -------- d-----w- c:windowssystem32ReinstallBackups
.
==================== Find3M  ====================
.
.
============= FINISH: 11:44:32.41 ===============


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform:  Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Driver "hwwikttf" deleted successfully.
Driver "prmwihd" deleted successfully.
Error:  registry key "RegistryMachineSystemCurrentControlSetServicesmtcdlxg" not found!
Deletion of driver "mtcdlxg" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist

Completed script processing.
*******************
Finished!  Terminate.

Можете ли да ми препоръчате нещо за Windows Server?

Не ми казахте какво е състоянието на "E", "SQL", "C"?

Поздрави!

  • Автор

Ето още един в дневника, да го наречем "I":

DDS (Ver_2011-09-30.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702
Run by account at 11:59:59 on 2012-08-01
Microsoft Windows XP Professional  5.1.2600.3.1251. 359.1033.18.511.149 [GMT 3:00]
.
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:Program FilesAVAST SoftwareAvastAvastSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSystem32SCardSvr.exe
C:WINDOWSsystem32cisvc.exe
C:Program FilesGoogleUpdateGoogleUpdate.exe
C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe
C:WINDOWSSystem32spoolDRIVERSW32X863HP1006MC.EXE
C:WINDOWSSystem32alg.exe
C:WINDOWSsystem32cidaemon.exe
C:WINDOWSsystem32wscntfy.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSExplorer.EXE
C:Program FilesJavajre1.6.0_06binjusched.exe
C:Program FilesGoogleGoogle Talkgoogletalk.exe
C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe
C:Program FilesAVAST SoftwareAvastavastUI.exe
C:DOCUME~1accountLOCALS~1TempRar$EX00.891NetMeter.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:Program FilesMessengermsmsgs.exe
C:Program Filescv cryptovisioncv act sc interfaceRegisterTool.exe
C:Program Filescharismathicssmart security interface 4.3CSPregtool.exe
C:Program FilesOutlook Expressmsimn.exe
C:Program FilesOpenOffice.org 2.0programsoffice.exe
C:Program FilesOpenOffice.org 2.0programsoffice.BIN
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesInternet Exploreriexplore.exe
C:WINDOWSexplorer.exe
C:NavZaplnavzapl.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
C:WINDOWSsystem32svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxps://online.bulbank.bg/page/default.aspx?xml_id=/bg-BG/.login
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uProxyServer = 192.168.0.4:3128
uProxyOverride = 192.168.10.*;192.168.0.*;127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mWinlogon: Userinit = c:windowssystem32userinit.exe,c:documents and settingsaccountsmcs.exe -init,
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll
BHO: SSVHelper Class: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:program filesjavajre1.6.0_06binssv.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogle toolbarGoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:program filesgooglegoogletoolbarnotifier5.7.7227.1100swg.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:program filesgooglegoogle toolbarGoogleToolbar_32.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:program filesavast softwareavastaswWebRepIE.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogle toolbarGoogleToolbar_32.dll
uRun: [c:docume~1accountlocals~1temprar$ex00.891netmeter.exe] c:docume~1accountlocals~1temprar$ex00.891NetMeter.exe
uRun: [swg] "c:program filesgooglegoogletoolbarnotifierGoogleToolbarNotifier.exe"
uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe
uRun: [MSMSGS] "c:program filesmessengermsmsgs.exe" /background
mRun: [SunJavaUpdateSched] "c:program filesjavajre1.6.0_06binjusched.exe"
mRun: [googletalk] c:program filesgooglegoogle talkgoogletalk.exe /autostart
mRun: [Adobe Reader Speed Launcher] "c:program filesadobereader 9.0readerReader_sl.exe"
mRun: [Malwarebytes' Anti-Malware] "c:program filesmalwarebytes' anti-malwarembamgui.exe" /starttray
mRun: [avast] "c:program filesavast softwareavastavastUI.exe" /nogui
dRun: [CTFMON.EXE] c:windowssystem32CTFMON.EXE
StartupFolder: c:docume~1accountstartm~1programsstartupopenof~1.lnk - c:program filesopenoffice.org 2.0programquickstart.exe
StartupFolder: c:docume~1accountstartm~1programsstartupshortc~1.lnk - c:navzaplnavdrvme.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupcvacts~1.lnk - c:program filescv cryptovisioncv act sc interfaceRegisterTool.exe
StartupFolder: c:docume~1alluse~1startm~1programsstartupmicros~1.lnk - c:program filesmicrosoft officeofficeOSA9.EXE
StartupFolder: c:docume~1alluse~1startm~1programsstartupsmarts~1.lnk - c:program filescharismathicssmart security interface 4.3CSPregtool.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-WindowsSystem: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: Add to Google Photos Screensa&ver - c:windowssystem32GPhotos.scr/200
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC} - c:program filesjavajre1.6.0_06binssv.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} - hxxp://picasaweb.google.com/s/v/69.19/uploader2.cab
DPF: {500A3316-5B0E-4253-BBE5-CE3F11A1AE71} - hxxps://inetdec.nra.bg/dds/InetVAT5Frm.cab
DPF: {5554DCB0-700B-498D-9B58-4E40E5814405} - hxxp://appreports.nssi.bg/ReportBulstatAll/Reserved.ReportViewerWebControl.axd?Culture=1033&CultureOverrides=True&UICulture=1033&UICultureOverrides=True&ReportStack=1&ControlID=3204cab895314eee91e2cb506cb9a58e&Mode=true&OpType=PrintCab&Arch=X86
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://javadl.sun.com/webapps/download/AutoDL?BundleId=21871
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {97EA2A5E-A821-48A1-B0F9-DEDB5E0E62A2} - hxxps://inetdec.nra.bg/cabs/SignCOM.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
TCP: Interfaces{06C752D6-94EA-4510-AB7D-DAC5DB32140F} : NameServer = 192.168.0.158
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:windowssystem32driversaswSnx.sys [2012-2-10 435032]
R1 aswSP;aswSP;c:windowssystem32driversaswSP.sys [2012-2-10 314456]
R2 aswFsBlk;aswFsBlk;c:windowssystem32driversaswFsBlk.sys [2012-2-10 20568]
R3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2011-10-12 22344]
S3 A38CCID;CCID USB Smart Card Reader;c:windowssystem32driversa38ccid.sys [2012-2-10 38016]
S3 ACSSCR;ACR38 Smart Card Reader;c:windowssystem32driversa38usb.sys [2008-9-10 33536]
S3 MBAMSwissArmy;MBAMSwissArmy;c:windowssystem32driversmbamswissarmy.sys [2012-6-8 40776]
.
=============== Created Last 30 ================
.
2012-07-26 09:29:53 1409 ----a-w- c:windowsQTFont.for
2012-07-24 06:40:23 221184 ----a-w- c:windowssystem32wmpns.dll
2012-07-23 13:34:43 79872 -c----w- c:windowssystem32dllcachemsxml6r.dll
2012-07-23 13:34:42 1306624 -c----w- c:windowssystem32dllcachemsxml6.dll
2012-07-23 13:33:41 102912 -c----w- c:windowssystem32dllcachedpcdll.dll
2012-07-23 13:33:10 9728 ------w- c:windowssystem32comsdupd.exe
2012-07-23 13:33:10 46592 ------w- c:windowssystem32driversirbus.sys
2012-07-23 13:33:09 9728 ------w- c:windowssystem32rwnh.dll
2012-07-23 13:33:09 10752 ------w- c:windowssystem32smtpapi.dll
2012-07-23 13:31:59 712704 ------w- c:windowssystem32windowscodecs.dll
2012-07-23 13:31:58 346112 ------w- c:windowssystem32windowscodecsext.dll
2012-07-23 13:31:57 69120 ------w- c:windowssystem32wlanapi.dll
2012-07-23 13:31:56 276992 ------w- c:windowssystem32wmphoto.dll
2012-07-23 13:31:49 32866 ------w- c:windowsslrundll.exe
2012-07-23 13:31:46 -------- d-----w- c:windowssystem32scripting
2012-07-23 13:31:44 -------- d-----w- c:windowsl2schemas
2012-07-23 13:31:39 -------- d-----w- c:windowssystem32en
2012-07-23 13:31:36 -------- d-----w- c:windowssystem32bits
2012-07-23 13:18:08 -------- d-----w- c:windowsServicePackFiles
2012-07-23 13:15:42 294912 ------w- c:program fileswindows media playerdlimport.exe
2012-07-23 13:15:03 294912 -c----w- c:windowssystem32dllcachedlimport.exe
2012-07-23 13:01:59 95424 ------w- c:windowssystem32driversslnthal.sys
2012-07-23 12:54:33 19569 ----a-w- c:windows002876_.tmp
2012-07-23 12:53:17 -------- d-----w- c:windowssystem32ReinstallBackups
2012-07-23 10:33:36 -------- d-----w- C:bda8bd818d3861fc0ca452d9aabc
.
==================== Find3M  ====================
.
2012-07-11 13:18:45 385024 ------w- c:windowsSetup1.exe
2012-07-11 13:18:34 73216 ----a-w- c:windowsST6UNST.EXE
2012-06-08 06:46:51 40776 ----a-w- c:windowssystem32driversmbamswissarmy.sys
2011-01-26 09:18:20 2360320 -c--a-w- c:program filesICollect.exe
.
============= FINISH: 12:05:22.53 ===============

Можете ли да ми препоръчате нещо за Windows Server?

Не ми казахте какво е състоянието на "E", "SQL", "C"?

Поздрави!

"Е" -

Запазете текста в карето във файл cleanup.bat и го поставете там където се намира gmer.exe:

gmer.exe -del file "C:Program FilesInternet Explorernatxtr.dll"
gmer.exe -del file "C:WINDOWSsystem32natxtr.dll"
gmer.exe -del file "C:Program FilesMovie Makernatxtr.dll"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3snapshot"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3rp.log"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3RestorePointSize"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3drivetable.txt"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3change.log.2"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3change.log.1"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003556.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003555.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003554.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003553.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003552.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021844.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021862.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021880.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021898.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021916.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021934.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021952.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021970.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021988.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021953.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021954.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021955.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021956.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021957.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021958.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021959.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021960.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021961.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021962.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021963.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021964.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021965.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021966.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021967.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021968.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021969.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021971.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021972.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021973.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021974.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021975.mdp"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021977.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021976.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021978.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021979.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021980.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021981.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021982.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021983.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021984.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021985.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021986.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021987.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17A0024544.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17A0024545.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17A0024546.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17A0024548.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003506.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021844.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021862.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021880.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021898.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021916.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021934.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021952.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021970.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021988.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021953.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021954.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021955.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021956.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021957.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021958.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021959.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021960.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021961.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021962.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021963.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021964.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021965.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021966.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021967.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021968.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021969.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021971.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021972.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021973.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021974.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021975.mdp"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021976.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021977.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021978.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021979.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021980.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021981.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021982.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021983.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021984.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021985.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021986.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP16A0021987.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17A0024544.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17A0024545.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17A0024546.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17A0024547.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17A0024548.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17A0024549.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17change.log"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17change.log.1"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17RestorePointSize"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17rp.log"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_NTUSER_S-1-5-21-1659004503-1454471165-839522115-500"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshotComDb.Dat"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshotdomain.txt"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshotRepository"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshotRepository$WinMgmt.CFG"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshotRepositoryFS"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshotRepositoryFSINDEX.BTR"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshotRepositoryFSINDEX.MAP"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshotRepositoryFSMAPPING.VER"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshotRepositoryFSMAPPING1.MAP"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshotRepositoryFSMAPPING2.MAP"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshotRepositoryFSOBJECTS.DATA"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshotRepositoryFSOBJECTS.MAP"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_MACHINE_SAM"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_MACHINE_SECURITY"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_MACHINE_SOFTWARE"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_MACHINE_SYSTEM"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_.DEFAULT"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_NTUSER_S-1-5-18"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_NTUSER_S-1-5-19"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_NTUSER_S-1-5-20"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_NTUSER_S-1-5-21-1659004503-1454471165-839522115-1003"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_NTUSER_S-1-5-21-1659004503-1454471165-839522115-1005"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_NTUSER_S-1-5-21-1659004503-1454471165-839522115-1006"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_NTUSER_S-1-5-21-606747145-2111687655-839522115-1162"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_NTUSER_S-1-5-21-606747145-2111687655-839522115-1206"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_USRCLASS_S-1-5-19"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_USRCLASS_S-1-5-20"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_USRCLASS_S-1-5-21-1659004503-1454471165-839522115-1003"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_USRCLASS_S-1-5-21-1659004503-1454471165-839522115-1005"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_USRCLASS_S-1-5-21-1659004503-1454471165-839522115-1006"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_USRCLASS_S-1-5-21-1659004503-1454471165-839522115-500"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_USRCLASS_S-1-5-21-606747145-2111687655-839522115-1162"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP17snapshot_REGISTRY_USER_USRCLASS_S-1-5-21-606747145-2111687655-839522115-1206"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000148.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000149.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000150.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000151.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000152.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000153.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000154.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000155.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000156.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000157.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000158.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000159.mdp"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000160.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000161.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000162.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000163.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP2A0000164.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003519.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003537.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003502.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003503.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003504.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003505.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003506.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003507.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003508.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003509.sys"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003510.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003511.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003512.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003513.INI"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003514.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003515.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003516.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003517.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003518.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003520.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003521.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003522.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003523.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003524.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003525.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003526.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003527.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003528.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003529.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003530.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003531.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003532.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003533.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003534.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003535.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003536.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003538.mdp"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003539.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003540.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003541.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003542.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003543.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003544.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003545.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003546.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003547.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003548.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003549.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003550.lnk"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003551.LNK"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003552.cfg"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003553.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003554.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003555.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3A0003556.ini"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3change.log.1"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3change.log.2"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3drivetable.txt"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3RestorePointSize"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3rp.log"
gmer.exe -del file "C:System Volume Information_restore{9C1958E5-7DBB-4E72-96E0-07A9FA3066B7}RP3snapshot"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesanrwi"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesdorebzb"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesdzsyyw"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesfomjjzs"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesikxkx"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesipszuq"
gmer.exe -del reg "HKLMSYSTEMControlSet002Serviceskdyhhlazh"
gmer.exe -del reg "HKLMSYSTEMControlSet002Serviceslzwms"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesmfffg"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesntpkdtf"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicespcafhhcv"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesqdhzinvs"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesqmesibuq"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesqvgktrd"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesqwtfalt"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicessdalrb"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicessqrigdv"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicestwthyo"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesuevykawpq"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesuflssq"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesutlnimj"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesvekkfi"
gmer.exe -del reg "HKLMSYSTEMControlSet002Serviceswbceyl"
gmer.exe -del reg "HKLMSYSTEMControlSet002Servicesxeufkhini"
gmer.exe -del reg "HKLMSYSTEMControlSet002Serviceszlkhse"
gmer.exe -del reg "HKLMSYSTEMControlSet002Serviceszzjplrm"
gmer.exe -reboot

Стартирате с двоен клик съхранения пакетен файл cleanup.bat.

Внимание!!! Компютъра ви ще се рестартира!!!

Изгответе нов лог с Gmer...!

"I" - изглежда наред..! :)

Поздрави..! :)

  • 2 седмици по-късно...
  • Автор

Публикувано изображение

След като се стартира въпросния cleanup.bat

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.